20762632p.rfihub.com Open in urlscan Pro
193.0.160.128 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://20762632p.rfihub.com/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.c...
Effective URL:
https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomar...
Submission: On October 01 via api (October 1st 2021, 4:02:30 pm UTC) from US — Scanned from DE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 16 IPs in 5 countries across 20 domains to perform 20 HTTP transactions. The main IP is 193.0.160.128, located in United States and belongs to ROCKETFUEL, US. The main domain is 20762632p.rfihub.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 18th 2020. Valid for: 2 years.

This is the only time 20762632p.rfihub.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 7	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
3 3	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1 2	185.33.221.90 185.33.221.90	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	52.49.107.116 52.49.107.116	16509 (AMAZON-02) (AMAZON-02)
1 2	3.124.210.90 3.124.210.90	16509 (AMAZON-02) (AMAZON-02)
1	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.120.90.180 3.120.90.180	16509 (AMAZON-02) (AMAZON-02)
1 1	13.225.87.94 13.225.87.94	16509 (AMAZON-02) (AMAZON-02)
1 3	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	52.200.156.204 52.200.156.204	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2600:1f18:612... 2600:1f18:612b:4216:7de5:38a9:e1be:23d8	14618 (AMAZON-AES) (AMAZON-AES)
1	35.176.195.187 35.176.195.187	16509 (AMAZON-02) (AMAZON-02)
1	34.240.156.207 34.240.156.207	16509 (AMAZON-02) (AMAZON-02)
1 2	35.157.197.70 35.157.197.70	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
20	16

7 193.0.160.128 (United States) 3 redirects

ASN54312 (ROCKETFUEL, US)

20762632p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.98 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.90 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.107.116 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-107-116.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.124.210.90 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-210-90.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.120.90.180 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-90-180.eu-central-1.compute.amazonaws.com

bs.serving-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.87.94 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-94.fra2.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.174.68 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.200.156.204 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-156-204.compute-1.amazonaws.com

bpi.rtactivate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:7de5:38a9:e1be:23d8 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.176.195.187 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-176-195-187.eu-west-2.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.240.156.207 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-240-156-207.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.197.70 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-197-70.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.2.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	rfihub.com 3 redirects 20762632p.rfihub.com a.rfihub.com p.rfihub.com	9 KB
3	rlcdn.com 1 redirects idsync.rlcdn.com	1007 B
3	doubleclick.net 3 redirects cm.g.doubleclick.net	1 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	631 B
2	bidswitch.net 1 redirects x.bidswitch.net	858 B
2	spotxchange.com 1 redirects sync.search.spotxchange.com	1 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	eyeota.net 1 redirects ps.eyeota.net	1 KB
2	demdex.net 1 redirects dpm.demdex.net	2 KB
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
1	krxd.net beacon.krxd.net	338 B
1	agkn.com aa.agkn.com	238 B
1	tremorhub.com partners.tremorhub.com	183 B
1	addthis.com x.dlx.addthis.com	191 B
1	rtactivate.com bpi.rtactivate.com	109 B
1	rezync.com 1 redirects live.rezync.com	789 B
1	serving-sys.com bs.serving-sys.com	105 B
1	media.net contextual.media.net	696 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	bluekai.com 1 redirects stags.bluekai.com	676 B
20	20

	Domain	Requested by
4	p.rfihub.com	2 redirects
3	idsync.rlcdn.com	1 redirects
3	cm.g.doubleclick.net	3 redirects
2	sync-tm.everesttech.net	2 redirects
2	x.bidswitch.net	1 redirects
2	sync.search.spotxchange.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	ps.eyeota.net	1 redirects
2	dpm.demdex.net	1 redirects
2	ib.adnxs.com	1 redirects
2	20762632p.rfihub.com	1 redirects
1	beacon.krxd.net
1	aa.agkn.com
1	partners.tremorhub.com
1	x.dlx.addthis.com
1	bpi.rtactivate.com
1	live.rezync.com	1 redirects
1	bs.serving-sys.com
1	contextual.media.net
1	pixel.rubiconproject.com
1	stags.bluekai.com	1 redirects
1	a.rfihub.com
20	22

This site contains no links.

