www.socinvestigation.com Open in urlscan Pro
2a06:98c1:3121::a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
Submission: On May 22 via api (May 22nd 2022, 10:07:22 am UTC) from DE — Scanned from DE

Summary HTTP 179 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 20 IPs in 3 countries across 13 domains to perform 179 HTTP transactions. The main IP is 2a06:98c1:3121::a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.socinvestigation.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 22nd 2022. Valid for: a year.

This is the only time www.socinvestigation.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
57	2a06:98c1:312... 2a06:98c1:3121::a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
4	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
18	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
22	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
2	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a02:2638:1::4 2a02:2638:1::4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
14	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2600:9000:206... 2600:9000:206f:4a00:1e:a43d:b640:93a1	16509 (AMAZON-02) (AMAZON-02)
2	178.250.2.148 178.250.2.148	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
14	178.250.0.139 178.250.0.139	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
179	20

57 2a06:98c1:3121::a (United States)

ASN13335 (CLOUDFLARENET, US)

www.socinvestigation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:206f:4a00:1e:a43d:b640:93a1 (United States)

ASN16509 (AMAZON-02, US)

secure-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 178.250.0.139 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.par.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	socinvestigation.com www.socinvestigation.com	2 MB
35	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 95 tpc.googlesyndication.com — Cisco Umbrella Rank: 130	483 KB
32	criteo.net static.criteo.net — Cisco Umbrella Rank: 621 pix.eu.criteo.net — Cisco Umbrella Rank: 7541 csm.eu.criteo.net — Cisco Umbrella Rank: 7580	73 KB
15	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 44	119 KB
12	gstatic.com fonts.gstatic.com www.gstatic.com	156 KB
6	criteo.com rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 11299 ads.eu.criteo.com — Cisco Umbrella Rank: 7544 cat.nl.eu.criteo.com — Cisco Umbrella Rank: 9672	106 KB
6	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 74 www.google.com — Cisco Umbrella Rank: 7	2 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 175	207 KB
4	wp.com c0.wp.com — Cisco Umbrella Rank: 6951	42 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46	3 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 7678	1 KB
2	imrworldwide.com secure-gl.imrworldwide.com — Cisco Umbrella Rank: 1382	1 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 789	651 B
179	13

	Domain	Requested by
57	www.socinvestigation.com	www.socinvestigation.com c0.wp.com
22	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
15	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
14	pix.eu.criteo.net	ads.eu.criteo.com
14	static.criteo.net	ads.eu.criteo.com
13	pagead2.googlesyndication.com	www.socinvestigation.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
6	www.gstatic.com	googleads.g.doubleclick.net
6	fonts.gstatic.com	www.socinvestigation.com
5	www.googletagservices.com	googleads.g.doubleclick.net
4	csm.eu.criteo.net	ads.eu.criteo.com
4	c0.wp.com	www.socinvestigation.com
3	fonts.googleapis.com	googleads.g.doubleclick.net
3	www.google.com	2 redirects tpc.googlesyndication.com
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.de	pagead2.googlesyndication.com
2	cat.nl.eu.criteo.com	ads.eu.criteo.com
2	secure-gl.imrworldwide.com	ads.eu.criteo.com
2	ads.eu.criteo.com	googleads.g.doubleclick.net
2	rtb.nl.eu.criteo.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
179	20

This site contains links to these domains. Also see Links.

Domain
facebook.com
www.instagram.com
www.linkedin.com
www.abuseipdb.com
dnstwister.report
sitecheck.sucuri.net
urlhaus.abuse.ch
web.archive.org
www.facebook.com
twitter.com
pinterest.com
telegram.me
reddit.com
api.whatsapp.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-22` - `2023-05-22`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-22` - `2022-08-24`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-19` - `2022-06-18`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-11` - `2022-07-13`	3 months	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-04` - `2023-02-03`	a year	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-10` - `2022-07-04`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
Frame ID: 1F3AFCFD4BE6859D18778717EA9F9A81
Requests: 85 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20190131/zrt_lookup.html
Frame ID: 7C818815BD317FFA9C1A6A8FDEE02141
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&adk=1812271804&adf=3025194257&lmt=1653214033&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032912&bpp=3&bdt=309&idt=169&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8765114747143&frm=20&pv=2&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=183
Frame ID: DDFD9E1CE6FC67433B8DE31EB0C6C3D2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=3038390094&adf=1672079200&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032915&bpp=3&bdt=313&idt=186&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=lBLPP9MFCy&p=https%3A//www.socinvestigation.com&dtd=192
Frame ID: 2060F4EA8EC9B93D4F3DC66D9848E925
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=940879867&adf=1710922307&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032918&bpp=1&bdt=316&idt=239&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=968&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=PK995wq6DR&p=https%3A//www.socinvestigation.com&dtd=245
Frame ID: EAA9F4B45C4517B2899DDBB5B032F182
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=90&adk=4100517743&adf=1183505835&w=728&lmt=1653214033&psa=0&format=728x90&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032995&bpp=3&bdt=393&idt=178&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=606&ady=84&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=NqBMRcSVWR&p=https%3A//www.socinvestigation.com&dtd=184
Frame ID: DEF9815CD13284BA95E5F1D0DA2C1346
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D1A7B6F2C708462F81BA71FE582A21F2
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 34F3952B97165C1ECB4190FD06612969
Requests: 2 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADQL0IFVBuAAamEj8CxLbhuF1kVzO62A&u=%7CAw0uXlyxecEjUxk1%2BSQjMAdSEh6LRoKE2J8XdQjKyV4%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZWgJ4RDTbq-Wb6C9K-cesMV_WPikrq5at_ACdAcfQ797Sw_Wa6MIlhNkhmTX7hSp1RUcQkMRQ1CtIPNyrOEIiddJZ9Utqo1xzd2NA-gzVWQUX8WFP-kVIXspD1XLiGtvCko-SB0NprXMBKXm32MMsnNkZ0b1YnIFKYrkJY5SC_P7kEAfnQXBb00rAtB1EBgXvlcj6h9-z8J06Okssi87z-gi5HG4twACTpUk_fzw0n6Vj_M5ia5DVJBlA3XhUhzIKxp6CA8dIkjmjKpi2ifivJ7j6w-4fZHYlCuUCBTbIk75bx0wQSJTpw1dkgnYmuPbNd1xefvECQh7AEH3EVK1tQerllom8CHwzGwc1Xzbz1tZKCii5qd0a9zKUOfr3lrGrn3aX4xzqyxzpqiDA08Bg7JQWmzny5Z_UgqSmDJ76okN5yH5fSq-izF5JlZvHgn_kWGwCk0II8WPw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC3vgxUQuKYr2BDe6g1fAPksyaoA3JntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTE2NjM5NzU4NzAwMzI5MjOgAdW20uoDyAEJqQKAvcgMx7ixPqgDAaoEiQJP0FA-z9E5X2PWOd75lDDcywBpAicOIhD9fJ_l-GP277Ma5_GW_zY-gLnACuACJG6S2FyHAUDaYVjA_E1bTLakTt9juPduNmaKG2NzIkJbquicqlvZDrRT11DB9H4j2rqMxBTWprm8yXZ1ZcGGlxbX4ZoKknFo9PmjvQ3eoDC7w82L9L0CEXk0v84IpPbD-c3r86bjvi76n1XSvKyQ_EMpFRMobQ8Cf8AOzKlOzhsUHix7IQzWKRDhnGO8ct5-UFbLCDWL9zBIVCP9yMZYaSFnyWXP4LaTZ0ipYuQXSA6NFqrBiIHrCnX3AleqTFuWxHHKC1J3-xrmQVIFkYyeIohCGkBMg-jKvvLKgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0MTOvo4wjsYkM6edfXV6g9xDjwtQ%26client%3Dca-pub-1663975870032923%26adurl%3D
Frame ID: 14BD5F83894078E7E13FF17A0FABDDEE
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1
Frame ID: 83F28E1B411B9DF122BC13CA413D7A9F
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1
Frame ID: E2D298B3232043DF0D5343FA786AAF35
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 69063636C706F769BA43DE3DE31ABCBC
Requests: 2 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADAnwIFWOwAA5ZNjg_30HieOreLPK0Yg&u=%7CAw0uXlyxecHI9Nedf5dyrFpGy%2BkbND86AuNUMUNc01I%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC865sf8XYaxpAMkl-CecRk5DR5hBjAXM-gl7S-ti1X8SoUEDwggxP1si7CdWpdC3FqA8hWfCwBP13_esFPbWG9vRIFb5O5OaFNuUNhdGRLVxHpSxaI5MMyfuCbU504NjBvbGGe7DNwhBtbZ37ayVmA0-VoeiyUucTXLUuRdF225SdqC32P5OwCr35Y-V8yNX7gTayl-hi9DmM20RPjfBIjXpCr1FG3vb2X2XkZCAc1wHcH70i5Z3s9VS8ZLKhV-24jTh3upB0SIQVj7Jdh2wGykIqd0fB6mQ4Jrz5Zm6xn3l9ElNqboVV-qgZwUBYBKrxDGd8vzsmtyR7HMfXkVsGB3Z948lypJUNwBllaga2rZNIXoVm69jmSf-EvgZnCNxRAY48OzYMgRu89sbyv-9ESRue0VLfy-X4lzg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCgcJ0UQuKYvyEDLDH1fAPtrK5iATJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0xNjYzOTc1ODcwMDMyOTIzoAHVttLqA8gBCakCgL3IDMe4sT6oAwGqBI8CT9BSp4wXnCchpTBWW7wKYGdONfBx2Qo_dpl-jQ2i6kpnUZYX8Him2ihEZDVMYJ7ijhjFYPy8K5NbIHcHEisGUe0vfm2tq2h69DEy6JmRiBobQzopnayQjrESPHH-Gd26OcyJB7bu9fpTjt7yY-6Ctpm-bYHG3FApkUJfBH-qa_tA-gKeqDHaPe5yNTrWBd1v-BtN2bz5xGOQschYPpGj_EcX1qRdLDHQITECFGp8aGHggLXgkHY6WWEfF7OL0hvSrHOg41UwOLX_JobOG8PUjEn13O2VemRlq4Gs3bA_czaD-SkzxP6Eul6_2kcqMxDveaC8HnG8KLBZnNs4Vs6maPkohMF8s0iAxNaKCoI_poAG1KCKy6SbqKNsoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1PqxGjukeg47Emgaqn0NFKAaXlWg%26client%3Dca-pub-1663975870032923%26adurl%3D
Frame ID: 201C906FF1AFCAEBA43121EAC9DE65B8
Requests: 21 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 7BB638ECA090EE07C389EE1933C0E787
Requests: 2 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700
Frame ID: 0B8F094E9004FE5F9B8DF3E363B38583
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js
Frame ID: 3BC65D3BC8E313FC4ED140DAAD86FBF6
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js
Frame ID: 67F51DD0835B71C9B2C8D16322772D1F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

APT34 Returns with New TTPs And Delivers Malicious Files - Security Investigation

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

RightJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

right\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

179
Requests

100 %
HTTPS

79 %
IPv6

13
Domains

20
Subdomains

20
IPs

3
Countries

3273 kB
Transfer

6435 kB
Size

3
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://facebook.com/cyberaptadmin/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/soc_investigation

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/soc-investigation

Search URL Search Domain Scan URL

URL: https://www.abuseipdb.com/
Title: AbuseIPDB

Search URL Search Domain Scan URL

URL: https://dnstwister.report/
Title: Phishing Domain Search

Search URL Search Domain Scan URL

URL: https://sitecheck.sucuri.net/
Title: Sucuri Web Malware

Search URL Search Domain Scan URL

URL: https://urlhaus.abuse.ch/
Title: Urlabuse

Search URL Search Domain Scan URL

URL: https://web.archive.org/
Title: WebPage Historic Checks

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/&title=APT34+Returns+with+New+TTPs+And+Delivers+Malicious+Files
Title: Linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=APT34+Returns+with+New+TTPs+And+Delivers+Malicious+Files&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&via=Security+Investigation
Title: Twitter

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/&media=https://www.socinvestigation.com/wp-content/uploads/2022/05/APT34-Returns-with-New-TTs-And-Delivers-Malicious-Files-min1.jpg&description=APT34+Returns+with+New+TTPs+And+Delivers+Malicious+Files
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://telegram.me/share/url?url=https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/&text=APT34+Returns+with+New+TTPs+And+Delivers+Malicious+Files
Title: Telegram

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/&title=APT34+Returns+with+New+TTPs+And+Delivers+Malicious+Files
Title: ReddIt

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=APT34+Returns+with+New+TTPs+And+Delivers+Malicious+Files%20%0A%0A%20https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
Title: WhatsApp

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 138

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 151

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

179 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/ 175 KB
29 KB 5136ms
5114ms Document
text/html 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bd4613515153737782bc9f94978398d909697345f3400699b2a7a3f6be1379f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=600
cf-cache-status: DYNAMIC
cf-ray: 70f4be37ca929bd7-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 10:07:12 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Sun, 22 May 2022 10:17:07 GMT
link: <https://www.socinvestigation.com/wp-json/>; rel="https://api.w.org/", <https://www.socinvestigation.com/wp-json/wp/v2/posts/4595>; rel="alternate"; type="application/json", <https://www.socinvestigation.com/?p=4595>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TLSeQtgLHkgAooSYc6yG3O5WkLknSYNl5MmGUK%2FvspCOYXUSx3NL%2FSy5JuPF6hsohrIRoVCGA3QKAYQQsLyVCPBwRSoAYQ4lilhxIUnTMs9kaIYB6ttqDgxdny2m2Dij1hN2poGpVz6YS4WpIVV%2BVsxE44ufcrQ%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-dns-prefetch-control: on
x-litespeed-tag: f24_HTTP.200,f24_post,f24_URL.8a11d99c5b4f632278dedce902dfb4d7,f24_Po.4595,f24_,f24_MIN.47c2a64988c1820916d8fe9fa9c39f75.css
x-pingback: https://www.socinvestigation.com/xmlrpc.php

GET
H2 200 47c2a64988c1820916d8fe9fa9c39f75.css
www.socinvestigation.com/wp-content/litespeed/css/ 999 KB
126 KB 23ms
22ms Stylesheet
text/css 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b4bd7d97d5aed8fa025e7d49644693b5529b122fea1079f887bfb6b30f89ed8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 839203
cf-polished: origSize=1026956
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 12 May 2022 04:27:28 GMT
server: cloudflare
etag: W/"fab8c-5dec8f9c04b20-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yV7lf2l4w4LBwNCHkXGT2Brkw%2Fuf7t6qfP9uY%2BB4KeuTee4qLq0qg1KhSTmTnxMrsaNgz7HF5Tb2Xn3cvGZczbA9Op3hvL5wQO8XKCZgfi5MGUJZnnWY%2BUH4meybDraQ%2FFb0R8OJqgU5AOIZIxz9SKBT2Vol2jw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 70f4be57fb959bd7-FRA
expires: Sat, 11 Jun 2022 15:42:41 GMT

GET
DATA 200
OK truncated
/ 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04c1bc744720c6e7542613e933c9a0f4bbd8f6ed45a5b1924223c256430dfd7b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 111 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ae5b52b01b37efb4547c3493f75abf51dc034326bb6f1ff6fc97348065716ba

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 121 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 newspaper.woff
www.socinvestigation.com/wp-content/themes/Newspaper/images/icons/ 24 KB
17 KB 36ms
35ms Font
application/font-woff 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/themes/Newspaper/images/icons/newspaper.woff?19
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea9ad8f6ace011a694d664482cc6ca0acc2dd86a8d6b684154327ec84c0c95fd

Request headers

Referer: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 23 Jul 2021 05:13:42 GMT
server: cloudflare
age: 100880
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6hJ0paJmHBT3m91YoQTCLbonKmpUOg6hJ8%2FRqo2JP%2BVN9CnplIuO8TF5qZ84pNFmrkS9BMJW4IvMTywH75tBXRax5NruwN%2FgoX2Nt5d1tLUwwzeWub5fMJXuVwlrIXnUuVmpmU4sKQ5uIWlb062%2BpIQQjtiqUL8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 70f4be586d445a37-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 21 May 2022 11:10:24 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVc.ttf
fonts.gstatic.com/s/opensans/v29/ 31 KB
21 KB 43ms
20ms Font
font/ttf 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVc.ttf

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18b7e49a6696c5a278ac77eb98149048d0819df63ac265a2cf3abb26914d57c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 03:07:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25166
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20989
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 22 May 2023 03:07:46 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsg-1x4gaVc.ttf
fonts.gstatic.com/s/opensans/v29/ 31 KB
21 KB 34ms
10ms Font
font/ttf 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsg-1x4gaVc.ttf

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68151e32200f64f60f412bbc3ccde917a5fadb2f1a464cf7b3b77fd7675e6afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 18:15:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20532
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 21 May 2023 18:15:54 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v30/ 35 KB
20 KB 17ms
17ms Font
font/ttf 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxP.ttf

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9ef021078603005c0b08fba881f1a7eb62ef213238021f3e8a4a00daa60b9d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Mon, 16 May 2022 23:48:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 469107
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20776
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 May 2023 23:48:45 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc9.ttf
fonts.gstatic.com/s/roboto/v30/ 35 KB
20 KB 24ms
9ms Font
font/ttf 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc9.ttf

