urlscan.io logo urlscan.io
SecurityTrails logo

thehackernews.com Open in urlscan Pro
104.26.1.97  Public Scan

Go To Rescan Add Verdict Report
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Submission: On October 28 via manual from PK — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 76 IPs in 11 countries across 81 domains to perform 328 HTTP transactions. The main IP is 104.26.1.97, located in United States and belongs to CLOUDFLARENET, US. The main domain is thehackernews.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 1st 2021. Valid for: a year.
This is the only time thehackernews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 104.26.1.97 13335 (CLOUDFLAR...)
9 104.76.201.201 16625 (AKAMAI-AS)
3 104.18.28.173 13335 (CLOUDFLAR...)
9 213.254.244.14 3257 (GTT-BACKB...)
1 69.16.175.10 20446 (HIGHWINDS3)
6 142.250.184.194 15169 (GOOGLE)
3 23.97.225.52 8075 (MICROSOFT...)
5 142.250.185.162 15169 (GOOGLE)
5 143.204.95.188 16509 (AMAZON-02)
16 216.58.212.174 15169 (GOOGLE)
5 7 91.228.74.134 16509 (AMAZON-02)
1 142.250.186.102 15169 (GOOGLE)
1 143.204.98.34 16509 (AMAZON-02)
22 216.58.212.162 15169 (GOOGLE)
4 142.250.186.98 15169 (GOOGLE)
1 143.204.98.28 16509 (AMAZON-02)
18 142.250.185.193 15169 (GOOGLE)
8 142.250.185.198 15169 (GOOGLE)
1 2 34.249.252.185 16509 (AMAZON-02)
1 18.196.159.27 16509 (AMAZON-02)
4 178.250.2.146 44788 (ASN-CRITE...)
1 104.16.89.20 13335 (CLOUDFLAR...)
5 172.67.8.174 13335 (CLOUDFLAR...)
1 13 35.244.159.8 15169 (GOOGLE)
1 3 147.75.38.124 54825 (PACKET)
4 9 185.33.221.15 29990 (ASN-APPNEX)
2 178.250.0.165 44788 (ASN-CRITE...)
4 104.16.190.66 13335 (CLOUDFLAR...)
3 63.251.109.138 36062 (DOUBLE-VE...)
1 52.57.255.59 16509 (AMAZON-02)
1 69.173.144.143 26667 (RUBICONPR...)
1 185.64.189.112 62713 (AS-PUBMATIC)
9 54.228.75.94 16509 (AMAZON-02)
1 3 63.251.14.3 32475 (SINGLEHOP...)
3 142.250.185.98 15169 (GOOGLE)
2 142.250.186.129 15169 (GOOGLE)
12 43 142.250.185.66 15169 (GOOGLE)
2 6 142.250.186.164 15169 (GOOGLE)
3 10 2.18.234.21 16625 (AKAMAI-AS)
1 2 159.253.128.188 36351 (SOFTLAYER)
4 10 15.197.193.217 16509 (AMAZON-02)
1 1 35.186.193.173 15169 (GOOGLE)
2 2 85.114.159.93 24961 (MYLOC-AS ...)
1 1 35.190.0.66 15169 (GOOGLE)
2 2 91.207.59.214 48061 (UMA-TECH-AS)
3 142.250.185.170 15169 (GOOGLE)
2 172.217.16.131 15169 (GOOGLE)
1 104.16.19.94 13335 (CLOUDFLAR...)
2 142.250.181.238 15169 (GOOGLE)
2 178.250.2.130 44788 (ASN-CRITE...)
1 108.177.15.157 15169 (GOOGLE)
1 13.107.213.44 8068 (MICROSOFT...)
2 151.101.129.108 54113 (FASTLY)
3 2.18.233.180 16625 (AKAMAI-AS)
1 5 23.37.42.132 16625 (AKAMAI-AS)
8 8 185.29.134.248 30419 (MEDIAMATH...)
5 7 37.157.6.247 198622 (ADFORM)
2 3 185.64.190.78 62713 (AS-PUBMATIC)
1 18 54.194.104.251 16509 (AMAZON-02)
2 208.100.17.173 32748 (STEADFAST)
1 51.38.120.206 16276 (OVH)
1 6 185.86.139.104 201081 (SMARTADSE...)
6 6 213.19.147.45 26120 (RHYTHMONE)
1 3.217.216.1 14618 (AMAZON-AES)
2 2 193.0.160.129 54312 (ROCKETFUEL)
1 178.162.133.149 60781 (LEASEWEB-...)
1 1 82.145.213.8 39832 (NO-OPERA)
2 2 213.155.156.183 1299 (TWELVE99 ...)
5 185.64.190.80 62713 (AS-PUBMATIC)
1 1 178.250.0.163 44788 (ASN-CRITE...)
5 185.64.189.110 62713 (AS-PUBMATIC)
3 198.47.127.20 62713 (AS-PUBMATIC)
2 2 51.222.80.231 16276 (OVH)
6 7 3.122.214.165 16509 (AMAZON-02)
1 1 46.228.164.13 56396 (AMOBEE)
4 4 151.101.66.49 54113 (FASTLY)
2 2 18.156.0.31 16509 (AMAZON-02)
1 2 52.46.130.91 16509 (AMAZON-02)
2 52.49.244.74 16509 (AMAZON-02)
2 2 135.125.160.160 16276 (OVH)
1 1 54.175.36.162 14618 (AMAZON-AES)
1 2 18.213.10.151 14618 (AMAZON-AES)
2 2 185.33.221.52 29990 (ASN-APPNEX)
2 2 66.155.71.25 13768 (COGECO-PEER1)
1 1 18.198.69.109 16509 (AMAZON-02)
2 2 35.227.248.159 15169 (GOOGLE)
6 6 3.123.82.137 16509 (AMAZON-02)
2 2 18.197.21.136 16509 (AMAZON-02)
1 1 34.205.3.24 14618 (AMAZON-AES)
2 2 64.74.236.159 22075 (AS-OUTBRAIN)
1 1 104.111.215.191 16625 (AKAMAI-AS)
1 1 198.148.27.140 19189 (PULSEPOINT)
3 3 70.42.32.31 13789 (INTERNAP-...)
1 192.132.33.46 18568 (BIDTELLECT)
1 1 52.21.104.248 14618 (AMAZON-AES)
1 132.226.41.106 31898 (ORACLE-BM...)
1 169.197.150.8 398989 (DEEPINTENT)
1 1 35.156.89.137 16509 (AMAZON-02)
1 18.195.155.181 16509 (AMAZON-02)
1 1 202.241.208.100 4694 (IDCF IDC ...)
2 2 185.184.8.65 204995 (RTB-HOUSE...)
2 6 8.39.36.141 26667 (RUBICONPR...)
5 143.204.98.109 16509 (AMAZON-02)
3 3 8.39.36.142 26667 (RUBICONPR...)
1 87.248.118.22 34010 (YAHOO-IRD)
1 35.244.174.68 15169 (GOOGLE)
3 142.250.184.195 15169 (GOOGLE)
328 76
14    104.26.1.97 (United States)