Subject Issuer	Validity	Valid
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-18` - `2022-06-18`	2 years	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.eyeota.net R3	`2021-08-27` - `2021-11-25`	3 months	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2021-04-12` - `2022-04-20`	a year	crt.sh
bs.serving-sys.com Amazon	`2021-05-10` - `2022-06-08`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
rtactivate.com Amazon	`2021-05-13` - `2022-06-11`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-04-25` - `2022-04-26`	a year	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2021-04-08` - `2022-05-09`	a year	crt.sh
*.tremorhub.com Amazon	`2021-06-27` - `2022-07-26`	a year	crt.sh
*.agkn.com RapidSSL RSA CA 2018	`2020-07-25` - `2022-09-18`	2 years	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-01-13` - `2022-01-07`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F%2Fwww.capitalone.com%2F&ra=23502502321215846
Frame ID: 73201C98BF8EC7FF4BB662E40BCD38BC
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://20762632p.rfihub.com/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww... HTTP 302
https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2F... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

<(?:iframe|img)[^>]+adnxs\.(?:net|com)
adnxs\.(?:net|com)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Sizmek (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

(?:<a [^>]*href="[^/]*//[^/]*serving-sys\.com/|<img [^>]*src="[^/]*//[^/]*serving-sys\.com/)
serving-sys\.com/

Page Statistics

20
Requests

100 %
HTTPS

5 %
IPv6

20
Domains

22
Subdomains

16
IPs

5
Countries

14 kB
Transfer

3 kB
Size

30
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://20762632p.rfihub.com/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F%2Fwww.capitalone.com%2F&ra=23502502321215846 HTTP 302
https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F%2Fwww.capitalone.com%2F&ra=23502502321215846 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk3MzM5ODU4MzQ4MQ==&forward= HTTP 302
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk3MzM5ODU4MzQ4MQ==&forward=&google_tc= HTTP 302
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESED8nxpM1g_n2gY7gOi6igcU&google_cver=1

Request Chain 1

https://ib.adnxs.com/setuid?entity=18&code=1871878973398583481 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878973398583481

Request Chain 2

https://stags.bluekai.com/site/4722?id=1871878973398583481&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D HTTP 302
https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=

Request Chain 4

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1871878973398583481&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878973398583481&redir=

Request Chain 5

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=1871878973398583481&bid=omt9pi0 HTTP 302
https://ps.eyeota.net/match/bounce/?uid=1871878973398583481&bid=omt9pi0

Request Chain 8

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1871878973398583481&referrer=https%3A%2F%2Fwww.capitalone.com%2F HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=aef78efd-e5ef-43a7-896e-2f8ebc98d63a%3A1633104146.0&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Daef78efd-e5ef-43a7-896e-2f8ebc98d63a%253A1633104146.0 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=aef78efd-e5ef-43a7-896e-2f8ebc98d63a%3A1633104146.0 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKnH_5zU1GQ9UA3RNgzXaSg&google_cver=1

Request Chain 10

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878973398583481&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878973398583481&forward=&C=1

Request Chain 13

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878973398583481&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878973398583481&img=1&__user_check__=1&sync_id=f889a6f9-22d0-11ec-adb8-1d66682b0206

Request Chain 17

https://x.bidswitch.net/sync?dsp_id=119&user_id=1871878973398583481&expires=30 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878973398583481&expires=30

Request Chain 18

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=YVcxEQAFxaHXTgAR HTTP 302
https://p.rfihub.com/cm?in=1&pub=21653&userid=YVcxEQAFxaHXTgAR&_test=YVcxEQAFxaHXTgAR

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set ca.html Show response
20762632p.rfihub.com/sr/
Redirect Chain

http://20762632p.rfihub.com/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F%2Fw...
https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F...