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a9a74f4455f392ec3e7499cfda6097b536bb4b7f1e529a079c3d953c08b54ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Thu, 19 May 2022 13:05:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 248525
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20828
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 May 2023 13:05:07 GMT

GET
H3 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVc.ttf
fonts.gstatic.com/s/opensans/v29/ 31 KB
20 KB 15ms
14ms Font
font/ttf 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVc.ttf

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c428add43f5bb054cb3049a19f9531d57ff37f1627cd03c04f6a59a742c95bde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 18:15:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57078
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20955
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:18 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 21 May 2023 18:15:54 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc9.ttf
fonts.gstatic.com/s/roboto/v30/ 36 KB
20 KB 14ms
14ms Font
font/ttf 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc9.ttf

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/wp-content/litespeed/css/47c2a64988c1820916d8fe9fa9c39f75.css?ver=8427e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ceb245a8f768b65c2ae250d96f5457b96e9537326da2feb2310b707736817aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Tue, 17 May 2022 17:30:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 405415
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20948
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
vary: Accept-Encoding
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 May 2023 17:30:17 GMT

GET
DATA 200
OK truncated
/ 101 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9a612722eed86936463bc8772a9d4509e0c24f22485221beaa583a60079fef2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 email-decode.min.js Show response
www.socinvestigation.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 22ms
21ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.socinvestigation.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 17 May 2022 19:29:40 GMT
server: cloudflare
etag: W/"6283f7a4-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=93coqMtoYd9VmwQ0IvuQZ1C0o8siqzdpfaI4O%2FH1Thi2tbTNS0usmfpfjiDWLS2kljfcBEZ3PJBdYui76WwA13b6MxMSiggCa38VLE4ax9NfqVrkYhsESqAxhFv35HQ3cILBN%2BryOAYldQLfXBnfuQ1gRXeVtRA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 70f4be590f1f5a37-MXP
vary: Accept-Encoding
expires: Tue, 24 May 2022 10:07:12 GMT

GET
H3 200 rocket-loader.min.js Show response
www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 22ms
22ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 17 May 2022 19:29:40 GMT
server: cloudflare
etag: W/"6283f7a4-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LUuBYy6cE6DYDthTs5XYXWjgVf7yIymG%2FTnUd7g8mSVsD%2Bh3gGhy0BafxtUDCNekJLa%2Fw%2BwDbZb4laZ08iZ1ZA20XS9IQ%2BcE5miN4vGcX8Jrif%2FfF5kzK2joASByPRgic2LONbfZo0zzCtJ%2BR5pGiMVSnO2PVZg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 70f4be590f225a37-MXP
vary: Accept-Encoding
expires: Tue, 24 May 2022 10:07:12 GMT

GET
H3 200 float-left-right.js Show response
www.socinvestigation.com/wp-content/plugins/devvn-float-left-right-ads/left-right-ads/ 2 KB
1 KB 57ms
56ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/devvn-float-left-right-ads/left-right-ads/float-left-right.js?ver=1.0.7
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bd6ef384f95c63760a90ab5e6d0ddc45ecee28a134fd869dd7d6ff629a7b274

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1565894
cf-polished: origSize=1951
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 21 Jul 2021 12:41:59 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ktiR3vxsAjPibx2MoLj3nUQqgWYyAbVIUsZ6U5iHRTWR6FYtITKJkMZRBYsvH%2FfOEmVG0%2BtieiUfyorCYQD%2FnPbpED2fpfr0MnGQOBs8AZX5SyayiZVruga9omFFz5z5d6eFlz9S7Y0Ofb4FbO45475A%2Fm0irl8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 70f4be593fb75a37-MXP
expires: Tue, 31 May 2022 07:06:23 GMT

GET
H3 200 js_files_for_front.min.js Show response
www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/ 37 KB
9 KB 62ms
61ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=328620891861006d8e6d673739daef14
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbb30b100da0e50588d20b4bc7ee0b5736716d14004e0b8e4258c084b57e24a9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 24 Jul 2021 18:25:35 GMT
server: cloudflare
age: 1821410
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FOAxDBCGk%2BELPrc%2F0g9l87QyFeeiXZq1nRtCUuKcE5wxwgw5ym2N%2FAKIoo4jbBJeXCx17Zv01MpPAcYJmVMLC57hD%2FAxGWAQJySbrkoIwr%2B4aDIsXUENimjbuJaVQOOPGatHutcqcJAXvjwMiqEwuhLClHQT8qU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 70f4be593fbc5a37-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 31 May 2022 07:06:23 GMT

GET
H2 200 comment-reply.min.js Show response
c0.wp.com/c/5.9.3/wp-includes/js/ 3 KB
1 KB 36ms
10ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.9.3/wp-includes/js/comment-reply.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
last-modified: Mon, 01 Nov 2021 21:47:13 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Mon, 22 May 2023 10:07:12 GMT

GET
H3 200 tagdiv_theme.min.js Show response
www.socinvestigation.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 257 KB
60 KB 63ms
61ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=11.1
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d036346b18bf4c27bc91f0416f8b59427e32bfc6c2724a27e6fe2e5a7b58574

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 24 Jul 2021 18:22:31 GMT
server: cloudflare
age: 45184
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TMZeUG9QI1%2BZ4urWzAthNu%2BZVndKwuct0YwCDloS2dxmyMsXdjODiAvfU74ezWd932EDAs7xLl5uvPDAuTbY9Ag61IzKG%2FLsv7V9yn2QDJG4kXqZ6UyWv0bhAoECuhjQJVuL8Nx3tcBLnTxavioyQGjJ1Um7lOQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 70f4be594fcb5a37-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 31 May 2022 06:55:41 GMT

GET
H3 200 js_posts_autoload.min.js Show response
www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/ 5 KB
2 KB 56ms
54ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/td-cloud-library/assets/js/js_posts_autoload.min.js?ver=328620891861006d8e6d673739daef14
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0dd95d9bfc689b8862a9dd8ae8166ca21df149fb24f3d0830423b66ae00d426e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 24 Jul 2021 18:25:35 GMT
server: cloudflare
age: 1821410
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZdUx0%2FaBuDlqR1rzNlv22SsrTyIB0EYQe0CCyObdQUmkDetzXjGOAWgcsdy07knc%2BRdGxHgaL5KbsSiFCvZscbe3yw3dgYAztacqKah%2FkPqdzE4N89q%2Frxprrsm79iqFa4qgaYxdNAV%2FHp6mIpTQ3ppyA%2F4hE%2Bo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 70f4be594fd15a37-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 31 May 2022 07:06:23 GMT

GET
H2 200 underscore.min.js Show response
c0.wp.com/c/5.9.3/wp-includes/js/ 19 KB
7 KB 35ms
10ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.9.3/wp-includes/js/underscore.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

4f6366518c3d992d6a9a3aee342675532822d6b1d66217df7b284bb450dbb99a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
last-modified: Mon, 01 Nov 2021 21:47:13 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Mon, 22 May 2023 10:07:12 GMT

GET
H3 200 email-subscribers-public.js Show response
www.socinvestigation.com/wp-content/plugins/email-subscribers/lite/public/js/ 2 KB
2 KB 92ms
91ms Script
application/javascript 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.socinvestigation.com/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.js?ver=5.3.15
Requested by: Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a525a2e5c92b17dc4a7f505b744c4b28084c5e538c60f1573daef91777a7f64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 315400
cf-polished: origSize=4551
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 18 May 2022 18:26:07 GMT
server: cloudflare
etag: W/"11c7-5df4d64064fae-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vN%2FgNXdzsWQbifZMmPNIu30V%2BpCdUYeHcR%2BjoJSG6m1Nr9jnYKeDcrWb8tE5663zyghJVTKR0w0LAURaCI%2B%2FuDtgiICdjc%2FHUHMM8VSfGSUxLJMpcBdS50K%2FkY%2B1H9EvFvqlK18Q4iKTTQXto07H9v8GOd5QD4c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 70f4be594fd65a37-MXP
expires: Fri, 17 Jun 2022 18:26:34 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 160 KB
56 KB 57ms
30ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1663975870032923

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9efd54ae70bb45c6b3fc08c5d766dd462c1476bbe815265d6d4a9b64a79fbc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Origin: https://www.socinvestigation.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56578
x-xss-protection: 0
server: cafe
etag: 8430143903081575555
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 22 May 2022 10:07:12 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 160 KB
56 KB 100ms
73ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57982f90e605a8cad3c510d836c5c8d087492686c420c106fcd6b06f8a8f72c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56601
x-xss-protection: 0
server: cafe
etag: 7413696500314822134
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 22 May 2022 10:07:12 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.9.3/wp-includes/js/jquery/ 11 KB
4 KB 35ms
10ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Mon, 22 May 2023 10:07:12 GMT

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/5.9.3/wp-includes/js/jquery/ 87 KB
30 KB 35ms
11ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Mon, 22 May 2023 10:07:12 GMT

GET
H3 403 wp-emoji-release.min.js
www.socinvestigation.com/wp-includes/js/ 0
0 81ms
79ms Script
text/html 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.socinvestigation.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: br
referrer-policy: same-origin
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pHnMOVKftQhe4VMI1IFG2lb61wLx2AvKtaZnYsbO5U8haaYsEgCl5etPxqRzTVtFXlupn6YKIFf%2BzeJD%2BUyEms7r9F7X4ThXDOnz0rqCMgDmh7EqPd0bBO%2Bzci%2BkqBpdVY3r7FItLQLpOH7abOosHjOTSnX0VpA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 70f4be5968b65a37-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205170101/ 310 KB
111 KB 47ms
31ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1663975870032923&plah=www.socinvestigation.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1663975870032923

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01b1ebc8a5f2f20daf8317c8badb1476bde105089ed777d998b1b7297da5a46f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113367
x-xss-protection: 0
server: cafe
etag: 2987343814338242266
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 22 May 2022 10:07:12 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220518/r20190131/ Frame 7C81 10 KB
5 KB 28ms
7ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220518/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1663975870032923

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42b853168bb627593eb95b83db66183f7b3bd442db24c37398f1958d1451acd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 50928
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4421
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 21 May 2022 19:58:24 GMT
etag: 1428802124239944296
expires: Sat, 04 Jun 2022 19:58:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 5 KB
6 KB 36ms
36ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35d22c1685889f79c4d92edd7544e5a0c2d58b8126190bc181474e518042c0ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277135
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5464
last-modified: Thu, 19 May 2022 01:57:40 GMT
server: cloudflare
etag: "1558-5df53b2ebe9d5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bNTcA4F3d01nH3RcEOodr8HlwsaNC98Pq3Ou9CbKFCzEkdeREsfqQm5tg8wqePifgpTyp0r5b1Y1YGQyRuGCepvwh%2B8MAnsA2cR5%2Fcwzfa9TSu2t7DwA9UyFxI2O2foP1OglcvmuTpxVyMrVqgs%2BDV9n246cHtQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5a9be25a37-MXP
expires: Sat, 18 Jun 2022 02:10:56 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 224 B
651 B 401ms
378ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.socinvestigation.com&callback=_gfp_s_&client=ca-pub-1663975870032923

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1663975870032923&plah=www.socinvestigation.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70444fefbc0ead30c80170a068074556e3829957824e058d7bdbfb7f85c20348

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 207
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 71ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 65ms
17ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DDFD 245 KB
57 KB 387ms
371ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&adk=1812271804&adf=3025194257&lmt=1653214033&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032912&bpp=3&bdt=309&idt=169&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8765114747143&frm=20&pv=2&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=183

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f634f4c39c597da014808f4689709393f72c3206377ed8e3a6321f7bd3d1abff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 58541
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:13 GMT
expires: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 37ms
21ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220518&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4756ac4212539b2754f490c4a076dd1a94dabbb5dc1eec78d5233865bbcdae3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10539
x-xss-protection: 0

GET
H3 200 Sysmon-Event-ID-13-to-Detect-Malicious-Password-Protected-File-unlock-and-Registry-Changes-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 11 KB
11 KB 93ms
93ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Sysmon-Event-ID-13-to-Detect-Malicious-Password-Protected-File-unlock-and-Registry-Changes-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98b4ef7085e505bfb2f5781a1d178d40b2a9f3de9f28abfd611d7707639fc6e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 879725
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10910
last-modified: Thu, 12 May 2022 05:19:58 GMT
server: cloudflare
etag: "2a9e-5dec9b584b1b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2BgT9Frs2XveJ2DzWwbFRJPqr9vb2OAwkeQ4QfVWwgs0X137qJQ%2FVx6Je0cI7m42rh3%2BeHN6YgBWH5LnvAyiwTF340mYVe5nhuVGFSXxRgfeazUiySSp1KkejvbgS0BVvfTkbxvsx%2BNN0saYAYjR%2FrB1kh2StL4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5aecc65a37-MXP
expires: Sat, 11 Jun 2022 05:34:25 GMT

GET
H3 200 ezgif-frame-008.png
www.socinvestigation.com/wp-content/uploads/2021/10/ 1 MB
1 MB 30ms
30ms Image
image/png 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/10/ezgif-frame-008.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bfed7fcc395671d82ccbeab04b29455102a75310511cd6ebfd951cbe5e0ae8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821490
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1474376
last-modified: Sun, 03 Oct 2021 02:30:40 GMT
server: cloudflare
etag: "167f48-5cd699522a3f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FIoAb8cvTXAGdwnVnAbIAJ7kTLNmznIFzS7jpNm6Jwxa7sR3EDCEii2%2BXQ7gwjci5QvmzQzBfdTSsDe77lRo6%2BjKwaC5xYItquh%2BJph6sKpNdTZYnu04abRbZS2y9L3%2B09rCD7CeOy8UMom7aih13wxIGrsMYlY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5afccd5a37-MXP
expires: Tue, 31 May 2022 07:09:38 GMT

GET
H3 200 APT34-Returns-with-New-TTs-And-Delivers-Malicious-Files-min1.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 24 KB
24 KB 171ms
171ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/APT34-Returns-with-New-TTs-And-Delivers-Malicious-Files-min1.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a8d1b4e6f8c86667984505ea5eee88cb7b75a4165dbf257263690ff55f32b19

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 340
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 24435
last-modified: Fri, 13 May 2022 05:57:51 GMT
server: cloudflare
etag: "5f73-5dede5ad03c0b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=93lrjAYitYep4KqHxdc3gsBYPGufGIBIaZkCZ%2BEl0hDjYfn1iNuIRRDd5rM1sU1T6qzRx2McTghWlp3%2FTSG8eJgvocDOmssL7xa8w9DKOMmtW0ncFbn%2BXHiVm3hoHwBYjplENnxwxxo68sUDDWQDFcvNDV7D9j0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5afcd15a37-MXP
expires: Sun, 12 Jun 2022 05:59:33 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2060 71 KB
29 KB 496ms
492ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=3038390094&adf=1672079200&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032915&bpp=3&bdt=313&idt=186&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=lBLPP9MFCy&p=https%3A//www.socinvestigation.com&dtd=192

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42d92eccf9ceba532166f67ed5985735d73d6fba67c3fcfec2d529dc65918bb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 29167
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:13 GMT
expires: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 52ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EAA9 24 KB
10 KB 593ms
592ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=940879867&adf=1710922307&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032918&bpp=1&bdt=316&idt=239&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=968&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=PK995wq6DR&p=https%3A//www.socinvestigation.com&dtd=245

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

915cbfbffed51f3cd6ea7a7f32d2b793c2b1f03f50e313e5a0e51d3f705eb51f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9891
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:13 GMT
expires: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Windows-Event-ID-5379-to-Detect-Malicious-Password-Protected-File-unlock-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 7 KB
8 KB 105ms
104ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Windows-Event-ID-5379-to-Detect-Malicious-Password-Protected-File-unlock-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 291c3d8a34473a7c8cb6fae74b608caa47d45699ec8dd8a9b795145aaf964ba8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1054633
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7438
last-modified: Mon, 09 May 2022 13:13:43 GMT
server: cloudflare
etag: "1d0e-5de93fa3ec31f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FZNy4oyJ%2F4eYuyDbn7bH5%2B%2FR12FyOwpGQA%2FFIc8vVl882SSoMs7ai8vQVnZMX4aclz4wI4IyJ2pxx53BdP7QT8CCLk17X%2BcWzjqS3XjBG%2BtuTitZOgdI%2BSt8GjsPupfyruWURZRcym1rfVuiXq6CGgNm9EWwMYc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5b6dd45a37-MXP
expires: Thu, 09 Jun 2022 05:04:56 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 49ms
30ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 44ms
25ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DEF9 24 KB
10 KB 338ms
337ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=90&adk=4100517743&adf=1183505835&w=728&lmt=1653214033&psa=0&format=728x90&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032995&bpp=3&bdt=393&idt=178&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=606&ady=84&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=NqBMRcSVWR&p=https%3A//www.socinvestigation.com&dtd=184

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6ba1c43ce69aec2bcd2df77d6ac38a92a430904d312181aecfb8abac13492466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9882
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:13 GMT
expires: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 How-FIDO-Makes-Passwordless-Authentication-Works-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 7 KB
8 KB 74ms
74ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/How-FIDO-Makes-Passwordless-Authentication-Works-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4bd1daea7c60596a7349e65a157552725386b9f0715f447c55cab8bba646f85