ASN13335 (CLOUDFLARENET, US)
thehackernews.com
9    104.76.201.201 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-76-201-201.deploy.static.akamaitechnologies.com
cdn.doubleverify.com
cdn3.doubleverify.com
3    104.18.28.173 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.adpushup.com
9    213.254.244.14 (Ireland)

ASN3257 (GTT-BACKBONE GTT, US)
rtb0.doubleverify.com
tps20516.doubleverify.com
tps20521.doubleverify.com
1    69.16.175.10 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: hwcdn.net
code.jquery.com
6    142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net
www.googletagservices.com
3    23.97.225.52 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
e3.adpushup.com
5    142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net
securepubads.g.doubleclick.net
partner.googleadservices.com
5    143.204.95.188 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-95-188.fra50.r.cloudfront.net
c.amazon-adsystem.com
16    216.58.212.174 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f14.1e100.net
fundingchoicesmessages.google.com
7    91.228.74.134 (United Kingdom)

ASN16509 (AMAZON-02, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
1    142.250.186.102 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f6.1e100.net
ad.doubleclick.net
1    143.204.98.34 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-34.fra50.r.cloudfront.net
rules.quantcount.com
22    216.58.212.162 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f2.1e100.net
pagead2.googlesyndication.com
4    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
googleads4.g.doubleclick.net
1    143.204.98.28 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-28.fra50.r.cloudfront.net
choices.truste.com
18    142.250.185.193 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f1.1e100.net
tpc.googlesyndication.com
8    142.250.185.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net
s0.2mdn.net
2    34.249.252.185 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-252-185.eu-west-1.compute.amazonaws.com
att.demdex.net
1    18.196.159.27 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-159-27.eu-central-1.compute.amazonaws.com
d.agkn.com
4    178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
1    104.16.89.20 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
5    172.67.8.174 (United States)