3 KB
4 KB

66ms
23ms

Document
text/html

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F%2Fwww.capitalone.com%2F&ra=23502502321215846
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: a5a8f141d3f3c132c42c6d7247554b22ba761b4ae784f7bd5b1446365da1b1e2

Request headers

Host: 20762632p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 01 Oct 2021 16:02:25 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwByILS3NjY0sLUwtjEwtDIT5DXSPPlGDPKlOzAo-gTCleQzNjY0MDE0MTUwsjSwAVqyoyNAAAAA; Path=/; Domain=.rfihub.com; Expires=Wed, 26 Oct 2022 16:02:25 GMT; Secure; SameSite=None eud=H4sIAAAAAAAAAJvFyGtoZmxsaGBiaGJqYWy0Co1_Co3_Co3_C40_iQmVPwuNvwiNvwqNvwmNvwtdPQsq_xYafxMrmn5uNPei8RcJo_IfofEBdUfnuCABAAA; Path=/; Domain=.rfihub.com; Expires=Wed, 26 Oct 2022 16:02:25 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwByILS3NjY0sLUwtjEwtDIT5DXSPPlGDPKlOzAo-gTAAWoJylJQAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html;charset=utf-8
Content-Length: 2790
Server: Jetty(9.3.29.v20201019)

Redirect headers

Date: Fri, 01 Oct 2021 16:02:25 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://20762632p.rfihub.com/sr/ca.html?ver=9&rb=29905&ca=20762632&_o=29905&_t=20762632&pe=https%3A%2F%2Fwww.brunswickautomart.com%2F%3Futm_source%3DGMB%26utm_medium%3DWebsite_Button&pf=https%3A%2F%2Fwww.capitalone.com%2F&ra=23502502321215846
Content-Length: 0

GET
H/1.1

200
OK

cm
a.rfihub.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk3MzM5ODU4MzQ4MQ==&forward=
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTg3MTg3ODk3MzM5ODU4MzQ4MQ==&forward=&google_tc=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESED8nxpM1g_n2gY7gOi6igcU&google_cver=1

42 B
1 KB

61ms
18ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESED8nxpM1g_n2gY7gOi6igcU&google_cver=1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 16:02:25 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 01 Oct 2021 16:02:25 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESED8nxpM1g_n2gY7gOi6igcU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 311
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/setuid?entity=18&code=1871878973398583481
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878973398583481

43 B
1 KB

15ms
14ms

Image
image/gif

185.33.221.90
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878973398583481

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.90 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 01 Oct 2021 16:02:25 GMT
X-Proxy-Origin: 194.36.108.21; 194.36.108.21; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 42e6e52d-16fc-4101-92cb-bba45490348a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 01 Oct 2021 16:02:25 GMT
X-Proxy-Origin: 194.36.108.21; 194.36.108.21; 727.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 75d1b9f0-8c78-42cb-9fe8-83a6aa812756
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1871878973398583481
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

cm
p.rfihub.com/
Redirect Chain

https://stags.bluekai.com/site/4722?id=1871878973398583481&redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fbk_uuid%3D%24_BK_UUID%26forward%3D
https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=

42 B
1 KB

18ms
18ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 16:02:26 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://p.rfihub.com/cm?bk_uuid=$_BK_UUID&forward=
Date: Fri, 01 Oct 2021 16:02:26 GMT
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ 0
239 B 54ms
16ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=1871878973398583481
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1871878973398583481&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878973398583481&redir=

42 B
945 B

41ms
40ms

Image
image/gif

52.49.107.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878973398583481&redir=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.107.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-107-116.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v018-07edf1b28.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: glUHLVM6RA8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v018-012e7a688.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: VGEv0CSaQBg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871878973398583481&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=1871878973398583481&bid=omt9pi0
https://ps.eyeota.net/match/bounce/?uid=1871878973398583481&bid=omt9pi0

70 B
440 B

7ms
7ms

Image
image/gif

3.124.210.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?uid=1871878973398583481&bid=omt9pi0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.124.210.90 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-210-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 16:02:25 GMT
Content-Type: image/gif
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /match/bounce/?uid=1871878973398583481&bid=omt9pi0
Date: Fri, 01 Oct 2021 16:02:25 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 200 cksync.php
contextual.media.net/ 46 B
696 B 93ms
44ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=1871878973398583481

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Fri, 01 Oct 2021 16:02:25 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 46
x-mnet-hl2: E
expires: Fri, 01 Oct 2021 16:02:25 GMT