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1134590
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7605
last-modified: Mon, 09 May 2022 05:09:21 GMT
server: cloudflare
etag: "1db5-5de8d360848dd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hFSolG2okc1Lh8st4bnLcW6Oy1%2BrnCcZ3ZUZFKAYaLiByOoDGd6NvWLfI74AnYMjaY7I5q8d86IuhURb7Gq4h407%2BWehGgAGgsAVTMfXDUnurAcg3j%2FHpDn7scsU0LF8ZNKBYh284wX15D4MPMeeLSTS9U5MBWY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5b9e5f5a37-MXP
expires: Wed, 08 Jun 2022 05:15:14 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D1A7 13 KB
5 KB 28ms
9ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4534
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 08:51:39 GMT
expires: Mon, 22 May 2023 08:51:39 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 34F3 783 B
1 KB 59ms
16ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

279bfff8c4ae31eced3c7260fbb144b4c80750130fcf92e66d69635a774981cd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-x_eZ9WK1CFPN2ybZ6Q9lZg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-x_eZ9WK1CFPN2ybZ6Q9lZg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:13 GMT
expires: Sun, 22 May 2022 10:07:13 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 2fa-11-218x150.png
www.socinvestigation.com/wp-content/uploads/2022/05/ 10 KB
11 KB 53ms
50ms Image
image/png 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/2fa-11-218x150.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7932fc0a2f9b2e067a89e1c2e9bf410c39242d3e7764fe1d543e0b209998bc7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1479123
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10187
last-modified: Thu, 05 May 2022 07:08:28 GMT
server: cloudflare
etag: "27cb-5de3e68a2c373"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DXuBJEBsCLKLrRm%2BjflYFP3s7vRWwyxvjKLi64JXrKyvq%2BcFBKX2IjTRvxz%2BHHwoPuIc%2FXRmNRS6gCSP06A%2FEiordIpV8Y8ZXA5FsZ84O%2FhNLiCnb36Y2BT2DTDXXmCDnhe1e4WgInIfOYSbBS8xv8PGtOfTImM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5bbecb5a37-MXP
expires: Sat, 04 Jun 2022 07:15:10 GMT

GET
H3 200 What-is-Port-Forwarding-and-the-Security-Risks--218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/03/ 8 KB
8 KB 38ms
37ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/03/What-is-Port-Forwarding-and-the-Security-Risks--218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6c92b4124a497573949aea82322dee37fc8f522ef4f59ce7ef1411fbe148976

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 45076
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8051
last-modified: Mon, 07 Mar 2022 04:53:39 GMT
server: cloudflare
etag: "1f73-5d999a5dfb05d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iA%2FRCOXRfwd%2Bdap%2FF8U9wtymAh0j4AVcXfJR9gpZDz72L8OPsyE9vBsAbQnAVImjbZV8iG24RRSOsJOX5xlw%2FLh3YVTxTq6VSpP7Z4sd4%2FDLJZsLQSILeXwY7GxEfBgnyDphE5V7hWvHvuFTDjawmaPP%2FCRgNr4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5bcf085a37-MXP
expires: Sun, 05 Jun 2022 05:30:45 GMT

GET
H3 200 CVE-2021-4034-Polkit-Vulnerability-Exploit-Detection-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/02/ 8 KB
9 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/02/CVE-2021-4034-Polkit-Vulnerability-Exploit-Detection-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b438bfaec498b9ae1119d3ff6b17032850d54007c059a3642abdd61ba57536cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821402
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8341
last-modified: Mon, 07 Feb 2022 13:09:19 GMT
server: cloudflare
etag: "2095-5d76d4ef58a40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=17YcdckV4sspxnKVGmYsg7xLbR%2BY4E9KB33OGtHA4oIHnOW6gd4XJXEbr1l4j79jOwOuhCGg5YJITJH3c8c1eX%2FPem7ftkOGiJFfarDkchQVBxhJLDxIXnzYOHVDsrpxrPdOBeWRYDSj1Fn1yboqzx8wJA3IHog%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5bef5d5a37-MXP
expires: Tue, 31 May 2022 08:01:04 GMT

GET
H3 200 AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js Show response
pagead2.googlesyndication.com/bg/ Frame D1A7 35 KB
13 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00072ba470f277297fccbaec52a2c8a09688a4ce9fbb27cdbb0dc91adabd7140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 21:24:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45768
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13604
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 21 May 2023 21:24:25 GMT

GET
H3 200 Domain-Name-System-Security-Extensions-Explained-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 10 KB
10 KB 27ms
26ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Domain-Name-System-Security-Extensions-Explained-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f69a3291a73787cd086a9d165630512c48bde188f68c53ef33aba67a0f9b8696

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821401
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10157
last-modified: Mon, 31 Jan 2022 11:19:03 GMT
server: cloudflare
etag: "27ad-5d6def3b6760f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P8QGxOx93KhmqS%2BjFS1ICKCzM9nKeBNw9j1%2BitL%2Bw1XiuxxQpEvTOOFl5GL3%2Bn5QwHeNI0Pgn%2BKeBztCUbbrqKgb00qXNUNSQzs5lHl7NcLc7ls27mVEnznN1NO4%2FI6Q5qDSJnA5iANYRgNrWcCwlX6tywxg9AE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5c0fa65a37-MXP
expires: Fri, 06 May 2022 14:14:04 GMT

GET
H3 200 Detect-Most-Common-Malicious-Actions-in-the-Linux-Environment-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 6 KB
6 KB 29ms
29ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Detect-Most-Common-Malicious-Actions-in-the-Linux-Environment-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c8ef9dfc9dd03c8c921452506e8036676c465f9f4ccb62c33934319506b99e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821400
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5639
last-modified: Mon, 17 Jan 2022 05:24:24 GMT
server: cloudflare
etag: "1607-5d5c05d985db4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eeA%2Ba7yyn113Tg8p0lRwM0jA9lZCd4px5UcyLW3rLv%2BLp9kWgglctDwWUtzHVagqW36pIMnR1IxyiKQnUgf0VpMMlI49zqs7jfRsgtC3npImKordgExUIadOeVphTEup73fqygoRzMcOcd%2Bu%2FYpVQ72CO2CkmGc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5c2ffc5a37-MXP
expires: Tue, 31 May 2022 06:40:55 GMT

GET
H3 200 How-DNS-Tunneling-works-Detection-Response-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 10 KB
11 KB 28ms
28ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/How-DNS-Tunneling-works-Detection-Response-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5e0684697fa8aeb5266b010e4cf40320640ebb988b51b26017c28dc5d7e93bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821399
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10358
last-modified: Tue, 11 Jan 2022 04:40:17 GMT
server: cloudflare
etag: "2876-5d5470cc330f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iUA2OZot3Krx1ctK%2BOkpotvIf7wqPLG425Nbq69cdZbGpwwM%2F69NhbXbaKfeE%2FNXgNE1cNIZqzl7mdwgpUNqPOZF%2BZwb2jb1XXUKIrffwVYs5welfWw5lDj8UhfsWzUXq8vQjjKHYUCU80SIs80QvFdeNwXsm3E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5c48665a37-MXP
expires: Tue, 31 May 2022 07:06:30 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 34F3 0
0 56ms
55ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220518&jk=727508953606018&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET
H3 200 Microsoft-Cloud-App-Security-Anomaly-Detection-Policies-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 6 KB
6 KB 60ms
60ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-Cloud-App-Security-Anomaly-Detection-Policies-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33a765d12fcf0854f5e0cddfd2d926cf1e4de070b6e02c871398ae2e64be5b29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1651066
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5964
last-modified: Tue, 03 May 2022 03:01:43 GMT
server: cloudflare
etag: "174c-5de12ba882f86"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EiDNRlpCo%2F1I0Un7lYENpIaXJQAv4cztHmXoc3SQp3ksOECjQK7SmAAc5Mja0GlMV%2BtKjePnHDuxyTWGuTIGw71JhQbLsZsUeja1xmm66Zj2gBK4jU7ROK0DIi4xxn7hXXSTm0ECUpxdjrSMsTsrNxi9rqIHkb0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5c78c95a37-MXP
expires: Thu, 02 Jun 2022 03:12:21 GMT

GET
H3 200 Ngrok-Threat-Hunting-Detect-Hackers-at-the-End-of-the-Tunnel-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 6 KB
7 KB 29ms
28ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Ngrok-Threat-Hunting-Detect-Hackers-at-the-End-of-the-Tunnel-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6355f06ffa570821c3fe64a8a49bce87b85c533684c0ea4b002a34ab5ad33ff8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1738840
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6233
last-modified: Mon, 02 May 2022 05:37:47 GMT
server: cloudflare
etag: "1859-5de00caca3434"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gDLcHJydhNUbWZvQSXUiYzk6o7b%2FmNf%2B%2Bxs2AB8GQd1d40BjGAMEthtOHfcfPpncVOYtKCNg8aDNsbPNf42Xd3vDtzCg6VZEPySqvxcGL1oNmZBefw%2BZf%2Fd7Wii%2FuxdRS8WT2SFeumkEiqh33MvM9JYjcdqus%2Fw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5c890a5a37-MXP
expires: Wed, 01 Jun 2022 05:44:41 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D1A7 0
9 B 8ms
7ms Image
text/plain 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?-PZc1w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 Ransomware-How-Attackers-are-Breaching-Corporate-Networks-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/04/ 7 KB
8 KB 29ms
28ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/04/Ransomware-How-Attackers-are-Breaching-Corporate-Networks-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82e4100cb570e901a66a7d3887b4e1d83924cde484dd74ab5fd270094e9e71d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299992
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7504
last-modified: Fri, 29 Apr 2022 07:54:32 GMT
server: cloudflare
etag: "1d50-5ddc65a51b078"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=skQDEi0DJeRg50yb8jJcimBTq1r%2FZIkAQimKs%2BxUaJjnKCjT2HLKh515Yfakjg5BVtnfnmapUXKnmAGpcNJw8L1m%2BHyAafRyy%2Buk2rSFCFdHRYRRWJZaLThLea8TcjrfG0By%2BZdoQyLDU0sb7SJM3b3qJRVgyHo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5ca95d5a37-MXP
expires: Sun, 29 May 2022 07:59:35 GMT

GET
H3 200 Microsoft-Defender-for-Cloud-App-Security-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/04/ 7 KB
8 KB 31ms
30ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/04/Microsoft-Defender-for-Cloud-App-Security-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c1cd047827ddbff6629d0d661805864414b9bdfad8296fad9abf7f96a9e089b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 45035
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7305
last-modified: Tue, 26 Apr 2022 01:02:11 GMT
server: cloudflare
etag: "1c89-5dd843e25866d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bTbb2OqJJ2OQm5pe5X6wQ9DbICXGhLkSAZrHsZXu4Wz1kpuZmU7g%2B6KxQS%2FXOJf9d5%2FS35chlYwSdpAiTAPMl8UVogLOmRkSlbKlU8dFbWaSWQ%2BRV0ZRzYDTZyT3QWlnu6Fj%2BVPdCx31n9dFqGDGekNMA91JvLA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5cc9b75a37-MXP
expires: Thu, 26 May 2022 01:04:58 GMT

GET
H3 200 How-a-Zero-Day-Exploit-Works-Attack-Timeline-and-Defense-Techniques-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/04/ 7 KB
7 KB 33ms
32ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/04/How-a-Zero-Day-Exploit-Works-Attack-Timeline-and-Defense-Techniques-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05318716bc3b0821062096c1ab4ac651cdbc1da91a61cb388d93cac57a9f422b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 45028
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7035
last-modified: Mon, 25 Apr 2022 05:36:03 GMT
server: cloudflare
etag: "1b7b-5dd73f3b51a70"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1UtOzyiD%2BPDk3BZc0JFV7wX4axnT5%2Ffa6tktUcE%2FFxdS%2BjCDFR5V6jWFWRsQiUBNgnvRcb7DVVj07DTCM1DHibg3YUdvO%2Fb708%2FRRGiujpkt8AAKEQaNvvxe1qp1jPx9yMgMkOe79GUVNgwAnkRF4WpUeOGzJVE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5ce9f05a37-MXP
expires: Wed, 25 May 2022 05:37:59 GMT

GET
H3 200 Free-Ransomware-Decryption-tool-No-More-Ransom-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/03/ 7 KB
8 KB 39ms
37ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/03/Free-Ransomware-Decryption-tool-No-More-Ransom-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c89871faf7d2b59c948ff5e12f2d4971d7cad0e9bc23d2ab8379d8210d7f5cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 98221
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7353
last-modified: Wed, 16 Mar 2022 05:19:30 GMT
server: cloudflare
etag: "1cb9-5da4f0edb1f1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9uwQZv5xAcXvZSpWE%2BLlEDwbUwrxw7AGJgbl%2B93rmsSHcLJaksyIOEtJB7R7Jx7xqRL0HY%2FXOliW4iCiG0hejzo5rQQY23yh73vc%2BeO5Igu5Ig2oQjcZRdY34EoMyNxa6rzHUdouRqL2C5Dk%2F%2BX3Yrvc0XHnbJU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5d0a495a37-MXP
expires: Sun, 05 Jun 2022 15:13:32 GMT

GET
H3 200 How-to-Remove-Database-Malware-from-Your-Website-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/02/ 12 KB
12 KB 33ms
33ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/02/How-to-Remove-Database-Malware-from-Your-Website-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc64ca4f9ac377de71a30b14be28b0b131109a99dd385a7f4c6c4fdad46b0899

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821392
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11904
last-modified: Wed, 02 Feb 2022 09:48:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2FJKcROqyhRzRybz4X7GjrgJkbUyc5IkxG5kULRFmGdq3H45hRt9vMcS%2FGDHg3Dmbg8IB7s6XIGUYbT7KGZYlCLssHaGQYE75e0qcq9HYQmiCQ1R561mdwVkjD%2FnhWSpJ76MppCcasNOrdRRRpEFv2JdCBSrAOw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=10368000
accept-ranges: bytes
cf-ray: 70f4be5d1a775a37-MXP
expires: Fri, 12 Aug 2022 06:54:44 GMT

GET
H3 200 Most-Common-Malware-Obfuscation-Techniques-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 18 KB
18 KB 32ms
32ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Most-Common-Malware-Obfuscation-Techniques-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c927356cd5c29976ac4448b1fc160316d88a24de40405b287ec05a71e355e7ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821391
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18159
last-modified: Mon, 31 Jan 2022 11:46:10 GMT
server: cloudflare
etag: "46ef-5d6df54b793b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lEzKGYLWyqIs%2F%2Fv3FC8vzhdqMsToLQkybxIMZbDsKaXIEOKHWJ2quY%2F0PD0SG%2FlZV56qqOW856JaFfXvcnrgw4jDY5Vno6ygASsG5F3w%2FQD2JFdkMRXujzSnsJAq7YUzdDtWCpAsVW8tGO7sXwrwkuXBOj1GsO0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5d3aa55a37-MXP
expires: Tue, 31 May 2022 08:01:14 GMT

GET
H3 200 Web-Malware-Removal-How-to-Remove-Malware-From-Your-Website--218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 8 KB
9 KB 32ms
31ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/Web-Malware-Removal-How-to-Remove-Malware-From-Your-Website--218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89340946079058ec32f6a455fdf05e55fcb627a5be2617fcdb0fc0d393195608

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821390
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8551
last-modified: Mon, 31 Jan 2022 10:44:06 GMT
server: cloudflare
etag: "2167-5d6de76b4992d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YvZxejSiz7vZrCQVYmSU1JOADei2IrCzgcTFyLE3r7nfdzu8hg9q5qRTvbuGK8XOTiTMUdZS%2Fxlmwh0OBzSgA5excTY328uX30VyK2UIbRx5aTTw540nfD%2BHwhRsH0O2k4ldTxPCcGLrnmphP5w8HzWnBHa1sBY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5d5aeb5a37-MXP
expires: Tue, 31 May 2022 08:01:15 GMT