ASN13335 (CLOUDFLARENET, US)
i.connectad.io
cdn.connectad.io
sync-eu.connectad.io
13    35.244.159.8 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
adpushup-d.openx.net
eu-u.openx.net
us-u.openx.net
3    147.75.38.124 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
prebid.a-mo.net
9    185.33.221.15 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
2    178.250.0.165 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.par.vip.prod.criteo.com
bidder.criteo.com
4    104.16.190.66 (United States)

ASN13335 (CLOUDFLARENET, US)
dmx.districtm.io
cdn.districtm.io
3    63.251.109.138 (United States)

ASN36062 (DOUBLE-VERIFY, US)
tps.doubleverify.com
tps11046.doubleverify.com
1    52.57.255.59 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-255-59.eu-central-1.compute.amazonaws.com
prebid-server.rubiconproject.com
1    69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
1    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
9    54.228.75.94 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
ads.servenobid.com
3    63.251.14.3 (United States)

ASN32475 (SINGLEHOP-LLC, US)
ap.lijit.com
ce.lijit.com
3    142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net
adservice.google.com
2    142.250.186.129 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f1.1e100.net
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
43    142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
6    142.250.186.164 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f4.1e100.net
www.google.com
10    2.18.234.21 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com
dsum-sec.casalemedia.com
ssum-sec.casalemedia.com
2    159.253.128.188 (Amsterdam, Netherlands)

ASN36351 (SOFTLAYER, US)
PTR: bc.80.fd9f.ip4.static.sl-reverse.com
um.simpli.fi
10    15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
1    35.186.193.173 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com
gcm.ctnsnet.com
2    85.114.159.93 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com
dsp.adfarm1.adition.com
1    35.190.0.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com
ads.travelaudience.com
2    91.207.59.214 (Moscow, Russian Federation)

ASN48061 (UMA-TECH-AS, RU)
PTR: smtp9.sender.ltmse.com
px.adhigh.net
3    142.250.185.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f10.1e100.net
fonts.googleapis.com
2    172.217.16.131 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f131.1e100.net
fonts.gstatic.com
1    104.16.19.94 (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    142.250.181.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f14.1e100.net
www.google-analytics.com
2    178.250.2.130 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
static.criteo.net
1    108.177.15.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wr-in-f157.1e100.net
stats.g.doubleclick.net
1    13.107.213.44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
public.servenobid.com
2    151.101.129.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
3    2.18.233.180 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com
ads.pubmatic.com
5    23.37.42.132 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-132.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
secure-assets.rubiconproject.com
8    185.29.134.248 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
7    37.157.6.247 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
3    185.64.190.78 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
18    54.194.104.251 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
g2.gumgum.com
rtb.gumgum.com
2    208.100.17.173 (Chicago, United States)

ASN32748 (STEADFAST, US)
PTR: ip173.208-100-17.static.steadfastdns.net
pixel.33across.com
ssc-cms.33across.com
1    51.38.120.206 (Germany)

ASN16276 (OVH, FR)
PTR: ip206.ip-51-38-120.eu
onetag-sys.com
6    185.86.139.104 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync.smartadserver.com
6    213.19.147.45 (United Kingdom)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    3.217.216.1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-217-216-1.compute-1.amazonaws.com
jadserve.postrelease.com
2    193.0.160.129 (Netherlands)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
1    178.162.133.149 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
1    82.145.213.8 (United Kingdom)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
2    213.155.156.183 (Ascension Island)

ASN1299 (TWELVE99 Twelve99, Telia Carrier, SE)
PTR: 213-155-156-183.teliacarrier-cust.com
d5p.de17a.com
5    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
1    178.250.0.163 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
5    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
3    198.47.127.20 (United States)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
simage4.pubmatic.com
2    51.222.80.231 (France)

ASN16276 (OVH, FR)
PTR: pikafka-4.cloudy.ovh
pixel.onaudience.com
7    3.122.214.165 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-214-165.eu-central-1.compute.amazonaws.com
ps.eyeota.net
1    46.228.164.13 (United Kingdom)

ASN56396 (AMOBEE, GB)
d.turn.com
4    151.101.66.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
2    18.156.0.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
2    52.46.130.91 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
2    52.49.244.74 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-244-74.eu-west-1.compute.amazonaws.com
pr-bh.ybp.yahoo.com
2    135.125.160.160 (United States)