GET
H2 200 serving
bs.serving-sys.com/ 0
105 B 52ms
10ms Image
text/plain 3.120.90.180
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.90.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-90-180.eu-central-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 16:02:25 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 0
p3p: CP="NOI DEVa OUR BUS UNI"

GET
H2

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1871878973398583481&referrer=https%3A%2F%2Fwww.capitalone.com%2F
https://p.rfihub.com/cm?pub=39342&in=0&userid=aef78efd-e5ef-43a7-896e-2f8ebc98d63a%3A1633104146.0&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Daef78efd-e5ef-43a7-896e-2f8ebc98d63a%...
https://idsync.rlcdn.com/501709.gif?partner_uid=aef78efd-e5ef-43a7-896e-2f8ebc98d63a%3A1633104146.0
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKnH_5zU1GQ9UA3RNgzXaSg&google_cver=1

42 B
299 B

16ms
16ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKnH_5zU1GQ9UA3RNgzXaSg&google_cver=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 01 Oct 2021 16:02:26 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

pragma: no-cache
date: Fri, 01 Oct 2021 16:02:26 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEKnH_5zU1GQ9UA3RNgzXaSg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
bpi.rtactivate.com/tag/ 43 B
109 B 351ms
138ms Image
image/gif 52.200.156.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=1871878973398583481
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.156.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-156-204.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 16:02:26 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878973398583481&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878973398583481&forward=&C=1

43 B
1006 B

33ms
32ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878973398583481&forward=&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 01 Oct 2021 16:02:25 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 01 Oct 2021 16:02:25 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 01 Oct 2021 16:02:25 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1871878973398583481&forward=&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 295
Expires: Fri, 01 Oct 2021 16:02:25 GMT

GET
H2 200 360947.gif
idsync.rlcdn.com/ 42 B
416 B 41ms
15ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=1871878973398583481
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 01 Oct 2021 16:02:25 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2 200 rocketfuel_sync
x.dlx.addthis.com/e/ 43 B
191 B 216ms
154ms Image
image/gif 104.111.215.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=1871878973398583481

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-215-191.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 01 Oct 2021 16:02:26 GMT
cache-control: max-age=0, no-cache, no-store
expires: Fri, 01 Oct 2021 16:02:26 GMT
content-length: 43
strict-transport-security: max-age=2628000
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878973398583481&img=1
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878973398583481&img=1&__user_check__=1&sync_id=f889a6f9-22d0-11ec-adb8-1d66682b0206

43 B
549 B

28ms
28ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1871878973398583481&img=1&__user_check__=1&sync_id=f889a6f9-22d0-11ec-adb8-1d66682b0206
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 16:02:26 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 143
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Fri, 01 Oct 2021 16:02:25 GMT
Server: nginx
Location: /partner?adv_id=7180&uid=1871878973398583481&img=1&__user_check__=1&sync_id=f889a6f9-22d0-11ec-adb8-1d66682b0206
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 19
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
partners.tremorhub.com/ 43 B
183 B 312ms
99ms Image
image/gif 2600:1f18:612b:4216:7de5:38a9:e1be:23d8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=1871878973398583481&r=NvLpHR_3nY9h
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:7de5:38a9:e1be:23d8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 16:02:26 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H2 200 g.pixel
aa.agkn.com/adscores/ 43 B
238 B 78ms
20ms Image
image/gif 35.176.195.187
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=1871878973398583481
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.195.187 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-195-187.eu-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 01 Oct 2021 16:02:25 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 204 usermatch.gif
beacon.krxd.net/ 0
338 B 105ms
30ms Image
text/plain 34.240.156.207
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=1871878973398583481
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.240.156.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-240-156-207.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 16:02:25 GMT
cache-control: private, no-cache, no-store
x-request-time: D=29 t=1633104145
x-served-by: beacon-n012-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=119&user_id=1871878973398583481&expires=30
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878973398583481&expires=30