GET
H3 200 What-is-a-WAF-Web-Application-Firewall-Explained-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/01/ 12 KB
12 KB 27ms
26ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/01/What-is-a-WAF-Web-Application-Firewall-Explained-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc821678522f6a89487b0b9310900e882dfb6ecee4bb2ac39a0afdf02d1a60dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44991
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12039
last-modified: Mon, 24 Jan 2022 04:43:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OuHf5t2OIxwTAF0U4hb4GoeTJHywJt%2FCsSEbD%2B8h7HlwxoseJ8%2Fx%2FWP%2B0EvH7KwQfE2D7nUjqZLPS3wQHgUT5M9O2HP%2FFwDWAzg75pY%2Bz9iE%2BdOYhKE4cHpkSScGbK2zAjyQ31WcIIc8NLEMsuoX01G%2BJhhSwF0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: public, max-age=10368000
accept-ranges: bytes
cf-ray: 70f4be5d7b2e5a37-MXP
expires: Fri, 12 Aug 2022 08:24:58 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205170101/ 147 KB
52 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205170101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd455b773b66cff4fb7a76cda8a3c94d8741b8db6d47f72e5c5a1edfed0d661b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53590
x-xss-protection: 0
server: cafe
etag: 1039594012652652506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 Threat-Actors-Take-Over-Unpatched-VMware-Vulnerabilities-to-Full-System-Control-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 8 KB
8 KB 60ms
59ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Threat-Actors-Take-Over-Unpatched-VMware-Vulnerabilities-to-Full-System-Control-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46d2ae95dcd216118b21508d7928db63337e00b98ad01fc4d97d5572e457417d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 152872
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7843
last-modified: Fri, 20 May 2022 13:55:47 GMT
server: cloudflare
etag: "1ea3-5df71d8eb5d02"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TdKaKc6Ipq5%2BJ1X8R4DXa4F1HhRKpzahU4LaOTA%2BA614rgBXt6G0B1tlGLbGaBqtt5TSybsuUn3FeQh%2Ft9nN%2BF0mZilc6zLACTXfOOQauBc%2B1hrbjyuWPvJAfd3rfPmXYzGVPYbPXUR35oqxbYLpGckdVoxZExg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5dec5d5a37-MXP
expires: Sun, 19 Jun 2022 14:13:02 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame DEF9 3 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=90&adk=4100517743&adf=1183505835&w=728&lmt=1653214033&psa=0&format=728x90&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032995&bpp=3&bdt=393&idt=178&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=606&ady=84&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=NqBMRcSVWR&p=https%3A//www.socinvestigation.com&dtd=184

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DEF9 135 KB
42 KB 34ms
18ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35d962f44b1208c783395315f2793914f30a7df4aed795e62885e30675532830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42375
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652873336749811"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame DEF9 17 KB
7 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be78b79774b196d2500f7bd3bb3ca7269ec444158f0e545d4d313bcf40e1310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:04:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7211
x-xss-protection: 0
server: cafe
etag: 2988716039725867132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:04:55 GMT

GET
H3 200 Threat-Actors-Abuse-Microsofts-HTML-help-file-to-Deliver-Malware-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 10 KB
10 KB 58ms
58ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Threat-Actors-Abuse-Microsofts-HTML-help-file-to-Deliver-Malware-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c21e1e297e26304a6a9e4a675826243b504501c06f60e7bbd5c8722d95cb4a3e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299986
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10103
last-modified: Wed, 18 May 2022 07:46:35 GMT
server: cloudflare
etag: "2777-5df4474dff8be"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BKHijte5iEOtFfoDbRtsXBU7v5qjKVNmecN6ooCWye31qt8QwMfANypw4Uf99KwovB%2FrvBAPWKqgfcvEjskVSQQZ%2BjHTqAahcaln1%2BVLTwdL8lwrTxM%2FGt0HB7jaF6kWr%2Bof9vFsN9rJ3wtweeDk2b%2BfHxX9FM0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5e1cfd5a37-MXP
expires: Fri, 17 Jun 2022 07:50:15 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DEF9 0
0 58ms
56ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=COspBUQuKYr2BDe6g1fAPksyaoA3JntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTE2NjM5NzU4NzAwMzI5MjOgAdW20uoDyAEJqQKAvcgMx7ixPqgDAaoEhgJP0FA-z9E5X2PWOd75lDDcywBpAicOIhD9fJ_l-GP277Ma5_GW_zY-gLnACuACJG6S2FyHAUDaYVjA_E1bTLakTt9juPduNmaKG2NzIkJbquicqlvZDrRT11DB9H4j2rqMxBTWprm8yXZ1ZcGGlxbX4ZoKknFo9PmjvQ3eoDC7w82L9L0CEXk0v84IpPbD-c3r86bjvi76n1XSvKyQ_EMpFRMobQ8Cf8AOzKlOzhsUHix7IQzWKRDhnGO8ct5-UFbLCDWL9zBIVCP9yMZYaSFnyWXP4LaTZ0ipYuQXSA6NFujDqRNshenkvcu-74urYonDH1jB8TT-w-bNrCpsnZZuAsXmB_t1gAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0xNjYzOTc1ODcwMDMyOTIzGAA&sigh=dN0FHZpA4l4&uach_m=[UACH]&cid=CAQSGwCNIrLMXXzc1Qt1ZzTCyNI_rQty3WtYLCDp7BgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=90&adk=4100517743&adf=1183505835&w=728&lmt=1653214033&psa=0&format=728x90&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032995&bpp=3&bdt=393&idt=178&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=606&ady=84&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=NqBMRcSVWR&p=https%3A//www.socinvestigation.com&dtd=184
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame DEF9 0
0 82ms
23ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kOb8EN6BMNgFWp2DYgICAAAA0PL1kPLG1hoQUQuKYlLfyPYHh1rEGdpyABIAAA&wp=YooLUQADQL0IFVBuAAamEj8CxLbhuF1kVzO62A

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
server: Kestrel
server-processing-duration-in-ticks: 273162
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 14BD 145 KB
47 KB 161ms
105ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADQL0IFVBuAAamEj8CxLbhuF1kVzO62A&u=%7CAw0uXlyxecEjUxk1%2BSQjMAdSEh6LRoKE2J8XdQjKyV4%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZWgJ4RDTbq-Wb6C9K-cesMV_WPikrq5at_ACdAcfQ797Sw_Wa6MIlhNkhmTX7hSp1RUcQkMRQ1CtIPNyrOEIiddJZ9Utqo1xzd2NA-gzVWQUX8WFP-kVIXspD1XLiGtvCko-SB0NprXMBKXm32MMsnNkZ0b1YnIFKYrkJY5SC_P7kEAfnQXBb00rAtB1EBgXvlcj6h9-z8J06Okssi87z-gi5HG4twACTpUk_fzw0n6Vj_M5ia5DVJBlA3XhUhzIKxp6CA8dIkjmjKpi2ifivJ7j6w-4fZHYlCuUCBTbIk75bx0wQSJTpw1dkgnYmuPbNd1xefvECQh7AEH3EVK1tQerllom8CHwzGwc1Xzbz1tZKCii5qd0a9zKUOfr3lrGrn3aX4xzqyxzpqiDA08Bg7JQWmzny5Z_UgqSmDJ76okN5yH5fSq-izF5JlZvHgn_kWGwCk0II8WPw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC3vgxUQuKYr2BDe6g1fAPksyaoA3JntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTE2NjM5NzU4NzAwMzI5MjOgAdW20uoDyAEJqQKAvcgMx7ixPqgDAaoEiQJP0FA-z9E5X2PWOd75lDDcywBpAicOIhD9fJ_l-GP277Ma5_GW_zY-gLnACuACJG6S2FyHAUDaYVjA_E1bTLakTt9juPduNmaKG2NzIkJbquicqlvZDrRT11DB9H4j2rqMxBTWprm8yXZ1ZcGGlxbX4ZoKknFo9PmjvQ3eoDC7w82L9L0CEXk0v84IpPbD-c3r86bjvi76n1XSvKyQ_EMpFRMobQ8Cf8AOzKlOzhsUHix7IQzWKRDhnGO8ct5-UFbLCDWL9zBIVCP9yMZYaSFnyWXP4LaTZ0ipYuQXSA6NFqrBiIHrCnX3AleqTFuWxHHKC1J3-xrmQVIFkYyeIohCGkBMg-jKvvLKgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0MTOvo4wjsYkM6edfXV6g9xDjwtQ%26client%3Dca-pub-1663975870032923%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ea4d23959c2206c70ce5f52b0c220057f923764d67a152fe8a58baaba6ecf22f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:12 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=05UZwG0WsFle_KkKLzU1vRsbYV3ZSfvMwGVXUEMCZzfJeFGrw4q7U2it1TESzbgXNov2QCyiQIa_DFXTAKLqVWuPjfsNOmZN5q9NuLQ9ws8M4zdUf4vg6Cg-1t1BYg9gIpQGhkzLEynqSxzSn_ASpOwekB7BwEDhIJQlP0gSsrlA1AIBxqpPG3g9OFAy8EMKsL9zZGLxSK_G0CyH3nUtMo1YjkaSPwUWq3jnfTXZ8Pjchu79SXeQCuEZXbTnp9Yk6w8Ugw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 81874831
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 23ms
23ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 23ms
23ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.socinvestigation.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/ Frame 83F2 10 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42b853168bb627593eb95b83db66183f7b3bd442db24c37398f1958d1451acd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 41571
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4421
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 21 May 2022 22:34:22 GMT
etag: 1428802124239944296
expires: Sat, 04 Jun 2022 22:34:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/ Frame E2D2 10 KB
4 KB 13ms
13ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42b853168bb627593eb95b83db66183f7b3bd442db24c37398f1958d1451acd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.socinvestigation.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 41571
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4421
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 21 May 2022 22:34:22 GMT
etag: 1428802124239944296
expires: Sat, 04 Jun 2022 22:34:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Cyber-Actors-Steal-Credit-Card-Data-from-the-US-Business1-min3-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 10 KB
11 KB 37ms
36ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Cyber-Actors-Steal-Credit-Card-Data-from-the-US-Business1-min3-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7263c5282c491d96ae72876695538ce114f7fbd39dbf31da3e952cdc622f8d67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 355454
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10721
last-modified: Wed, 18 May 2022 06:56:56 GMT
server: cloudflare
etag: "29e1-5df43c358de3e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4wXlAXHs3MLRYD%2FFEZiBqtg3l2KEGoWJxLAr67BLaOH6TV9PZfD2%2Fm0kv9b%2F1C3gvUHlgONQNUTlfIDIYOngZ6prDA1fSt%2F7cWAUEFpdq9ieIUIH87Syt07DBX98ZYuPoStYlxWRbeuBCZFbhj%2F1emqjjCy0RSo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5e8e625a37-MXP
expires: Fri, 17 Jun 2022 07:00:33 GMT

GET
H3 200 10568014572129132979
tpc.googlesyndication.com/simgad/ Frame 2060 53 KB
53 KB 18ms
13ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10568014572129132979?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlFDrNJFfzRwDtwARSpmafgeLUvPw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=3038390094&adf=1672079200&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032915&bpp=3&bdt=313&idt=186&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=lBLPP9MFCy&p=https%3A//www.socinvestigation.com&dtd=192

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

647663010f80dcb7035daf2936c2e084a789d024cba11a9f09bf3cf3186c0da4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 00:47:36 GMT
x-content-type-options: nosniff
age: 33577
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54036
x-xss-protection: 0
last-modified: Fri, 08 Apr 2022 14:52:21 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 22 May 2023 00:47:36 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/ Frame 2060 21 KB
8 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fc62d99ca580e914d7af298fd36b6926ba2b1e6c97ab21be0f9022f9c665816

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 09:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1082
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8611
x-xss-protection: 0
server: cafe
etag: 11030745046341915621
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 09:49:11 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame 2060 3 KB
1 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:06 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2060 135 KB
41 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35d962f44b1208c783395315f2793914f30a7df4aed795e62885e30675532830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42375
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652873336749811"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame 2060 17 KB
7 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be78b79774b196d2500f7bd3bb3ca7269ec444158f0e545d4d313bcf40e1310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:04:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7211
x-xss-protection: 0
server: cafe
etag: 2988716039725867132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:04:55 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame 2060 31 KB
13 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

06460c5ac2ac6f0dcecb946cb8160e58c2c1b81977086c1ac9d2a181fc73d92a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 09:38:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1696
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12929
x-xss-protection: 0
server: cafe
etag: 1407223271217901296
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 09:38:57 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2060 0
0 59ms
58ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CJIb_UQuKYuCrCO2A1fAPk5-DkAb88LKPavGH94foD_aK8_P1LxABIOjo3IABYJXikIKgB6ABxdzu0ALIAQKoAwHIA8kEqgSXAk_QD_XO_7Sc4d556Ud5GNNHRZ30JWLHzkubKMuZHI6m3tm-NuSj_3E6JjZfWV8C7NqVK2eeHRAqwIJ_gKo-hvI7NbXRSawpY61rAk01CLN5H923YDMAxD6CEVYpByZWIYY3Od5e1FP_BzcvOGrL5giMZD_mduVahS-iqaXlUFCXJPPrTljlllcSUKHifNU-tQI_Fw6sZ0EEW8l8OL_sFsROh9IspRTnyrTRFex6QBbX90QjeW9_EnL2kCMvcgtOJuAHUXGcjEjg0rNcxoC_DNffairr_Sa_qS7huW2Bqb1hosMBGHgz239jil6cb_pzA3mVxTj1MlzLO7yLrTyuSyCbH-U9YZFNxLafDADqMc2rlEe0FI3aNcAEqLam7_kDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB6Ojka8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQi6EN0ggJCIDhgBAQARgfgAoByAsB2BML0BUBmBYBgBcBshccChoIABIUcHViLTE2NjM5NzU4NzAwMzI5MjMYAA&sigh=Ryoy_O6plcw&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=3038390094&adf=1672079200&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032915&bpp=3&bdt=313&idt=186&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=lBLPP9MFCy&p=https%3A//www.socinvestigation.com&dtd=192
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 83F2 4 KB
1 KB 59ms
16ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cba47082178b1574a96fa49c257693082949237914f632073da2f476dc81e0db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 22 May 2022 09:31:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 22 May 2022 10:07:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 83F2 205 B
743 B 51ms
10ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 06:08:37 GMT
x-content-type-options: nosniff
age: 14316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 22 May 2023 06:08:37 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 83F2 604 B
694 B 51ms
10ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 08:29:22 GMT
x-content-type-options: nosniff
age: 5871
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 22 May 2023 08:29:22 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/elements/html/ Frame 83F2 19 KB
8 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01284adf0039080c4d89732ef83440fd31b310a7bf3867b83b030f99ffd1f1c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8280
x-xss-protection: 0
server: cafe
etag: 1405619832300133377
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:07:00 GMT

GET
H3 200 Ukraine-CERT-UA-Reports-a-phishing-campaign-conducted-by-Armageddon-APT-min-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 8 KB
9 KB 41ms
40ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Ukraine-CERT-UA-Reports-a-phishing-campaign-conducted-by-Armageddon-APT-min-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b50c99e909bbeaee18b1608162c5702a240d3f1cea91b39f41443bcc019b46b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 191871
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8262
last-modified: Mon, 16 May 2022 02:21:14 GMT
server: cloudflare
etag: "2046-5df17ada914f1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VjdtT9IxHr%2BjNVXXn93ZW8OIIt4QElRFoTj%2FRqIcjhrvoyd4H5nIV21cq0dhyhjYWenlFpupN9jP7R8kL0CT%2BQiDuRKFSVDS878RAmZI66qSrI2AyXcoriSRCyeaQE65Jw6HgF0JBHO%2Bdjd31p759695HmOIeZs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5eef645a37-MXP
expires: Wed, 15 Jun 2022 02:29:25 GMT

GET
H2 200 583c04eba622323b1bc7d6fda2f57e1e.js Show response
www.gstatic.com/mysidia/ Frame E2D2 9 KB
4 KB 38ms
11ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/583c04eba622323b1bc7d6fda2f57e1e.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b968113e586107906911e61864086ba097b7b45cf857c0de3c4fd20963a90e61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 20 May 2022 13:38:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160141
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3720
x-xss-protection: 0
last-modified: Wed, 11 May 2022 08:21:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 18 Aug 2022 13:38:12 GMT

GET
H2 200 7e8d9be85afe70328c144e2bd1bc7ea5.js Show response
www.gstatic.com/mysidia/ Frame E2D2 8 KB
4 KB 37ms
11ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7e8d9be85afe70328c144e2bd1bc7ea5.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e011e5db5fba47db92bc725349b3ef86a4c8cdb49a750ab259704596e0e5ef05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 20 May 2022 13:38:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160141
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3703
x-xss-protection: 0
last-modified: Wed, 11 May 2022 08:21:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 18 Aug 2022 13:38:12 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame E2D2 8 KB
965 B 43ms
17ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 22 May 2022 09:29:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 22 May 2022 10:07:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame E2D2 2 KB
904 B 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:20 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/ Frame E2D2 21 KB
8 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fc62d99ca580e914d7af298fd36b6926ba2b1e6c97ab21be0f9022f9c665816

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 09:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1082
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8611
x-xss-protection: 0
server: cafe
etag: 11030745046341915621
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 09:49:11 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame E2D2 3 KB
1 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:06 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E2D2 135 KB
41 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35d962f44b1208c783395315f2793914f30a7df4aed795e62885e30675532830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42375
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652873336749811"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame E2D2 17 KB
7 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be78b79774b196d2500f7bd3bb3ca7269ec444158f0e545d4d313bcf40e1310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:04:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7211
x-xss-protection: 0
server: cafe
etag: 2988716039725867132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:04:55 GMT

GET
H2 200 8ac99cc5020451d5a2f944f2abe6dceb.js Show response
www.gstatic.com/mysidia/ Frame E2D2 30 KB
12 KB 36ms
12ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8ac99cc5020451d5a2f944f2abe6dceb.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f27644734b8ead437f7ae34027490dae1d295348b0fc0cdca8b839bd9ef48d46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 20 May 2022 13:38:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160140
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12291
x-xss-protection: 0
last-modified: Wed, 11 May 2022 08:21:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 18 Aug 2022 13:38:13 GMT