ASN16276 (OVH, FR)
PTR: ns3198892.ip-135-125-160.eu
gu.dyntrk.com
1    54.175.36.162 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-36-162.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
2    18.213.10.151 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-10-151.compute-1.amazonaws.com
um2.eqads.com
2    185.33.221.52 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
2    66.155.71.25 (Southampton, United Kingdom)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
1    18.198.69.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-69-109.eu-central-1.compute.amazonaws.com
loadm.exelator.com
2    35.227.248.159 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com
pixel.tapad.com
6    3.123.82.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-82-137.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    18.197.21.136 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-21-136.eu-central-1.compute.amazonaws.com
a.sportradarserving.com
1    34.205.3.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-205-3-24.compute-1.amazonaws.com
sync.srv.stackadapt.com
2    64.74.236.159 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: chi.outbrain.com
b1sync.zemanta.com
1    104.111.215.191 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
3    70.42.32.31 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
sync.outbrain.com
1    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
1    52.21.104.248 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-104-248.compute-1.amazonaws.com
sync.ipredictive.com
1    132.226.41.106 (Amsterdam, Netherlands)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
1    169.197.150.8 (Albuquerque, United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
1    35.156.89.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-89-137.eu-central-1.compute.amazonaws.com
ad.360yield.com
1    18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
cs.emxdgt.com
1    202.241.208.100 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)
tg.socdm.com
2    185.184.8.65 (Poland)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-65.rtbhouse.net
creativecdn.com
6    8.39.36.141 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
5    143.204.98.109 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-109.fra50.r.cloudfront.net
choices.trustarc.com
3    8.39.36.142 (United States)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
1    87.248.118.22 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)
PTR: e1.ycpi.vip.deb.yahoo.com
ads.yahoo.com
1    35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
3    142.250.184.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net
www.gstatic.com
Apex Domain
Subdomains		 Transfer
53 doubleclick.net
securepubads.g.doubleclick.net
ad.doubleclick.net
googleads4.g.doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
stats.g.doubleclick.net
281 KB
42 googlesyndication.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
438 KB
25 google.com
fundingchoicesmessages.google.com
adservice.google.com
www.google.com
84 KB
21 doubleverify.com
cdn.doubleverify.com
cdn3.doubleverify.com
rtb0.doubleverify.com
tps20516.doubleverify.com
tps20521.doubleverify.com
tps.doubleverify.com
tps11046.doubleverify.com
141 KB
20 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
image6.pubmatic.com
image2.pubmatic.com
simage2.pubmatic.com
image4.pubmatic.com
simage4.pubmatic.com
35 KB
18 gumgum.com
g2.gumgum.com
rtb.gumgum.com
6 KB
16 rubiconproject.com
prebid-server.rubiconproject.com
fastlane.rubiconproject.com
eus.rubiconproject.com
secure-assets.rubiconproject.com
pixel.rubiconproject.com
token.rubiconproject.com
25 KB
14 thehackernews.com
thehackernews.com
198 KB
13 adnxs.com
ib.adnxs.com
acdn.adnxs.com
secure.adnxs.com
44 KB
13 openx.net
adpushup-d.openx.net
eu-u.openx.net
us-u.openx.net
3 KB
10 adsrvr.org
match.adsrvr.org
4 KB
10 casalemedia.com
dsum-sec.casalemedia.com
ssum-sec.casalemedia.com
10 KB
10 servenobid.com
ads.servenobid.com
public.servenobid.com
6 KB
8 mathtag.com
sync.mathtag.com
4 KB