43 B
344 B

14ms
14ms

Image
image/gif

35.157.197.70
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878973398583481&expires=30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.197.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-197-70.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 16:02:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1871878973398583481&expires=30
date: Fri, 01 Oct 2021 16:02:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

cm
p.rfihub.com/
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=YVcxEQAFxaHXTgAR
https://p.rfihub.com/cm?in=1&pub=21653&userid=YVcxEQAFxaHXTgAR&_test=YVcxEQAFxaHXTgAR

42 B
1 KB

18ms
18ms

Image
image/gif

193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?in=1&pub=21653&userid=YVcxEQAFxaHXTgAR&_test=YVcxEQAFxaHXTgAR
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://20762632p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Fri, 01 Oct 2021 16:02:26 GMT
Cache-Control: no-cache
Server: Jetty(9.3.29.v20201019)
Content-Type: image/gif
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 01 Oct 2021 16:02:26 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1633104146.005984,VS0,VE0
x-served-by: cache-hhn4074-HHN
x-cache: HIT
location: https://p.rfihub.com/cm?in=1&pub=21653&userid=YVcxEQAFxaHXTgAR&_test=YVcxEQAFxaHXTgAR
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| firePixel

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1970-01-20 07:00:00	Name: rud Value: H4sIAAAAAAAAAOMSNrQwByILS3NjY0sLUwtjEwtDIT5DXSPPlGDPKlOzAo-gTCleQzNjY0MDE0MTUwsjSwAVqyoyNAAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNrQwByILS3NjY0sLUwtjEwtDIT5DXSPPlGDPKlOzAo-gTAAWoJylJQAAAA
.adnxs.com/	1970-01-19 23:48:00	Name: uuid2 Value: 8506651091089817831
.bidswitch.net/	1970-01-20 06:24:00	Name: tuuid Value: 9280df65-f47a-413b-8c5c-d4743df2f036
.bidswitch.net/	1970-01-20 06:24:00	Name: c Value: 1633104145
.bidswitch.net/	1970-01-20 06:24:00	Name: tuuid_lu Value: 1633104145
.adnxs.com/	1970-01-19 23:48:00	Name: anj Value: dTM7k!M4/YErk#WF']wIg2GVOfRlgM!]tbPl1MNu::wpAk`1NXPg*.'RO$QE=N+5y21?a281b7c0Kc<2(Ed5b>w-/6-#6F8
.doubleclick.net/	1970-01-20 07:00:00	Name: IDE Value: AHWqTUmA6Kk6arKK3AIwQZpjH0GihkiUYOYLRt-RVC_qWjOOtHu5JEaGMACZ9UpIhZk
.casalemedia.com/	1970-01-20 06:24:00	Name: CMID Value: YVcxEX2ocOTMI0qHKXBYqgAA
.casalemedia.com/	1970-01-19 23:48:00	Name: CMPS Value: 5222
.media.net/	1970-01-20 06:24:00	Name: visitor-id Value: 2761057456686975000V10
.media.net/	1970-01-20 06:22:33	Name: data-rk Value: 1871878973398583481~~3
.media.net/	1970-01-20 02:04:48	Name: gdpr_status Value: 1
.eyeota.net/	1970-01-20 06:24:00	Name: mako_uid Value: 17c3c97ae31-7880000010f5fe2
.eyeota.net/	1970-01-19 21:38:24	Name: SERVERID Value: 24546~DM
.krxd.net/	1970-01-20 01:57:36	Name: _kuid_ Value: OZSaxcf5
.casalemedia.com/	1970-01-19 23:48:00	Name: CMPRO Value: 1177
.casalemedia.com/	1970-01-20 06:24:00	Name: CMRUM3 Value: 396157311127601871878973398583481
.casalemedia.com/	1970-01-19 21:39:50	Name: CMST Value: YVcxEWFXMREA