GET
DATA 200
OK truncated
/ Frame DEF9 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d8d70943539d5b567ebd75eb8bc2b77a2a3402b0326104a7616e8ccf7f27d2c4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6906 143 B
163 B 20ms
13ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=3038390094&adf=1672079200&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032915&bpp=3&bdt=313&idt=186&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=505&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=lBLPP9MFCy&p=https%3A//www.socinvestigation.com&dtd=192
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2522
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 09:25:11 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Detecting-and-Preventing-F5-Big-IP-Critical-Vulnerability-CVE-2022-1388-min2-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 8 KB
9 KB 38ms
34ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Detecting-and-Preventing-F5-Big-IP-Critical-Vulnerability-CVE-2022-1388-min2-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ba15f64baf79941f285fd94148e0c171b1382a53f5cbe8cd0b64a925946e77c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 534321
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8618
last-modified: Mon, 16 May 2022 01:13:25 GMT
server: cloudflare
etag: "21aa-5df16bb206c2a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FJ0J2fVS45rL98xUKIdVA15QkfN9knI36qmm%2FQNtgMk5NqBbgSwDf48GJFCBK0PDe%2Bj%2BFjdRzKfkv1z2bEI5EJY14Eh2tC%2FS1jWjaNzoKMU1gKdTtNQgTApFdkjpLJnKn6RfAAxELw%2BBqX9e14mcYu8PgkAhPWo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5f0fe85a37-MXP
expires: Wed, 15 Jun 2022 01:22:15 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame EAA9 3 KB
1 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=940879867&adf=1710922307&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032918&bpp=1&bdt=316&idt=239&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=968&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=PK995wq6DR&p=https%3A//www.socinvestigation.com&dtd=245

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:06 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EAA9 135 KB
41 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35d962f44b1208c783395315f2793914f30a7df4aed795e62885e30675532830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42375
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652873336749811"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame EAA9 17 KB
7 KB 17ms
11ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be78b79774b196d2500f7bd3bb3ca7269ec444158f0e545d4d313bcf40e1310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:04:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7211
x-xss-protection: 0
server: cafe
etag: 2988716039725867132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:04:55 GMT

GET
H3 200 Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 6 KB
7 KB 39ms
31ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51a7253d7470a5568df4c781f29ddf530a892a6a044ef91a4dafff95dcd0d265

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44938
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6203
last-modified: Mon, 16 May 2022 00:57:00 GMT
server: cloudflare
etag: "183b-5df168066e24f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c2mmT9L25YqKBTCTwGREMgJZr13b0WxZt02nIAnSgiX3dwKMmUdX%2BsD7XkGpcPaPoZQQETIP9CL1%2B%2Foerx6knT5TjY9NK9%2FJJqxj654eNfTwFVj%2FsD9kF%2BfadcUHJpQ0jDUo57hrQidsv%2F3Xffn%2F6hqJpGoUJOs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5f48785a37-MXP
expires: Wed, 15 Jun 2022 01:24:36 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 14BD 2 KB
1 KB 56ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADQL0IFVBuAAamEj8CxLbhuF1kVzO62A&u=%7CAw0uXlyxecEjUxk1%2BSQjMAdSEh6LRoKE2J8XdQjKyV4%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZWgJ4RDTbq-Wb6C9K-cesMV_WPikrq5at_ACdAcfQ797Sw_Wa6MIlhNkhmTX7hSp1RUcQkMRQ1CtIPNyrOEIiddJZ9Utqo1xzd2NA-gzVWQUX8WFP-kVIXspD1XLiGtvCko-SB0NprXMBKXm32MMsnNkZ0b1YnIFKYrkJY5SC_P7kEAfnQXBb00rAtB1EBgXvlcj6h9-z8J06Okssi87z-gi5HG4twACTpUk_fzw0n6Vj_M5ia5DVJBlA3XhUhzIKxp6CA8dIkjmjKpi2ifivJ7j6w-4fZHYlCuUCBTbIk75bx0wQSJTpw1dkgnYmuPbNd1xefvECQh7AEH3EVK1tQerllom8CHwzGwc1Xzbz1tZKCii5qd0a9zKUOfr3lrGrn3aX4xzqyxzpqiDA08Bg7JQWmzny5Z_UgqSmDJ76okN5yH5fSq-izF5JlZvHgn_kWGwCk0II8WPw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC3vgxUQuKYr2BDe6g1fAPksyaoA3JntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTE2NjM5NzU4NzAwMzI5MjOgAdW20uoDyAEJqQKAvcgMx7ixPqgDAaoEiQJP0FA-z9E5X2PWOd75lDDcywBpAicOIhD9fJ_l-GP277Ma5_GW_zY-gLnACuACJG6S2FyHAUDaYVjA_E1bTLakTt9juPduNmaKG2NzIkJbquicqlvZDrRT11DB9H4j2rqMxBTWprm8yXZ1ZcGGlxbX4ZoKknFo9PmjvQ3eoDC7w82L9L0CEXk0v84IpPbD-c3r86bjvi76n1XSvKyQ_EMpFRMobQ8Cf8AOzKlOzhsUHix7IQzWKRDhnGO8ct5-UFbLCDWL9zBIVCP9yMZYaSFnyWXP4LaTZ0ipYuQXSA6NFqrBiIHrCnX3AleqTFuWxHHKC1J3-xrmQVIFkYyeIohCGkBMg-jKvvLKgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0MTOvo4wjsYkM6edfXV6g9xDjwtQ%26client%3Dca-pub-1663975870032923%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 14BD 2 KB
1 KB 56ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 14BD 308 B
636 B 44ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 14BD 293 B
621 B 45ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 14BD 0
689 B 142ms
114ms Image
text/plain 2600:9000:206f:4a00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1653214033
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADQL0IFVBuAAamEj8CxLbhuF1kVzO62A&u=%7CAw0uXlyxecEjUxk1%2BSQjMAdSEh6LRoKE2J8XdQjKyV4%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZWgJ4RDTbq-Wb6C9K-cesMV_WPikrq5at_ACdAcfQ797Sw_Wa6MIlhNkhmTX7hSp1RUcQkMRQ1CtIPNyrOEIiddJZ9Utqo1xzd2NA-gzVWQUX8WFP-kVIXspD1XLiGtvCko-SB0NprXMBKXm32MMsnNkZ0b1YnIFKYrkJY5SC_P7kEAfnQXBb00rAtB1EBgXvlcj6h9-z8J06Okssi87z-gi5HG4twACTpUk_fzw0n6Vj_M5ia5DVJBlA3XhUhzIKxp6CA8dIkjmjKpi2ifivJ7j6w-4fZHYlCuUCBTbIk75bx0wQSJTpw1dkgnYmuPbNd1xefvECQh7AEH3EVK1tQerllom8CHwzGwc1Xzbz1tZKCii5qd0a9zKUOfr3lrGrn3aX4xzqyxzpqiDA08Bg7JQWmzny5Z_UgqSmDJ76okN5yH5fSq-izF5JlZvHgn_kWGwCk0II8WPw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC3vgxUQuKYr2BDe6g1fAPksyaoA3JntKxXNWdkfdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTE2NjM5NzU4NzAwMzI5MjOgAdW20uoDyAEJqQKAvcgMx7ixPqgDAaoEiQJP0FA-z9E5X2PWOd75lDDcywBpAicOIhD9fJ_l-GP277Ma5_GW_zY-gLnACuACJG6S2FyHAUDaYVjA_E1bTLakTt9juPduNmaKG2NzIkJbquicqlvZDrRT11DB9H4j2rqMxBTWprm8yXZ1ZcGGlxbX4ZoKknFo9PmjvQ3eoDC7w82L9L0CEXk0v84IpPbD-c3r86bjvi76n1XSvKyQ_EMpFRMobQ8Cf8AOzKlOzhsUHix7IQzWKRDhnGO8ct5-UFbLCDWL9zBIVCP9yMZYaSFnyWXP4LaTZ0ipYuQXSA6NFqrBiIHrCnX3AleqTFuWxHHKC1J3-xrmQVIFkYyeIohCGkBMg-jKvvLKgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0MTOvo4wjsYkM6edfXV6g9xDjwtQ%26client%3Dca-pub-1663975870032923%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:13 GMT
via: 1.1 c888f786e25e6e3c7dbb7e9da462d714.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-C1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-length: 0
x-amz-cf-id: g8RZqKUQj1Uj6dcLgcwikA71c8ACJO-1W_ZdEuJBfcaHmlLTvDxNAg==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 14BD 43 B
348 B 65ms
18ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=wyy7NvdilEUGzUYjtvasR3GqREeq3WXNLaUYQzDtNdm0-ZfsdhfA5PzkKiEaInO-cLwWDcYHC9j_0L9XAocXCaUlUYMGU1dcorwMEmWXmx_MPHlbzI0ux8-cx2aRn5VxNka5nfot5RgeH400Dnp4HbGbZ_-jJyzUQZTjjyAMKghljTKX5nPVYVw-TDlkWCXoHS5y38jMmSOaQ7RvGo1eV0Lgg8hsVjdSthESjRdFOgTSlpj-umYylfvSSRC1QoTUE6ltMszfeecKKO-PkzBasycg1cUfKwIyYVbAX9-s6ZXf6e9dxodMBgJQDGBBZn-2XLfolNghDDkwZ9AwyzmB6W6ZsJHHYEkYggIL0-KDG76MTCa34eXEXEMzilzsaXDnmUA9Zim7W0UK6-rqyHc5Pmwub6GT-FiE8_QpQXiz7Gi_xfYJDlUtAp4DhzSUZkq7-_sv0w

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:13 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4813908
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame EAA9 0
0 49ms
49ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CP_NuUQuKYvyEDLDH1fAPtrK5iATJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0xNjYzOTc1ODcwMDMyOTIzoAHVttLqA8gBCakCgL3IDMe4sT6oAwGqBIwCT9BSp4wXnCchpTBWW7wKYGdONfBx2Qo_dpl-jQ2i6kpnUZYX8Him2ihEZDVMYJ7ijhjFYPy8K5NbIHcHEisGUe0vfm2tq2h69DEy6JmRiBobQzopnayQjrESPHH-Gd26OcyJB7bu9fpTjt7yY-6Ctpm-bYHG3FApkUJfBH-qa_tA-gKeqDHaPe5yNTrWBd1v-BtN2bz5xGOQschYPpGj_EcX1qRdLDHQITECFGp8aGHggLXgkHY6WWEfF7OL0hvSrHOg41UwOLX_JobOG8PUjEn13O2VemRlq4Gs3bA_czaD-SkzxP7GuH8tXci2IK9zbQNsI9dEIaRTKtEWTkwSoMSOdn5in1AFblKZtYAG1KCKy6SbqKNsoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMTY2Mzk3NTg3MDAzMjkyMxgA&sigh=5avJrGN7SPs&uach_m=[UACH]&cid=CAQSGwCNIrLM_j0_6c__SsZaVto3_Y060dk4qOOZAxgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1663975870032923&output=html&h=280&adk=940879867&adf=1710922307&w=696&fwrn=4&fwrnh=100&lmt=1653214033&rafmt=1&psa=0&format=696x280&url=https%3A%2F%2Fwww.socinvestigation.com%2Fapt34-returns-with-new-ttps-and-delivers-malicious-files%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653214032918&bpp=1&bdt=316&idt=239&shv=r20220518&mjsv=m202205170101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C696x280&nras=1&correlator=8765114747143&frm=20&pv=1&ga_vid=2059720102.1653214033&ga_sid=1653214033&ga_hid=1782451663&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=266&ady=968&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761043&oid=2&pvsid=727508953606018&pem=99&tmod=1667907279&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=PK995wq6DR&p=https%3A//www.socinvestigation.com&dtd=245
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame EAA9 0
0 22ms
22ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kOb8EMz6RLgFmAKdg2ICAgAAANDy9ZDyxtYaEFALimI9K_axzSSkSxSEyAASAAA&wp=YooLUQADAnwIFWOwAA5ZNjg_30HieOreLPK0Yg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
server: Kestrel
server-processing-duration-in-ticks: 295934
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 201C 211 KB
58 KB 155ms
154ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADAnwIFWOwAA5ZNjg_30HieOreLPK0Yg&u=%7CAw0uXlyxecHI9Nedf5dyrFpGy%2BkbND86AuNUMUNc01I%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC865sf8XYaxpAMkl-CecRk5DR5hBjAXM-gl7S-ti1X8SoUEDwggxP1si7CdWpdC3FqA8hWfCwBP13_esFPbWG9vRIFb5O5OaFNuUNhdGRLVxHpSxaI5MMyfuCbU504NjBvbGGe7DNwhBtbZ37ayVmA0-VoeiyUucTXLUuRdF225SdqC32P5OwCr35Y-V8yNX7gTayl-hi9DmM20RPjfBIjXpCr1FG3vb2X2XkZCAc1wHcH70i5Z3s9VS8ZLKhV-24jTh3upB0SIQVj7Jdh2wGykIqd0fB6mQ4Jrz5Zm6xn3l9ElNqboVV-qgZwUBYBKrxDGd8vzsmtyR7HMfXkVsGB3Z948lypJUNwBllaga2rZNIXoVm69jmSf-EvgZnCNxRAY48OzYMgRu89sbyv-9ESRue0VLfy-X4lzg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCgcJ0UQuKYvyEDLDH1fAPtrK5iATJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0xNjYzOTc1ODcwMDMyOTIzoAHVttLqA8gBCakCgL3IDMe4sT6oAwGqBI8CT9BSp4wXnCchpTBWW7wKYGdONfBx2Qo_dpl-jQ2i6kpnUZYX8Him2ihEZDVMYJ7ijhjFYPy8K5NbIHcHEisGUe0vfm2tq2h69DEy6JmRiBobQzopnayQjrESPHH-Gd26OcyJB7bu9fpTjt7yY-6Ctpm-bYHG3FApkUJfBH-qa_tA-gKeqDHaPe5yNTrWBd1v-BtN2bz5xGOQschYPpGj_EcX1qRdLDHQITECFGp8aGHggLXgkHY6WWEfF7OL0hvSrHOg41UwOLX_JobOG8PUjEn13O2VemRlq4Gs3bA_czaD-SkzxP6Eul6_2kcqMxDveaC8HnG8KLBZnNs4Vs6maPkohMF8s0iAxNaKCoI_poAG1KCKy6SbqKNsoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1PqxGjukeg47Emgaqn0NFKAaXlWg%26client%3Dca-pub-1663975870032923%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

37181efd3f8cc9b4ecd6acdc31dc5518762864eaa4dca00c5c4b899bb95121be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sun, 22 May 2022 10:07:12 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=TQlEKG0WsFle_KkK_KhBvVxZJ10NuXKdy9RzzMcO3IjarZsE_hB1Oyr8_K5kpHCqM60h7AnVapm6wn0ZgSMng__BrsqMc1HNH1A6dPBqxwkLWd1NWlhlbU_ukU3mlYg6OSwi0rxpA0LQZOI9b5jD6PtuK7MjVdbnUQbDQHLwKeuCVH9YaODnHpUkj4uHifdeZxpWiJSWaK-XJiU9tyVUQmbProeBn7LheUkR-Jy9fV8ooB0b0DGpizmLs_MCP3ypV-H3SQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 133034732
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 2060 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c894c338fddff3aa5259ea0876599d1724eb4d64fb3995f74a0bdc4603e9307

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 photo-1562813733-b31f71025d54-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/11/ 6 KB
6 KB 35ms
34ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/11/photo-1562813733-b31f71025d54-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e249765e273a74656063470fe2148a7f4aed395b8731d4efe2a828c52da018d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299985
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6026
last-modified: Mon, 22 Nov 2021 04:55:22 GMT
server: cloudflare
etag: "178a-5d1596eae36c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tbl5hP6iAADAtKDxHKoB4w8aALjvmjQFAO8Qd5jFXyK9yErqzhe5etADEc1mqfa2uV86ZZAq4e5%2B%2F%2FtBqCePYxLguWXt%2Ft9%2B87wcoOkn7f7jM5stuyaqZsbS0lhbH%2BXeV5Ano7XL%2BrZmxCjV8%2Fju1aOWqUOTu1g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be5f78db5a37-MXP
expires: Tue, 31 May 2022 06:40:55 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/16724293977746283999/ Frame E2D2 4 KB
4 KB 12ms
12ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16724293977746283999/downsize_200k_v1?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541bd46059c2b8987999b59ba85e695f38663ba0c3457f15d4b63ec710f06216

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Wed, 18 May 2022 09:54:05 GMT
x-content-type-options: nosniff
age: 346388
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3670
x-xss-protection: 0
last-modified: Sun, 22 Mar 2020 15:22:27 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 18 May 2023 09:54:05 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E2D2 0
0 50ms
50ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cji7qUQuKYvGyCOPH1fAP6dKtmALJsu33aaOzmrWgDrC4lJhDEAEg6OjcgAFgleKQgqAHoAGN7OTZAsgBAakCawfToD0iqj6oAwGqBJUCT9D_NE6f7Hd_sdH4L1BXCCGpLnRascLrNJlR3FKK1L5EhRB3xnxA3FuXrSvVOSSy_gWxbSvh_9a8sXD-9audEOymcW4znvqshHirM60fW7ysNDh9leffk2kYMYyLFbXVJeXAuUsZeB-fJ6wRHMmS4ISwsplZmaxkpDyqaLR9XudNyr0bJiSfuRxQEivkdtI8KbfPZb4goqfKzs68mlKXT_AaPXl8B29ZXCkUBC5YGZ_EOhda065b46QhGLb1sEs3ay49HDbV2S5zbkyqxFdXklp_FEq29t67HW5kf-8ftPxjs655FhkUOJ_3IWL9gWsMnXVhQaU6pqiz1MMN5AXlYyx2iKgK6G3ZJyvvV_RMQOYGOGsbQMAEoMCdzOYDkgUECAQYAZIFBAgFGASAB9uTm6YBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQrvwH0ggJCIDhgBAQARgfgAoByAsB2BMNiBQF0BUBgBcBshccChoIABIUcHViLTE2NjM5NzU4NzAwMzI5MjMYAA&sigh=5PycQjA2_7U&uach_m=[UACH]&template_id=5001