8 2mdn.net
s0.2mdn.net
888 KB
7 eyeota.net
ps.eyeota.net
4 KB
7 adform.net
c1.adform.net
3 KB
7 criteo.com
gum.criteo.com
bidder.criteo.com
dis.criteo.com
7 KB
7 quantserve.com
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
12 KB
7 amazon-adsystem.com
c.amazon-adsystem.com
s.amazon-adsystem.com
41 KB
6 bidswitch.net
x.bidswitch.net
4 KB
6 smartadserver.com
ssbsync.smartadserver.com
4 KB
6 googletagservices.com
www.googletagservices.com
168 KB
6 adpushup.com
cdn.adpushup.com
e3.adpushup.com
201 KB
5 trustarc.com
choices.trustarc.com
16 KB
5 yahoo.com
ups.analytics.yahoo.com
pr-bh.ybp.yahoo.com
ads.yahoo.com
3 KB
5 gstatic.com
fonts.gstatic.com
www.gstatic.com
44 KB
5 connectad.io
i.connectad.io
cdn.connectad.io
sync-eu.connectad.io
3 KB
4 everesttech.net
sync-tm.everesttech.net
903 B
4 1rx.io
sync.1rx.io
2 KB
4 districtm.io
dmx.districtm.io
cdn.districtm.io
344 B
3 outbrain.com
sync.outbrain.com
1 KB
3 googleapis.com
fonts.googleapis.com
3 KB
3 lijit.com
ap.lijit.com
ce.lijit.com
2 KB
3 a-mo.net
prebid.a-mo.net
853 B
2 creativecdn.com
creativecdn.com
695 B
2 zemanta.com
b1sync.zemanta.com
1 KB
2 sportradarserving.com
a.sportradarserving.com
1 KB
2 tapad.com
pixel.tapad.com
1 KB
2 sitescout.com
pixel-sync.sitescout.com
1 KB
2 eqads.com
um2.eqads.com
563 B
2 dyntrk.com
gu.dyntrk.com
850 B
2 onaudience.com
pixel.onaudience.com
791 B
2 de17a.com
d5p.de17a.com
637 B
2 rfihub.com
p.rfihub.com
1 KB
2 unrulymedia.com
sync.targeting.unrulymedia.com
942 B
2 33across.com
pixel.33across.com
ssc-cms.33across.com
2 criteo.net
static.criteo.net
55 KB
2 google-analytics.com
www.google-analytics.com
20 KB
2 adhigh.net
px.adhigh.net
964 B
2 adition.com
dsp.adfarm1.adition.com
1 KB
2 simpli.fi
um.simpli.fi
1 KB
2 demdex.net
att.demdex.net
2 KB
1 rlcdn.com
id.rlcdn.com
1 socdm.com
tg.socdm.com
699 B
1 emxdgt.com
cs.emxdgt.com
1 360yield.com
ad.360yield.com
197 B
1 deepintent.com
match.deepintent.com
44 B
1 technoratimedia.com
sync.technoratimedia.com
293 B
1 ipredictive.com
sync.ipredictive.com
428 B
1 bttrack.com
bttrack.com
380 B
1 contextweb.com
bh.contextweb.com
383 B
1 bluekai.com
stags.bluekai.com
1 KB
1 stackadapt.com
sync.srv.stackadapt.com
614 B
1 exelator.com
loadm.exelator.com
664 B
1 cognitivlabs.com
beacon.lynx.cognitivlabs.com
377 B
1 turn.com
d.turn.com
472 B
1 opera.com
t.adx.opera.com
508 B
1 sonobi.com
sync.go.sonobi.com
474 B
1 postrelease.com
jadserve.postrelease.com
427 B
1 onetag-sys.com
onetag-sys.com
823 B
1 googleadservices.com
partner.googleadservices.com
446 B
1 cloudflare.com
cdnjs.cloudflare.com
28 KB
1 travelaudience.com
ads.travelaudience.com
525 B
1 ctnsnet.com
gcm.ctnsnet.com
480 B
1 jsdelivr.net
cdn.jsdelivr.net
1 KB
1 agkn.com
d.agkn.com
671 B
1 truste.com
choices.truste.com
9 KB
1 quantcount.com
rules.quantcount.com
345 B
1 jquery.com
code.jquery.com
29 KB
0 admanmedia.com Failed
cs.admanmedia.com Failed
328 81
Domain Requested by
32 cm.g.doubleclick.net 12 redirects googleads.g.doubleclick.net
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
eu-u.openx.net
g2.gumgum.com
22 pagead2.googlesyndication.com ad.doubleclick.net
tpc.googlesyndication.com
thehackernews.com
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
googleads.g.doubleclick.net
securepubads.g.doubleclick.net
pagead2.googlesyndication.com
www.googletagservices.com
18 tpc.googlesyndication.com ad.doubleclick.net
tpc.googlesyndication.com
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
17 rtb.gumgum.com 1 redirects g2.gumgum.com
16 fundingchoicesmessages.google.com cdn.adpushup.com
14 thehackernews.com thehackernews.com
11 googleads.g.doubleclick.net e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
thehackernews.com
pagead2.googlesyndication.com
googleads.g.doubleclick.net
10 match.adsrvr.org 4 redirects e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
cdn.adpushup.com
eu-u.openx.net
ssum-sec.casalemedia.com
9 ads.servenobid.com cdn.adpushup.com
public.servenobid.com
ssum-sec.casalemedia.com
ssbsync.smartadserver.com
g2.gumgum.com
9 ib.adnxs.com 4 redirects cdn.adpushup.com