.demdex.net/	1970-01-20 01:57:36	Name: demdex Value: 13339044260912363442094861460464388513
.everesttech.net/	1970-01-20 06:24:00	Name: everest_g_v2 Value: g_surferid~YVcxEQAFxaHXTgAR
.spotxchange.com/	1970-01-20 06:24:04	Name: audience Value: f889a695-22d0-11ec-adb8-1d66682b0206
.rfihub.com/	1970-01-20 07:00:00	Name: smd Value: H4sIAAAAAAAAAOPiNTQzNjY0MDE0MbW0NDFCcM0MjAwAYsxxVx4AAAA
.dpm.demdex.net/	1970-01-20 01:57:36	Name: dpm Value: 13339044260912363442094861460464388513
.rezync.com/	1970-01-20 01:57:10	Name: zync-uuid Value: aef78efd-e5ef-43a7-896e-2f8ebc98d63a:1633104146.0
live.rezync.com/	1970-01-20 01:57:36	Name: sd-session-id Value: .eJwVyrsKgzAYQOFXKf_soEYxCg4FXUoTEaxiFuklNInGFhNBFN-9Fs5y4Nug-_JJ30c-WkjsNHMHnoM8zkCygZGr5j0k4OHoCMcRQjEOMQqwB7sDhhsjP2MnX399ehyybWpNVzEwXVpW1QOTrkv8HF2rd0j1zRLdBqy5qKISPVVUFCr3yUoWkpULzdqZnNMU9v0HzgExTg.FDjCkg.WHYiEQsq9j35ETJFiktmZTzDtQE
.rfihub.com/	1970-01-20 07:00:00	Name: eud Value: H4sIAAAAAAAAAOOSMXR2dA12dbHIqyjwNUyPzzNKjzRP9880y0xPDg3iNTQzNjY0MDE0MbW0NJ7FiMS3MDZahcY_hcZ_hcb_hcafxITKn4XGX4TGX4XG34TG34WungWVfwuZb2lkuIhVIDIsucI10NGtItEjIiTdMWgVK0KJmYGh5SZWNCu40byExp8kbJiYmmZukZqWoptqmpqma2KcaK5rYWmWqmuUZpGalGxpkWJmnGiFsETPYJYwkp2GhiaLhFHNfITGBwDuFjhUtAEAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAAAOOSMXR2dA12dbHIqyjwNUyPzzNKjzRP9880y0xPDl3FKBAZllzhGujoVpHoERGS7hjUxGKYmJpmbpGalqKbapqapmtinGiua2FplqprlGaRmpRsaZFiZpxoZWhmbGxoYGJoYqZnAACPa5h2ZQAAAA
.rlcdn.com/	1970-01-20 06:24:00	Name: rlas3 Value: 9GNcSSxUFDtPZa5MUl/IO4eWJtBuYqXZIe3/qe1Ii/Q=
.rlcdn.com/	1970-01-19 23:04:48	Name: pxrc Value: CJLi3IoGEgYIuuoBEAA=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20762632p.rfihub.com
a.rfihub.com
aa.agkn.com
beacon.krxd.net
bpi.rtactivate.com
bs.serving-sys.com
cm.g.doubleclick.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
ib.adnxs.com
idsync.rlcdn.com
live.rezync.com
p.rfihub.com
partners.tremorhub.com
pixel.rubiconproject.com
ps.eyeota.net
stags.bluekai.com
sync-tm.everesttech.net
sync.search.spotxchange.com
x.bidswitch.net
x.dlx.addthis.com
104.111.215.191
13.225.87.94
142.250.185.98
151.101.2.49
185.33.221.90
185.94.180.125
193.0.160.128
2.18.234.21
2.18.235.93
2600:1f18:612b:4216:7de5:38a9:e1be:23d8
3.120.90.180
3.124.210.90
34.240.156.207
35.157.197.70
35.176.195.187
35.244.174.68
52.200.156.204
52.49.107.116
69.173.144.138
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a5a8f141d3f3c132c42c6d7247554b22ba761b4ae784f7bd5b1446365da1b1e2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

20762632p.rfihub.com Open in urlscan Pro 193.0.160.128 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

5 %IPv6

20 Domains

22 Subdomains

16 IPs

5 Countries

14 kBTransfer

3 kBSize

30 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

30 Cookies

Indicators

20762632p.rfihub.com Open in urlscan Pro
193.0.160.128 Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

5 %
IPv6

20
Domains

22
Subdomains

16
IPs

5
Countries

14 kB
Transfer

3 kB
Size

30
Cookies

20 HTTP transactions
0 data transactions