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 22 May 2022 10:07:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7BB6 143 B
163 B 8ms
7ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2522
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 09:25:11 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame E2D2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4499566b0fadeeb9756c8145b76ae48f5fbe6b6e235299dad786d05df5aa99f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 0B8F 6 KB
670 B 45ms
28ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dbfffa2ccca810c8921d8ff5d03714c06b4646838e8d96c0de4f05be3561de16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 22 May 2022 09:38:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 22 May 2022 10:07:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame 0B8F 2 KB
904 B 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:20 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/ Frame 0B8F 21 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fc62d99ca580e914d7af298fd36b6926ba2b1e6c97ab21be0f9022f9c665816

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 09:49:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1082
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8611
x-xss-protection: 0
server: cafe
etag: 11030745046341915621
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 09:49:11 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame 0B8F 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 367
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:01:06 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0B8F 135 KB
41 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35d962f44b1208c783395315f2793914f30a7df4aed795e62885e30675532830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42375
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652873336749811"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 22 May 2022 10:07:13 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/ Frame 0B8F 17 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220518/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be78b79774b196d2500f7bd3bb3ca7269ec444158f0e545d4d313bcf40e1310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:04:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7211
x-xss-protection: 0
server: cafe
etag: 2988716039725867132
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 05 Jun 2022 10:04:55 GMT

GET
H3 200 8ac99cc5020451d5a2f944f2abe6dceb.js Show response
www.gstatic.com/mysidia/ Frame 0B8F 30 KB
12 KB 25ms
9ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8ac99cc5020451d5a2f944f2abe6dceb.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f27644734b8ead437f7ae34027490dae1d295348b0fc0cdca8b839bd9ef48d46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 20 May 2022 13:38:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160140
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12291
x-xss-protection: 0
last-modified: Wed, 11 May 2022 08:21:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 18 Aug 2022 13:38:13 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 14BD 12 KB
6 KB 18ms
18ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 14BD 7 KB
7 KB 65ms
17ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=176&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=256&s=Ztz4HcK_1CUe8izFWU-TMUXT

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2a29e79bd75cc83eade181c4acc1c198786539997766b648bc21ed5aa7698408

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28753674
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7142
expires: Thu, 20 Apr 2023 05:15:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 14BD 1 KB
1 KB 68ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoBKA_Bundeskriminalamt_4558DE.gif%3Feb%3D1&v=3&w=800&s=DI0SONUVXrdIf4n2KRU4NSEh&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1276659
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1266
expires: Mon, 06 Jun 2022 04:44:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 14BD 400 B
662 B 65ms
17ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2FlogoDB_Mobility_Logistics_AG_60544DE.gif%3Feb%3D1&v=3&w=800&s=0y_71H41LXRUcFG_iY9j6SKC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

42c9e4f9d8c14ea0ecac49e147f029a6bb58b69e544bd63667e5b0e64169f631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=459173
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 400
expires: Fri, 27 May 2022 17:40:07 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 14BD 0
128 B 63ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=05UZwG0WsFle_KkKLzU1vRsbYV3ZSfvMwGVXUEMCZzfJeFGrw4q7U2it1TESzbgXNov2QCyiQIa_DFXTAKLqVWuPjfsNOmZN5q9NuLQ9ws8M4zdUf4vg6Cg-1t1BYg9gIpQGhkzLEynqSxzSn_ASpOwekB7BwEDhIJQlP0gSsrlA1AIBxqpPG3g9OFAy8EMKsL9zZGLxSK_G0CyH3nUtMo1YjkaSPwUWq3jnfTXZ8Pjchu79SXeQCuEZXbTnp9Yk6w8Ugw&sds=2&rev=81571&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 14BD 2 KB
1 KB 16ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 14BD 2 KB
1 KB 19ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:13 GMT

GET
H3 200 mitre-attack-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/03/ 4 KB
5 KB 33ms
33ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/03/mitre-attack-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94c8fd89363e3fab34824ecaa6cbe2ed9b97970ecc55c8f64b52a0a056a1de99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299985
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4162
last-modified: Wed, 02 Mar 2022 00:58:35 GMT
server: cloudflare
etag: "1042-5d931c7f9e371"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=45UnWHynhd%2BgCVl3dtn%2BbArB9Trz6fxPTM4FP8FIo2PTg8CQvGn156dSQD0ayMYWCq9sr8BQEVToEKsq0Lrfbw21t7rmgzWmzCJrs%2FnFmR4tVqSXd5pRFabowLAr8dWJVRLWQEGNpb8UHcXEEJ9HYaBZXRAg7V8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be601a9c5a37-MXP
expires: Tue, 31 May 2022 07:35:12 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6906
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

79ms
79ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 10:07:14 GMT
expires: Sun, 22 May 2022 10:07:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 10:07:14 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js Show response
pagead2.googlesyndication.com/bg/ Frame 3BC6 35 KB
13 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00072ba470f277297fccbaec52a2c8a09688a4ce9fbb27cdbb0dc91adabd7140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 21:24:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45768
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13604
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 21 May 2023 21:24:25 GMT

GET
H3 200 crown-jewels-cyber-security-mitre-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/08/ 9 KB
10 KB 61ms
61ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/08/crown-jewels-cyber-security-mitre-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 364b5d98bead0ec08dd588f03c19a7eb6761b38200746ccc2fd290edc9863668

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821382
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9347
last-modified: Wed, 11 Aug 2021 12:50:09 GMT
server: cloudflare
etag: "2483-5c9480efab00a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1KWp2cdSVnCUqICa%2BYIJfuL1OJuMor%2F353DV8OuULqXwHJlpyRHE6y%2B8IJUHpUyB2g1Mkic3lW94f1kyKre6aU0%2FWptg0AnMxIktGsqM9iFhuQhnYCsX0b%2FZNy5buEdzCSEbrTYqa46lgKp9XE64YU0n4wmXcoE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be608ba65a37-MXP
expires: Tue, 31 May 2022 08:01:24 GMT

GET
H3 200 Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 6 KB
7 KB 40ms
39ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Mapping-MITRE-ATTCK-with-Window-Event-Log-IDs-min1-218x150.jpg
Requested by: Host: c0.wp.com
URL: https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51a7253d7470a5568df4c781f29ddf530a892a6a044ef91a4dafff95dcd0d265

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44939
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6203
last-modified: Mon, 16 May 2022 00:57:00 GMT
server: cloudflare
etag: "183b-5df168066e24f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AqeVqCaTbjm2wfFGFk3Z%2BLOR8g5OrzPpkt2NVGB8gc4%2FDI7Ac9G8nxRbp7B8OeZkPgfWdRcj34dltBRstZqtzot6EZkychnaXdYDOXT%2FPabktNUokF%2FDll9jJY5sBFbWvb3eoep37GSOi8EKxCARXmWRevgdDvo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be60ac165a37-MXP
expires: Wed, 15 Jun 2022 01:24:36 GMT

GET
DATA 200
OK truncated
/ Frame EAA9 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8516a612b549e9392064af18dbf9b9a328f22bbbf1d5977f60707dae7726220

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 201C 2 KB
1 KB 22ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADAnwIFWOwAA5ZNjg_30HieOreLPK0Yg&u=%7CAw0uXlyxecHI9Nedf5dyrFpGy%2BkbND86AuNUMUNc01I%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC865sf8XYaxpAMkl-CecRk5DR5hBjAXM-gl7S-ti1X8SoUEDwggxP1si7CdWpdC3FqA8hWfCwBP13_esFPbWG9vRIFb5O5OaFNuUNhdGRLVxHpSxaI5MMyfuCbU504NjBvbGGe7DNwhBtbZ37ayVmA0-VoeiyUucTXLUuRdF225SdqC32P5OwCr35Y-V8yNX7gTayl-hi9DmM20RPjfBIjXpCr1FG3vb2X2XkZCAc1wHcH70i5Z3s9VS8ZLKhV-24jTh3upB0SIQVj7Jdh2wGykIqd0fB6mQ4Jrz5Zm6xn3l9ElNqboVV-qgZwUBYBKrxDGd8vzsmtyR7HMfXkVsGB3Z948lypJUNwBllaga2rZNIXoVm69jmSf-EvgZnCNxRAY48OzYMgRu89sbyv-9ESRue0VLfy-X4lzg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCgcJ0UQuKYvyEDLDH1fAPtrK5iATJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0xNjYzOTc1ODcwMDMyOTIzoAHVttLqA8gBCakCgL3IDMe4sT6oAwGqBI8CT9BSp4wXnCchpTBWW7wKYGdONfBx2Qo_dpl-jQ2i6kpnUZYX8Him2ihEZDVMYJ7ijhjFYPy8K5NbIHcHEisGUe0vfm2tq2h69DEy6JmRiBobQzopnayQjrESPHH-Gd26OcyJB7bu9fpTjt7yY-6Ctpm-bYHG3FApkUJfBH-qa_tA-gKeqDHaPe5yNTrWBd1v-BtN2bz5xGOQschYPpGj_EcX1qRdLDHQITECFGp8aGHggLXgkHY6WWEfF7OL0hvSrHOg41UwOLX_JobOG8PUjEn13O2VemRlq4Gs3bA_czaD-SkzxP6Eul6_2kcqMxDveaC8HnG8KLBZnNs4Vs6maPkohMF8s0iAxNaKCoI_poAG1KCKy6SbqKNsoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1PqxGjukeg47Emgaqn0NFKAaXlWg%26client%3Dca-pub-1663975870032923%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 201C 2 KB
1 KB 22ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 201C 308 B
636 B 26ms
26ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 201C 293 B
621 B 26ms
25ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 201C 0
690 B 309ms
308ms Image
text/plain 2600:9000:206f:4a00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1653214033
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YooLUQADAnwIFWOwAA5ZNjg_30HieOreLPK0Yg&u=%7CAw0uXlyxecHI9Nedf5dyrFpGy%2BkbND86AuNUMUNc01I%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC865sf8XYaxpAMkl-CecRk5DR5hBjAXM-gl7S-ti1X8SoUEDwggxP1si7CdWpdC3FqA8hWfCwBP13_esFPbWG9vRIFb5O5OaFNuUNhdGRLVxHpSxaI5MMyfuCbU504NjBvbGGe7DNwhBtbZ37ayVmA0-VoeiyUucTXLUuRdF225SdqC32P5OwCr35Y-V8yNX7gTayl-hi9DmM20RPjfBIjXpCr1FG3vb2X2XkZCAc1wHcH70i5Z3s9VS8ZLKhV-24jTh3upB0SIQVj7Jdh2wGykIqd0fB6mQ4Jrz5Zm6xn3l9ElNqboVV-qgZwUBYBKrxDGd8vzsmtyR7HMfXkVsGB3Z948lypJUNwBllaga2rZNIXoVm69jmSf-EvgZnCNxRAY48OzYMgRu89sbyv-9ESRue0VLfy-X4lzg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCgcJ0UQuKYvyEDLDH1fAPtrK5iATJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0xNjYzOTc1ODcwMDMyOTIzoAHVttLqA8gBCakCgL3IDMe4sT6oAwGqBI8CT9BSp4wXnCchpTBWW7wKYGdONfBx2Qo_dpl-jQ2i6kpnUZYX8Him2ihEZDVMYJ7ijhjFYPy8K5NbIHcHEisGUe0vfm2tq2h69DEy6JmRiBobQzopnayQjrESPHH-Gd26OcyJB7bu9fpTjt7yY-6Ctpm-bYHG3FApkUJfBH-qa_tA-gKeqDHaPe5yNTrWBd1v-BtN2bz5xGOQschYPpGj_EcX1qRdLDHQITECFGp8aGHggLXgkHY6WWEfF7OL0hvSrHOg41UwOLX_JobOG8PUjEn13O2VemRlq4Gs3bA_czaD-SkzxP6Eul6_2kcqMxDveaC8HnG8KLBZnNs4Vs6maPkohMF8s0iAxNaKCoI_poAG1KCKy6SbqKNsoAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1PqxGjukeg47Emgaqn0NFKAaXlWg%26client%3Dca-pub-1663975870032923%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4a00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:14 GMT
via: 1.1 c888f786e25e6e3c7dbb7e9da462d714.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-C1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-length: 0
x-amz-cf-id: e6A918XVEzMPDH5C377SedKPYQMXVT5XUChxFdi6VTzFjeKcutaqMg==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 201C 43 B
347 B 26ms
26ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=kyj8UKIgar3PdS5R9BM-mVDRxQVH97LbUPBFBlne_Jjq4_bPxmix4qau2QEvv6An7mqpIL-d9McdWAZ3ArdlUxGJ2EgPnmGkg1PFgxGciw_0u9aZ3tTLBGc6By0OGIdgqIDEC_6v7VL5cxAq7b90QXf2OlB7EU1jWTkRABPWxPvInXTsdCyCTDC-17ZhQtQ4Z_rmfUIkVDNDrmAC3W73RnabR7B4mz-Tzb9DNOTmqTPEz4DhwpetI7UsrfWw8AUDCTggOhQilBJIjsqmsbnUo1hn2ycumzAFRsbfm6mh2XPv3komaQnzKdiDxMhS5ComJn9tstL4Q-8hk3pVsJwlp5-8XaBzPlnszFHAiutC_o8H3bfffXeYGvPeiLFnSZwz_9UfgzFAGsts3Ng6OTtaSKvGp2J5uitF5gy7qe0mz2PduJsRaH68DcVfGNjSDDumG_0m-Q

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:13 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3288948
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 64ms
64ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220518&jk=727508953606018&bg=!IiGlIWXNAAZ4vKt9WLw7ACkAdvg8Wl1e7AoeFDyuGTJAuKuqGaor5Mb4hNmCoqe66t6XAxtJLnCqyQIAAABhUgAAAAJoAQcKAIVY3uW0o4eh-sgq7ke1avpfoRY9hnSg8iofXnxFE6bBOx3AZV86vu101zaD-uXf1yqeNXPYovdNud9MZilYkWe8HzGfpaMAOtSVJIPmO5MSQVnoyRKR2i6U-xqUqfVk4Gu-etwejAX5EYCdVaaXZy3ld3hwyZdp7Bgrkkrd_j0wX7ywyw8_mQK4owO0NpwvQ2UIbBuQEi5OhIJk6Zxs6YxJdv1M9C1-qkNRsrRUS4doHFHxIyJh7eD20LPyoDATtNZ7lPxBiFaSwCk4jrJvIoKJfGVIdDt4a1Tt3-xcLFH4OasW2ieHpMm3-JnpvpZtUvfBxCmsp4Ae0MB-Iim_ZypkiPdIaUFmWTmxfzmFkp41X_SKwypLAsBxQwJjZfI5anP5i03xhMxbwRjTB85WIkYL2u_DCyUtugkHxupKDjoUluNR5DHDPcs3QncvRG4loGrcaH4PgJLVJ5q0u4VIWW9gdI3HMO75aH-a5bwDid58Rg--qXkO6X1TmcvnJTH6cDJel_sWPml4rUgA-zvLEpy99HboUpc9B4LMsQe-oFsLy0zg4XnoBgWCjV92RqspS9-bdZPpDGgPsCxzAU8u8FAYr_zqs1QC3KyGkd_eL1b2ZtMizzP0F1A3jNdYlZKZOC3BkSa56_0ilz957kTbujWd1Hjk0wvtaLqkd6k7_l9mouuDBmM7wv_2tvw9SyuVqnzI-6RQbP8OwcsC68Obh4l8LTlOtrrAXYIxtx2ZJXVpMhNZBh1vm1nqVA0KOKFTcMevb2WHgf7sUp9fGVcgtEFY-HItxQh1nrAWvB_aoZdnIQ1Qdu3Jrrx68p6uZZ-vEH5q0AmKYSazadWdNefTIsZqZddNq_Gt6-RW8yUiK7FTs10RR0TfJl3x2eHqNDFaYMdjHA_Yc-FmB3N1TfTsr_akS6xgMwJsbzjFQRgke7mvR1z_fU7U4rgS19bbvXOgsWjcV8TNhqgKfdr8xsvjhitnnffo6IN2U7IKG-OvJxtv22XkQid0VJMTSjgAC35igkKEmOIdqyGzf8zPcKd0YAzyFeSxdu0oUez2-89MHJsnanaamvPJvc1j1y9Fb2p8CL0osBoIddvSd4yOo6FL_qmW
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