googleads.g.doubleclick.net
acdn.adnxs.com
8 sync.mathtag.com 8 redirects
8 dsum-sec.casalemedia.com 3 redirects googleads.g.doubleclick.net
ssum-sec.casalemedia.com
um2.eqads.com
8 s0.2mdn.net thehackernews.com
s0.2mdn.net
7 ps.eyeota.net 6 redirects ads.pubmatic.com
7 c1.adform.net 5 redirects ads.pubmatic.com
ssum-sec.casalemedia.com
7 cdn.doubleverify.com thehackernews.com
cdn.doubleverify.com
ad.doubleclick.net
6 pixel.rubiconproject.com 2 redirects g2.gumgum.com
6 x.bidswitch.net 6 redirects
6 ssbsync.smartadserver.com 1 redirects public.servenobid.com
ssbsync.smartadserver.com
6 eu-u.openx.net cdn.adpushup.com
eu-u.openx.net
6 www.google.com 2 redirects e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
tpc.googlesyndication.com
googleads.g.doubleclick.net
6 www.googletagservices.com cdn.doubleverify.com
www.googletagservices.com
ad.doubleclick.net
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
googleads.g.doubleclick.net
5 choices.trustarc.com choices.truste.com
5 simage2.pubmatic.com ads.pubmatic.com
5 image2.pubmatic.com ads.pubmatic.com
5 us-u.openx.net 1 redirects eu-u.openx.net
5 c.amazon-adsystem.com cdn.adpushup.com
c.amazon-adsystem.com
4 sync-tm.everesttech.net 4 redirects
4 sync.1rx.io 4 redirects
4 eus.rubiconproject.com cdn.adpushup.com
eus.rubiconproject.com
g2.gumgum.com
4 gum.criteo.com cdn.adpushup.com
static.criteo.net
gum.criteo.com
4 tps20521.doubleverify.com cdn.doubleverify.com
4 googleads4.g.doubleclick.net ad.doubleclick.net
thehackernews.com
4 pixel.quantserve.com 3 redirects thehackernews.com
4 securepubads.g.doubleclick.net cdn.adpushup.com
securepubads.g.doubleclick.net
3 www.gstatic.com googleads.g.doubleclick.net
3 token.rubiconproject.com 3 redirects
3 sync.outbrain.com 3 redirects
3 image6.pubmatic.com 2 redirects ads.pubmatic.com
3 ads.pubmatic.com cdn.adpushup.com
ads.pubmatic.com
g2.gumgum.com
3 fonts.googleapis.com s0.2mdn.net
googleads.g.doubleclick.net
3 adservice.google.com securepubads.g.doubleclick.net
pagead2.googlesyndication.com
3 prebid.a-mo.net 1 redirects cdn.adpushup.com
3 e3.adpushup.com cdn.adpushup.com
thehackernews.com
3 tps20516.doubleverify.com cdn.doubleverify.com
3 cdn.adpushup.com thehackernews.com
cdn.adpushup.com
2 cms.quantserve.com 2 redirects
2 creativecdn.com 2 redirects
2 b1sync.zemanta.com 2 redirects
2 a.sportradarserving.com 2 redirects
2 pixel.tapad.com 2 redirects
2 pixel-sync.sitescout.com 2 redirects
2 secure.adnxs.com 2 redirects
2 um2.eqads.com 1 redirects ssum-sec.casalemedia.com
2 gu.dyntrk.com 2 redirects
2 pr-bh.ybp.yahoo.com ssum-sec.casalemedia.com
g2.gumgum.com
2 s.amazon-adsystem.com 1 redirects ssum-sec.casalemedia.com
2 ups.analytics.yahoo.com 2 redirects
2 pixel.onaudience.com 2 redirects
2 image4.pubmatic.com ads.pubmatic.com
2 d5p.de17a.com 2 redirects
2 p.rfihub.com 2 redirects
2 sync.targeting.unrulymedia.com 2 redirects
2 ce.lijit.com 1 redirects public.servenobid.com
2 ssum-sec.casalemedia.com public.servenobid.com
ssum-sec.casalemedia.com
2 cdn.connectad.io cdn.adpushup.com
2 acdn.adnxs.com cdn.adpushup.com
2 cdn.districtm.io cdn.adpushup.com
2 static.criteo.net cdn.adpushup.com
static.criteo.net
2 www.google-analytics.com thehackernews.com
www.google-analytics.com
2 tps11046.doubleverify.com cdn.doubleverify.com
2 fonts.gstatic.com fonts.googleapis.com
2 px.adhigh.net 2 redirects
2 dsp.adfarm1.adition.com 2 redirects
2 um.simpli.fi 1 redirects ads.pubmatic.com
2 e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com securepubads.g.doubleclick.net
2 dmx.districtm.io cdn.adpushup.com
2 bidder.criteo.com cdn.adpushup.com
2 adpushup-d.openx.net cdn.adpushup.com
2 i.connectad.io cdn.adpushup.com
2 att.demdex.net 1 redirects thehackernews.com
2 rtb0.doubleverify.com cdn.doubleverify.com
2 cdn3.doubleverify.com cdn.doubleverify.com
1 simage4.pubmatic.com ads.pubmatic.com
1 id.rlcdn.com
1 ads.yahoo.com
1 tg.socdm.com 1 redirects
1 cs.emxdgt.com g2.gumgum.com
1 ssc-cms.33across.com g2.gumgum.com
1 secure-assets.rubiconproject.com 1 redirects
1 ad.360yield.com 1 redirects
1 match.deepintent.com g2.gumgum.com