GET
H3 200 photo-1562813733-b31f71025d54-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/11/ 6 KB
6 KB 36ms
36ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/11/photo-1562813733-b31f71025d54-218x150.jpg
Requested by: Host: c0.wp.com
URL: https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e249765e273a74656063470fe2148a7f4aed395b8731d4efe2a828c52da018d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299986
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6026
last-modified: Mon, 22 Nov 2021 04:55:22 GMT
server: cloudflare
etag: "178a-5d1596eae36c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fXJUI4nYMUC3aXEVepe4W2UxqXqNBQ6coL%2FYK4U%2FuZAcZt4MvYhXCw8xKpFMk81iU%2F%2FDLA3QWU%2BJHOObUAUyuh0Ndcv46f29Y%2FJS9KkiNoBtR6COWg05dYyioeApr2pKZfs6mSdgmXoouk984YnorqWdDTKi8R0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be610d255a37-MXP
expires: Tue, 31 May 2022 06:40:55 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7BB6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

80ms
80ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 10:07:14 GMT
expires: Sun, 22 May 2022 10:07:14 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 22 May 2022 10:07:14 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 mitre-attack-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/03/ 4 KB
5 KB 34ms
33ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/03/mitre-attack-218x150.jpg
Requested by: Host: c0.wp.com
URL: https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 94c8fd89363e3fab34824ecaa6cbe2ed9b97970ecc55c8f64b52a0a056a1de99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299986
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4162
last-modified: Wed, 02 Mar 2022 00:58:35 GMT
server: cloudflare
etag: "1042-5d931c7f9e371"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=okg05VdIJJ%2BhsWAe34E0%2FEfruIBJy9RxC2ZFCuKzSiNkAa2QbSx7OF7sa%2FUcJ9%2B8nztBuW%2F4VTnB12b1zmxmoDYXb23FTOuo3QQQoDpEE4lSGquKYgyw%2FXpp5HMNwzo8NV6uKcQ9H59qt7pJhTzQofMKjg%2FMrGQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be618e945a37-MXP
expires: Tue, 31 May 2022 07:35:12 GMT

GET
H3 200 AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js Show response
pagead2.googlesyndication.com/bg/ Frame 67F5 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js

Requested by

Host: www.socinvestigation.com
URL: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00072ba470f277297fccbaec52a2c8a09688a4ce9fbb27cdbb0dc91adabd7140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sat, 21 May 2022 21:24:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45769
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13604
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 21 May 2023 21:24:25 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 201C 12 KB
6 KB 17ms
15ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 1 KB
1 KB 17ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1276659
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1266
expires: Mon, 06 Jun 2022 04:44:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 7 KB
7 KB 21ms
14ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=556&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F05c244b8e1cf40f39dbba9559c8c38e9_blue.png&v=3&w=196&s=oNGP9mXfdQyD0qXhWvys9Xbc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

bfcd7a262745ac2a8520d46dbe261c5db424c001970e9ebe83c440bfb48454f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=29976173
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6722
expires: Thu, 04 May 2023 08:50:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 2 KB
2 KB 24ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FG%2FlogoGlobal-Legal-Entity-Identifier-Foundation-GLEIF-146515DE.gif%3Feb%3D1&v=3&w=800&s=zABmv7x0X-Tg7Jdipdn6E0h5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3df7758fd745a0c7a327e276992b0b1749aa864daf8395e553a9851007cab060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1206943
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1642
expires: Sun, 05 Jun 2022 09:22:57 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 2 KB
3 KB 22ms
17ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FC%2FlogoRheinmetall-Electronics-GmbH-55533DE-2106231724.gif%3Feb%3D1&v=3&w=800&s=oKRrDAzZCfI8m4rwMu3ePag8&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

cc5e65f3bf4a6f565b2e549b9b401450a1e7d283ffe50dd4a906b5375808b851

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=1173420
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2446
expires: Sun, 05 Jun 2022 00:04:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 5 KB
5 KB 23ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FF%2FlogoOrnua-Deutschland-GmbH-Kerrygold-54784DE-2112221059.gif%3Feb%3D1&v=3&w=800&s=DI4a5VmI6d6uKKzYMnMDU0em&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

456de4deb42b59c2640870db0d53e64ae9b7955b0787b411e46d590bffa5ff52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=135514
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5036
expires: Mon, 23 May 2022 23:45:48 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 2 KB
2 KB 34ms
30ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F2%2FlogoAsseco-Solutions-AG-33650DE-2203011002.gif%3Feb%3D1&v=3&w=800&s=7ICBVE9tlgrIgWRmrkW4axBZ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

42b4d722cc51360e4ff545d54ac1ffa3f1f333bebfee92ef064e53e158d11b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=804567
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2090
expires: Tue, 31 May 2022 17:36:42 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 7 KB
8 KB 25ms
22ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FE%2FlogoCarl-Rumpel-GmbH-204917DE-2203241135.gif%3Feb%3D1&v=3&w=800&s=M14anaj-njGfBMze6XlEa2s9&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

4a977f0cb5fd0f9222f6e9c83719c1c74cf7cf8d75e89420d8dad3fba5617312

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7552
expires: Sun, 22 May 2022 10:07:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 2 KB
2 KB 33ms
30ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F4%2FlogoOatly-Germany-GmbH-207197DE.gif%3Feb%3D1&v=3&w=800&s=3P86wAcVa1aES5XMAr_TCNIe&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

adbe3fd3360442fa6f09419065baea9ad3bdba01aa0520c7f0524210bf2d5ca5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1109315
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1964
expires: Sat, 04 Jun 2022 06:15:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 5 KB
5 KB 24ms
21ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoHMS-Analytical-Software-GmbH-27086DE.gif%3Feb%3D1&v=3&w=800&s=dyFGUDy19sifCGgNm-U6_Goo&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

3d51f9a3d934599bf63c7c09c1af0158c0b9d6e7d73fb98a00f7f989b3b90edc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2943
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4774
expires: Sun, 22 May 2022 10:56:17 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 201C 2 KB
2 KB 33ms
30ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FW%2FlogoWARDOW-GmbH-111562DE.gif%3Feb%3D1&v=3&w=800&s=je8Iw0LvfnIL2zGeKcm22XZS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

46b9a5901111b1edd678afe1cb94d83bf348f56c7b25a64e893ecf1260a996e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:13 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=409543
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2020
expires: Fri, 27 May 2022 03:52:57 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 201C 0
127 B 17ms
14ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=TQlEKG0WsFle_KkK_KhBvVxZJ10NuXKdy9RzzMcO3IjarZsE_hB1Oyr8_K5kpHCqM60h7AnVapm6wn0ZgSMng__BrsqMc1HNH1A6dPBqxwkLWd1NWlhlbU_ukU3mlYg6OSwi0rxpA0LQZOI9b5jD6PtuK7MjVdbnUQbDQHLwKeuCVH9YaODnHpUkj4uHifdeZxpWiJSWaK-XJiU9tyVUQmbProeBn7LheUkR-Jy9fV8ooB0b0DGpizmLs_MCP3ypV-H3SQ&sds=2&rev=81571&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 22 May 2022 10:07:13 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 201C 2 KB
1 KB 22ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 201C 2 KB
1 KB 21ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 17 May 2023 10:07:14 GMT

GET
H3 200 crown-jewels-cyber-security-mitre-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/08/ 9 KB
10 KB 29ms
29ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/08/crown-jewels-cyber-security-mitre-218x150.jpg
Requested by: Host: c0.wp.com
URL: https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 364b5d98bead0ec08dd588f03c19a7eb6761b38200746ccc2fd290edc9863668

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821382
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9347
last-modified: Wed, 11 Aug 2021 12:50:09 GMT
server: cloudflare
etag: "2483-5c9480efab00a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3TYe0%2BmKGwi9A7B%2BBF8E5mvpUn7lcQrNj75FtMsPOGaxgYJAmQT1qm910pXCyUtyngf%2BEEMJ1NhDxhi%2F%2FcjGMMu9WC5KKCGhZnhg4DQc1IniFVi%2B183zQFdRdkQztSnj%2Fe4%2Fq859GXMNs2cXdOadR59%2BbjBU3AU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be61efaa5a37-MXP
expires: Tue, 31 May 2022 08:01:24 GMT

GET
H3 200 red_canary-1-218x150.png
www.socinvestigation.com/wp-content/uploads/2021/06/ 10 KB
11 KB 33ms
32ms Image
image/png 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/06/red_canary-1-218x150.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67fb6e7af56698a9718d38afa180cf8e5b7017dd397a4b1689a542bb6afff901

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44914
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10498
last-modified: Wed, 02 Mar 2022 03:16:08 GMT
server: cloudflare
etag: "2902-5d933b3e1cdd2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KsoXSOZFTHpOWjdmNzigQ1%2Bb%2FGdr57At9O1jhQlVVOsVBsRU1JuzyEXxDUGubdIRxQIatCersi%2BGJjAOlAq4nFfzK7OZ3lQ%2ByBTJz72xNv9hc6PXzOIYJt631yqwJ0iFubrmjyp6%2FWpCAohhcwuILb3fo4%2BhmYE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be6258b55a37-MXP
expires: Tue, 31 May 2022 06:40:55 GMT

GET
H3 200 Google-SMTP-Relay-Abused-to-Deliver-Phishing-Emails1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 7 KB
7 KB 31ms
31ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Google-SMTP-Relay-Abused-to-Deliver-Phishing-Emails1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1794a3cf13f7bb6847ad633beedd9dc4c09773165073a6718b73d1314d4b87a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1565860
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 7080
last-modified: Wed, 04 May 2022 05:55:05 GMT
server: cloudflare
etag: "1ba8-5de29445788a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t%2FVOnD7e8BGwXbgJtnnxfzhtOIYMZDCqI%2F1rfev5RT5KT79a9eMT%2BlPr%2FbPDDU6IzFeuHixV6LrZ1K34NhlVOprPvaEoJXGyw%2Ba8j6x6BITXbm6MgLgRp6xFR5yRV32NBsQFXJZt8278tO9%2FhC7yreokAgR33%2F8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be6278f75a37-MXP
expires: Fri, 03 Jun 2022 06:00:38 GMT

GET
H3 200 email_header_analysis_-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/09/ 7 KB
7 KB 30ms
29ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/09/email_header_analysis_-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5198e742cbc39d3d391f98807d571495206da0a8d95f854b493beaa2950ff3f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44899
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6911
last-modified: Fri, 17 Sep 2021 05:46:41 GMT
server: cloudflare
etag: "1aff-5cc2a74a4a12c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CswFL13eulwx594BPgWwBUT%2FHu9USus3k%2Bznt%2BfDx34yOZGDAyD9ysmi35NacB7VzNQlMs46rDtqU0OXwK0mvujcuycfslq%2Flft2r6PhaIwYBHm2EQlHfkFaqGisGNAAnbMl0NNpsTB8b1clerK%2FHnIG%2F7eAl7Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be6289425a37-MXP
expires: Tue, 31 May 2022 06:40:55 GMT

GET
H3 200 Proxyshell-Vulnerability-Large-Exploitation-of-Microsoft-Exchange-Servers-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/11/ 9 KB
10 KB 32ms
32ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/11/Proxyshell-Vulnerability-Large-Exploitation-of-Microsoft-Exchange-Servers-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 807c988638b1ef9530acb4eb4eeb9c34e64a4a681b7423b97cf87f24a49e042a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821378
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9239
last-modified: Fri, 26 Nov 2021 06:30:04 GMT
server: cloudflare
etag: "2417-5d1ab38b1a4c5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2GpS1KbDgcZZKk%2F30W2g4WU1k%2B7IiFbJQHGCOQYgbe%2BYBqaNPyMNxvJngN4bYPq5dWB0OFPH%2BpMtkUFWnyudhQtokF4PPVh8TYWc3p1XzA8NFLm2KQ75uFVbnj4whPdV8zI2mckT%2B%2F0ogGF%2FFcHrdnQD5gyISAI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be62a99c5a37-MXP
expires: Sun, 29 May 2022 12:37:38 GMT

GET
H3 200 what-is-spf-dkim-and-dmarc-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/09/ 16 KB
17 KB 34ms
33ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/09/what-is-spf-dkim-and-dmarc-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2077b7272968c25e73de897215e009f7bc288dbd3a58c0420d74a82fd8d2b07

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821377
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16381
last-modified: Thu, 16 Sep 2021 05:32:17 GMT
server: cloudflare
etag: "3ffd-5cc162358a8df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vkr3fKvT6ehH1wZEIJQAheHAzebk1WtgH0eF%2FtBUWr8pC6edxkdMJMYZFenP%2F0vj1Jdjqf7yd5OkRdMXuW7D9YT9b3CIPHofJvNm3I5MJ6dvoJ78r3v3KJ4024ZR0UFPbeUvPhxQY8fMOlq%2FQVJgMTrfds2pWTU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be62ca145a37-MXP
expires: Tue, 31 May 2022 07:35:18 GMT

GET
H3 200 cyberchef-1-218x150.jpg
www.socinvestigation.com/wp-content/uploads/2021/09/ 6 KB
6 KB 33ms
32ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2021/09/cyberchef-1-218x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61561230095c27c15c4714987d36849d0d4bb20ad010372bdf5e2bac0e87dd7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1821376
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5828
last-modified: Wed, 15 Sep 2021 06:32:59 GMT
server: cloudflare
etag: "16c4-5cc02de880a1d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s9TYQfqZxxCIlrMTNtKuijT0iFR1S95jDKWeYPPsl1wDno2Q%2FSqcPROQ6acuPsZ8G9A9EidtjvutmmgfZ%2FCDlqDCSuSJFm1Ok0dOnnveC0qpfJwcfLKbIaZWZ9DGeM0Up0xHFXlAA4ZzP31Qw9sn8Vzf6orWbSE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be62ea5d5a37-MXP
expires: Tue, 31 May 2022 06:40:55 GMT

GET
H3 200 Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 2 KB
2 KB 29ms
28ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Microsoft-asks-Defenders-to-Monitor-sqlps.exe-and-Powershell2-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06affebe3ff598a04bdbb98e7440365dc63e81a496ed82424edd6c9e827fb694

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277136
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1933
last-modified: Thu, 19 May 2022 01:57:41 GMT
server: cloudflare
etag: "78d-5df53b2f2fe50"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4abYlyUHYx0ZO4u8x9LmV%2F1TNaG5SRx7%2BIwr9EGjH7ZCIQuiKWMQ8RAfd3kjTW42CpwCZiMjiD57lBrB3HDc9i0p4VLK%2Fr0JcTADaDfUYgDFZoNxvBncdNDQ1fTi14lV7tqQjjWbrYKGzTsvZP4WcftIE6RkAaQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be631ae15a37-MXP
expires: Sat, 18 Jun 2022 02:11:23 GMT

GET
H3 200 Sysmon-Event-ID-13-to-Detect-Malicious-Password-Protected-File-unlock-and-Registry-Changes-min1-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 3 KB
4 KB 37ms
37ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Sysmon-Event-ID-13-to-Detect-Malicious-Password-Protected-File-unlock-and-Registry-Changes-min1-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 722549e56084ace24bc5faaa9a2ee6bae4e58ed1daefe269f71103d8c0c47492

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 879569
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3243
last-modified: Thu, 12 May 2022 05:19:59 GMT
server: cloudflare
etag: "cab-5dec9b589746e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0EB7vjvbqzHRg5TvmBHUjQZJRsputWE2c7pJtcQhbC%2FSjfDRxdPeCDdwE5bb40E2td00FMvskkgBMeO7TJ6wuimCzvijnMsEr3Mesunhxy6tjRW%2F3frZz3yoKL1MayVWK7vOX4fG4UQMvJz6XOzwYvw2ABm1UNg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be633b2c5a37-MXP
expires: Sat, 11 Jun 2022 05:34:34 GMT

GET
H3 200 Windows-Event-ID-5379-to-Detect-Malicious-Password-Protected-File-unlock-min1-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 3 KB
3 KB 64ms
64ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/Windows-Event-ID-5379-to-Detect-Malicious-Password-Protected-File-unlock-min1-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05920bd5ce0003baa28921e5a03c0f3a51cfc3196be7160fdfbe6b58a9190fda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14342
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2579
last-modified: Mon, 09 May 2022 13:13:44 GMT
server: cloudflare
etag: "a13-5de93fa472f59"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vKQ9%2BcZb4eTDTqiVYlQP2F6G146q3WLUfB0W3NBHyCvZr9ykLAJKUrk8T1agOsiRhdqSEdfXjD18M38NROMctsmG7u%2B3CY0LX5rlUYwvM8l312WAHBe1DPrLsFwvr%2FvZq3XHRCDSBOzdSpaeUv6UVKFcIAL1Tos%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be635b9c5a37-MXP
expires: Thu, 09 Jun 2022 05:04:56 GMT

GET
H3 200 How-FIDO-Makes-Passwordless-Authentication-Works-min-100x70.jpg
www.socinvestigation.com/wp-content/uploads/2022/05/ 2 KB
3 KB 54ms
54ms Image
image/jpeg 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/How-FIDO-Makes-Passwordless-Authentication-Works-min-100x70.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 31039300ab2e90c85f5e0c21e857366d7b95f5e890076feeeea655a0f6c6a75d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 299986
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2442
last-modified: Mon, 09 May 2022 05:09:22 GMT
server: cloudflare
etag: "98a-5de8d3610b518"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HSgBcEiyP9MMph24NGXkvIjhJ94WBqzNwvFK3d6Ab8WFEHrQGetMRe48VzTylMHYJWgQwXiLZBgbPfMYHZFXZzBpdslkD0bSQqI7THCJA24quwRtdiHOKLOB%2FlYysW%2FF9CvtWybQEzGLJFbZKm9jgTAraSOJgCA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be639c495a37-MXP
expires: Wed, 08 Jun 2022 05:15:32 GMT

GET
H3 200 2fa-11-100x70.png
www.socinvestigation.com/wp-content/uploads/2022/05/ 5 KB
5 KB 37ms
37ms Image
image/png 2a06:98c1:3121::a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.socinvestigation.com/wp-content/uploads/2022/05/2fa-11-100x70.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf98609a0ee90860f824aeb151de954684d817c0a21e2d4ca70371147e3b1db5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.socinvestigation.com/apt34-returns-with-new-ttps-and-delivers-malicious-files/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:14 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14338
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4644
last-modified: Thu, 05 May 2022 07:08:29 GMT
server: cloudflare
etag: "1224-5de3e68b1e669"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YCZdi2lrmC4TWGaAVXCAAM2GU7MJ97ocIbsQx9bdkqJpAzN28hsInDwPi%2BJv3GkMagOlnalosiptQcsle5OlZAZ%2BVk8Bf5Q6%2FWJUgaEF8m3%2BspmRa1ZMaw3CU7gpdFucoP3%2Bbz7jIo%2Bq%2F7aWidyX%2FUDrhOJC9FY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 70f4be63ed0d5a37-MXP
expires: Sat, 04 Jun 2022 07:15:12 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DEF9 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstp7GhSd4DcfTkEFrqx0y14u0cEadl9UFC2m88_gd9FAkAVnL46uAcPwo2_Ovizw-ZiMMGR-fLO-Xss0-vLVlxU&sig=Cg0ArKJSzPY3bnwJ-pyjEAE&id=lidar2&mcvt=1028&p=0,0,90,728&mtos=1028,1028,1028,1028,1028&tos=1028,0,0,0,0&v=20220518&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4100517743&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1653214033184&rpt=522&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2060 42 B
64 B 42ms
41ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsski0oSAw0niyatu1vJcsGvrVTM_RlTlKEQIK6jUkMY5WSfmLSKmUiE5hDnkX_lXtUV9PzTNhsSO0uEPZl2h4lGYa407j4oLfjDL1JNqNX_UJMa4xNCAPSqP2cQ&sai=AMfl-YRhIJ2EbQHnfOhCpI2asXizK_4hZBXhP_0Bh6z9OIKLCHtK01cMMSXRtZO8pV5GNw0tFPvFnfKJpkbl&sig=Cg0ArKJSzDH9bft7bKqiEAE&id=lidar2&mcvt=1002&p=0,0,278,696&mtos=0,1002,1002,1002,1002&tos=0,1002,0,0,0&v=20220518&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&vu=1&app=0&itpl=4&adk=3038390094&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1653214033108&rpt=672&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 14BD 0
127 B 16ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 22 May 2022 10:07:14 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E2D2 42 B
64 B 42ms
42ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvhJ6DmmWKmCOB3KXK3YFzrlKJaDFAHaf6pIjm2JBpKXl4g0blNJhg9zIn0jy5mXH8d8w6zzrIDyVMa4246MaekpdrfN5GrabXlmkrTTfwRYbFsVjCWFyJlPGyt&sai=AMfl-YRWJ1P1TRG2ExpW6jNG3KB5CNX9z5uc23ZlCOGatUFQQsU8F7dHxoWeqmZ_FqYOI5S_XFzzmChADbDM&sig=Cg0ArKJSzCW5aOYM4UIzEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=119,762,1000,1000,1000&tos=119,643,238,0,0&v=20220518&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1653214033622&rpt=421&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 22 May 2022 10:07:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 14BD 1 KB
2 KB 16ms
15ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 22 May 2022 10:07:16 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1276656
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1266
expires: Mon, 06 Jun 2022 04:44:53 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 14BD 0
127 B 19ms
19ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 22 May 2022 10:07:20 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

Verdicts & Comments Add Verdict or Comment

203 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.socinvestigation.com/	1970-01-20 12:35:10	Name: __gads Value: ID=7a78ebd7d75b4f85-22d80af79acd00be:T=1653214033:RT=1653214033:S=ALNI_MaVNd7lIGT0ZhZV3xMHjYP4XsUWTA
.doubleclick.net/	1970-01-20 12:35:10	Name: IDE Value: AHWqTUlt2DnZOyyzSh5fxq_QB9NMLAz9mWYc5InERDk2QRioZrxbN3DfhTx9DAQF8v8
.doubleclick.net/	1970-01-20 03:13:37	Name: DSID Value: NO_DATA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.socinvestigation.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3 Message: Failed to load resource: the server responded with a status of 403 ()
javascript	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20220518/r20110914/zrt_lookup.html?fsb=1#RS-1-&adk=1812271801&client=ca-pub-1663975870032923&fa=1&ifi=8&uci=a!8&btvi=1&xpc=3rGZFlndZN&p=https%3A//www.socinvestigation.com Message: The resource https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
adservice.google.com
adservice.google.de
c0.wp.com
cat.nl.eu.criteo.com
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
rtb.nl.eu.criteo.com
secure-gl.imrworldwide.com
static.criteo.net
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.socinvestigation.com
178.250.0.139
178.250.0.162
178.250.2.148
192.0.77.37
2600:9000:206f:4a00:1e:a43d:b640:93a1
2a00:1450:4001:800::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2004
2a00:1450:4001:813::2002
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2003
2a00:1450:4001:831::2001
2a00:1450:4001:831::2002
2a00:1450:4001:831::2003
2a02:2638:1::2
2a02:2638:1::4
2a02:2638::3
2a06:98c1:3121::a
00072ba470f277297fccbaec52a2c8a09688a4ce9fbb27cdbb0dc91adabd7140
01284adf0039080c4d89732ef83440fd31b310a7bf3867b83b030f99ffd1f1c1
01b1ebc8a5f2f20daf8317c8badb1476bde105089ed777d998b1b7297da5a46f
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
04c1bc744720c6e7542613e933c9a0f4bbd8f6ed45a5b1924223c256430dfd7b
05318716bc3b0821062096c1ab4ac651cdbc1da91a61cb388d93cac57a9f422b
05920bd5ce0003baa28921e5a03c0f3a51cfc3196be7160fdfbe6b58a9190fda
06460c5ac2ac6f0dcecb946cb8160e58c2c1b81977086c1ac9d2a181fc73d92a
06affebe3ff598a04bdbb98e7440365dc63e81a496ed82424edd6c9e827fb694
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0b4bd7d97d5aed8fa025e7d49644693b5529b122fea1079f887bfb6b30f89ed8
0ba15f64baf79941f285fd94148e0c171b1382a53f5cbe8cd0b64a925946e77c
0c89871faf7d2b59c948ff5e12f2d4971d7cad0e9bc23d2ab8379d8210d7f5cd
0dd95d9bfc689b8862a9dd8ae8166ca21df149fb24f3d0830423b66ae00d426e
1794a3cf13f7bb6847ad633beedd9dc4c09773165073a6718b73d1314d4b87a2
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18b7e49a6696c5a278ac77eb98149048d0819df63ac265a2cf3abb26914d57c3
1a525a2e5c92b17dc4a7f505b744c4b28084c5e538c60f1573daef91777a7f64
1be78b79774b196d2500f7bd3bb3ca7269ec444158f0e545d4d313bcf40e1310
1c8ef9dfc9dd03c8c921452506e8036676c465f9f4ccb62c33934319506b99e3
1ceb245a8f768b65c2ae250d96f5457b96e9537326da2feb2310b707736817aa
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
279bfff8c4ae31eced3c7260fbb144b4c80750130fcf92e66d69635a774981cd
291c3d8a34473a7c8cb6fae74b608caa47d45699ec8dd8a9b795145aaf964ba8
2a29e79bd75cc83eade181c4acc1c198786539997766b648bc21ed5aa7698408
2d036346b18bf4c27bc91f0416f8b59427e32bfc6c2724a27e6fe2e5a7b58574
31039300ab2e90c85f5e0c21e857366d7b95f5e890076feeeea655a0f6c6a75d
33a765d12fcf0854f5e0cddfd2d926cf1e4de070b6e02c871398ae2e64be5b29
35d22c1685889f79c4d92edd7544e5a0c2d58b8126190bc181474e518042c0ba
35d962f44b1208c783395315f2793914f30a7df4aed795e62885e30675532830
364b5d98bead0ec08dd588f03c19a7eb6761b38200746ccc2fd290edc9863668
37181efd3f8cc9b4ecd6acdc31dc5518762864eaa4dca00c5c4b899bb95121be
3d51f9a3d934599bf63c7c09c1af0158c0b9d6e7d73fb98a00f7f989b3b90edc
3df7758fd745a0c7a327e276992b0b1749aa864daf8395e553a9851007cab060
42b4d722cc51360e4ff545d54ac1ffa3f1f333bebfee92ef064e53e158d11b5b
42b853168bb627593eb95b83db66183f7b3bd442db24c37398f1958d1451acd6
42c9e4f9d8c14ea0ecac49e147f029a6bb58b69e544bd63667e5b0e64169f631
42d92eccf9ceba532166f67ed5985735d73d6fba67c3fcfec2d529dc65918bb1
456de4deb42b59c2640870db0d53e64ae9b7955b0787b411e46d590bffa5ff52
46b9a5901111b1edd678afe1cb94d83bf348f56c7b25a64e893ecf1260a996e0
46d2ae95dcd216118b21508d7928db63337e00b98ad01fc4d97d5572e457417d
4756ac4212539b2754f490c4a076dd1a94dabbb5dc1eec78d5233865bbcdae3d
4a977f0cb5fd0f9222f6e9c83719c1c74cf7cf8d75e89420d8dad3fba5617312
4c894c338fddff3aa5259ea0876599d1724eb4d64fb3995f74a0bdc4603e9307
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f6366518c3d992d6a9a3aee342675532822d6b1d66217df7b284bb450dbb99a
5198e742cbc39d3d391f98807d571495206da0a8d95f854b493beaa2950ff3f0
51a7253d7470a5568df4c781f29ddf530a892a6a044ef91a4dafff95dcd0d265
541bd46059c2b8987999b59ba85e695f38663ba0c3457f15d4b63ec710f06216
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57982f90e605a8cad3c510d836c5c8d087492686c420c106fcd6b06f8a8f72c5
5a8d1b4e6f8c86667984505ea5eee88cb7b75a4165dbf257263690ff55f32b19
5bd4613515153737782bc9f94978398d909697345f3400699b2a7a3f6be1379f
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61561230095c27c15c4714987d36849d0d4bb20ad010372bdf5e2bac0e87dd7f
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6355f06ffa570821c3fe64a8a49bce87b85c533684c0ea4b002a34ab5ad33ff8
647663010f80dcb7035daf2936c2e084a789d024cba11a9f09bf3cf3186c0da4
67fb6e7af56698a9718d38afa180cf8e5b7017dd397a4b1689a542bb6afff901
68151e32200f64f60f412bbc3ccde917a5fadb2f1a464cf7b3b77fd7675e6afc
6ba1c43ce69aec2bcd2df77d6ac38a92a430904d312181aecfb8abac13492466
6bd6ef384f95c63760a90ab5e6d0ddc45ecee28a134fd869dd7d6ff629a7b274
70444fefbc0ead30c80170a068074556e3829957824e058d7bdbfb7f85c20348
722549e56084ace24bc5faaa9a2ee6bae4e58ed1daefe269f71103d8c0c47492
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
7263c5282c491d96ae72876695538ce114f7fbd39dbf31da3e952cdc622f8d67
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7ae5b52b01b37efb4547c3493f75abf51dc034326bb6f1ff6fc97348065716ba
7bfed7fcc395671d82ccbeab04b29455102a75310511cd6ebfd951cbe5e0ae8b
807c988638b1ef9530acb4eb4eeb9c34e64a4a681b7423b97cf87f24a49e042a
82e4100cb570e901a66a7d3887b4e1d83924cde484dd74ab5fd270094e9e71d6
8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92
89340946079058ec32f6a455fdf05e55fcb627a5be2617fcdb0fc0d393195608
8a9a74f4455f392ec3e7499cfda6097b536bb4b7f1e529a079c3d953c08b54ca
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
915cbfbffed51f3cd6ea7a7f32d2b793c2b1f03f50e313e5a0e51d3f705eb51f
94c8fd89363e3fab34824ecaa6cbe2ed9b97970ecc55c8f64b52a0a056a1de99
98b4ef7085e505bfb2f5781a1d178d40b2a9f3de9f28abfd611d7707639fc6e3
9fc62d99ca580e914d7af298fd36b6926ba2b1e6c97ab21be0f9022f9c665816
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a9ef021078603005c0b08fba881f1a7eb62ef213238021f3e8a4a00daa60b9d6
a9efd54ae70bb45c6b3fc08c5d766dd462c1476bbe815265d6d4a9b64a79fbc7
adbe3fd3360442fa6f09419065baea9ad3bdba01aa0520c7f0524210bf2d5ca5
b438bfaec498b9ae1119d3ff6b17032850d54007c059a3642abdd61ba57536cd
b50c99e909bbeaee18b1608162c5702a240d3f1cea91b39f41443bcc019b46b2
b968113e586107906911e61864086ba097b7b45cf857c0de3c4fd20963a90e61
bbb30b100da0e50588d20b4bc7ee0b5736716d14004e0b8e4258c084b57e24a9
bc64ca4f9ac377de71a30b14be28b0b131109a99dd385a7f4c6c4fdad46b0899
bc821678522f6a89487b0b9310900e882dfb6ecee4bb2ac39a0afdf02d1a60dd
bd455b773b66cff4fb7a76cda8a3c94d8741b8db6d47f72e5c5a1edfed0d661b
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bf98609a0ee90860f824aeb151de954684d817c0a21e2d4ca70371147e3b1db5
bfcd7a262745ac2a8520d46dbe261c5db424c001970e9ebe83c440bfb48454f7
c1cd047827ddbff6629d0d661805864414b9bdfad8296fad9abf7f96a9e089b1
c21e1e297e26304a6a9e4a675826243b504501c06f60e7bbd5c8722d95cb4a3e
c428add43f5bb054cb3049a19f9531d57ff37f1627cd03c04f6a59a742c95bde
c927356cd5c29976ac4448b1fc160316d88a24de40405b287ec05a71e355e7ba
c9a612722eed86936463bc8772a9d4509e0c24f22485221beaa583a60079fef2
cba47082178b1574a96fa49c257693082949237914f632073da2f476dc81e0db
cc5e65f3bf4a6f565b2e549b9b401450a1e7d283ffe50dd4a906b5375808b851
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d2077b7272968c25e73de897215e009f7bc288dbd3a58c0420d74a82fd8d2b07
d4499566b0fadeeb9756c8145b76ae48f5fbe6b6e235299dad786d05df5aa99f
d5e0684697fa8aeb5266b010e4cf40320640ebb988b51b26017c28dc5d7e93bf
d8d70943539d5b567ebd75eb8bc2b77a2a3402b0326104a7616e8ccf7f27d2c4
dbfffa2ccca810c8921d8ff5d03714c06b4646838e8d96c0de4f05be3561de16
e011e5db5fba47db92bc725349b3ef86a4c8cdb49a750ab259704596e0e5ef05
e249765e273a74656063470fe2148a7f4aed395b8731d4efe2a828c52da018d8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138
e4bd1daea7c60596a7349e65a157552725386b9f0715f447c55cab8bba646f85
e6c92b4124a497573949aea82322dee37fc8f522ef4f59ce7ef1411fbe148976
e8516a612b549e9392064af18dbf9b9a328f22bbbf1d5977f60707dae7726220
ea4d23959c2206c70ce5f52b0c220057f923764d67a152fe8a58baaba6ecf22f
ea9ad8f6ace011a694d664482cc6ca0acc2dd86a8d6b684154327ec84c0c95fd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f27644734b8ead437f7ae34027490dae1d295348b0fc0cdca8b839bd9ef48d46
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f634f4c39c597da014808f4689709393f72c3206377ed8e3a6321f7bd3d1abff
f69a3291a73787cd086a9d165630512c48bde188f68c53ef33aba67a0f9b8696
f7932fc0a2f9b2e067a89e1c2e9bf410c39242d3e7764fe1d543e0b209998bc7

www.socinvestigation.com Open in urlscan Pro 2a06:98c1:3121::a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

179 Requests

100 %HTTPS

79 %IPv6

13 Domains

20 Subdomains

20 IPs

3 Countries

3273 kBTransfer

6435 kBSize

3 Cookies

15 Outgoing links

Redirected requests

179 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.socinvestigation.com Open in urlscan Pro
2a06:98c1:3121::a Public Scan

Screenshot
Live screenshot

Full Image

179
Requests

100 %
HTTPS

79 %
IPv6

13
Domains

20
Subdomains

20
IPs

3
Countries

3273 kB
Transfer

6435 kB
Size

3
Cookies

179 HTTP transactions
8 data transactions