1 sync.technoratimedia.com g2.gumgum.com
1 sync.ipredictive.com 1 redirects
1 bttrack.com g2.gumgum.com
1 bh.contextweb.com 1 redirects
1 stags.bluekai.com 1 redirects
1 sync.srv.stackadapt.com 1 redirects
1 loadm.exelator.com 1 redirects
1 beacon.lynx.cognitivlabs.com 1 redirects
1 d.turn.com 1 redirects
1 dis.criteo.com 1 redirects
1 t.adx.opera.com 1 redirects
1 sync.go.sonobi.com public.servenobid.com
1 jadserve.postrelease.com public.servenobid.com
1 onetag-sys.com public.servenobid.com
1 pixel.33across.com public.servenobid.com
1 g2.gumgum.com public.servenobid.com
1 sync-eu.connectad.io cdn.connectad.io
1 public.servenobid.com cdn.adpushup.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 stats.g.doubleclick.net www.google-analytics.com
1 cdnjs.cloudflare.com thehackernews.com
1 ads.travelaudience.com 1 redirects
1 gcm.ctnsnet.com 1 redirects
1 ap.lijit.com cdn.adpushup.com
1 hbopenbid.pubmatic.com cdn.adpushup.com
1 fastlane.rubiconproject.com cdn.adpushup.com
1 prebid-server.rubiconproject.com cdn.adpushup.com
1 tps.doubleverify.com cdn.doubleverify.com
1 cdn.jsdelivr.net cdn.adpushup.com
1 d.agkn.com thehackernews.com
1 choices.truste.com ad.doubleclick.net
1 rules.quantcount.com secure.quantserve.com
1 ad.doubleclick.net www.googletagservices.com
1 secure.quantserve.com cdn.adpushup.com
1 code.jquery.com cdn.adpushup.com
0 cs.admanmedia.com Failed public.servenobid.com
328 128
Subject Issuer Validity Valid
thehackernews.com
Cloudflare Inc ECC CA-3		 2021-06-01 -
2022-05-31		 a year crt.sh
*.doubleverify.com
DigiCert SHA2 Secure Server CA		 2021-01-10 -
2022-01-17		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-22 -
2022-06-21		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.adpushup.com
Sectigo RSA Domain Validation Secure Server CA		 2020-05-27 -
2022-08-29		 2 years crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.truste.com
Amazon		 2021-02-16 -
2022-03-17		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-09 -
2021-12-07		 3 months crt.sh
connectad.io
Cloudflare Inc ECC CA-3		 2021-05-16 -
2022-05-15		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
*.a-mo.net
R3		 2021-10-05 -
2022-01-03		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2021-03-05 -
2022-02-19		 a year crt.sh
districtm.io
Cloudflare Inc ECC CA-3		 2021-06-02 -
2022-06-01		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-04		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-09-04		 a year crt.sh
ads.servenobid.com
Amazon		 2021-06-28 -
2022-07-27		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
www.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-10-04 -
2021-12-27		 3 months crt.sh
*.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-09 -
2021-12-07		 3 months crt.sh
public.servenobid.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-22 -
2022-05-22		 a year crt.sh
cdn.adnxs.com
GlobalSign Organization Validated CA - SHA256 - G4		 2021-05-10 -
2022-06-11		 a year crt.sh
*.gumgum.com
Amazon		 2021-06-05 -
2022-07-04		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
onetag-sys.com
R3		 2021-10-14 -
2022-01-12		 3 months crt.sh
*.smartadserver.com
DigiCert ECC Secure Server CA		 2020-01-30 -
2022-02-03		 2 years crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-02-05 -
2022-02-09		 a year crt.sh
*.postrelease.com
Amazon		 2021-01-28 -
2022-02-25		 a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2020-12-06 -
2022-01-07		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.simpli.fi
DigiCert SHA2 Secure Server CA		 2019-09-18 -
2021-12-12		 2 years crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2021-08-24 -
2022-02-16		 6 months crt.sh
um3.eqads.com
Amazon		 2021-06-26 -
2022-07-25		 a year crt.sh
*.technoratimedia.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-17 -
2022-10-05		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2		 2021-05-18 -
2022-06-19		 a year crt.sh
*.trustarc.com
Go Daddy Secure Certificate Authority - G2		 2020-05-21 -
2022-07-17		 2 years crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh

This page contains 60 frames:

Primary Page: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Frame ID: 45847AE4BF577A40956233454B10B29E
Requests: 125 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/bst2tv3.html
Frame ID: 4925EEC93DA56A3468664EAF370487FC
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-match6.js
Frame ID: 9416654BF0DC78C789B1BCA62D61D874
Requests: 1 HTTP requests in this frame

Frame: https://cdn3.doubleverify.com/bst2tv3.html
Frame ID: 5A009F398131DA61BCE87CD7D1E8BD82
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-match6.js
Frame ID: 7F557A7D011FCBCFA1B71CE39077883B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1800.js
Frame ID: 4A96591F8843FCE7B7003D0262BBA097
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 86FAFCACAB2C76F225114311466C78B6
Requests: 3 HTTP requests in this frame

Frame: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: D6413DFCD356765F042DC5FF6E599E9D
Requests: 1 HTTP requests in this frame

Frame: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: D978FA044E9197C6282BB0E4093D9CCB
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYx4a0twEwAQ&v=APEucNVI3lFTOdHle_17zFUradHCmbszucw88gR2cuY9NI-eR1ueOUx-sf2bSdAyfdtRBDPD8uFXum1fQQlpYgT89ELBegJOW8AE5HaiLs1MslsHrYb_4oA
Frame ID: B114FB3867F6FD8ECD92258DAF72AB8A
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 109A0D9F6D973EB6E8D5ED5A49CB7592
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E239DC920C1DD27F35F6231D69C407D8
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Frame ID: 1E9062F8877C462EAC75DBEB81576B32
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20190131/zrt_lookup.html
Frame ID: 8E6A3115A07FB471B208F9212BAC8D4F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: F436FA22EE971C491E864922AADAAE73
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D253FF3FD9DF107FEDE372A7841C71C3
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=thehackernews.com&gdpr=0&gdpr_consent=
Frame ID: C73386530FAF599BD4E69FB654794538
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Frame ID: 78B07DC18A3E706FBF420952CE1B3B1C
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&adk=1812271804&adf=3025194257&lmt=1635411984&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782952&bpp=1&bdt=3771&idt=105&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&prev_fmts=300x250&nras=1&correlator=7818631033191&frm=20&pv=1&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=110
Frame ID: EEA496F78F4F4C508545D39D63E5542F
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 621092444E7C102DBF90A46502FB2A98
Requests: 10 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: F0F4716EDDDE04559B314D4547100C8A
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 7748B4A85DB8A19EF7784AC072E50ABF
Requests: 2 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php
Frame ID: A3A294B78E6B9947F15AB75B6F6EB308
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Frame ID: A9EDC2A1336502EFB7D997934F5DD821
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: E665C85C1B237475DA68744590814822
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Frame ID: A890FA3B22266DEBA3D4D5D0064F0262
Requests: 15 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php
Frame ID: A368CE9FF76345AA509FCCF79DE62536
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 5915360072D89B1CF215382224F183CC
Requests: 10 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 5AE37AF6A17CEBC03AC52389766BC703
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Frame ID: F1F3BF858716110EF00696E9647C5B77
Requests: 7 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/syncer/1
Frame ID: 36F281FFC9DDD76D1E0B536003C671C4
Requests: 1 HTTP requests in this frame

Frame: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Frame ID: 6EE7DD0FEE4938EA873798C9837D89F2
Requests: 16 HTTP requests in this frame

Frame: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Frame ID: 2379034AC842A7FD9C336C70267A82C5
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1---&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Frame ID: 1AE4E8CBD5D8AA06EDE012C9915CF21C
Requests: 1 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Frame ID: 0540698494D478D2B97A038AF49FEAF2
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Frame ID: 476D891B270A37301D413EC769E8A5FE
Requests: 9 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?party=14&cid=04058E6D-CF71-44B3-9A35-BA9855CD0606
Frame ID: BDC1C1EB8E3618D71822EA3ACB47B0C2
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4074810829502671380
Frame ID: 47256A161897A709A9C8D8B2D5963021
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Frame ID: 44E78819696C34880CA7DC0B0137EA06
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7024057294773483671
Frame ID: F29CDFBB24ABD9DA3608559D50996C2B
Requests: 1 HTTP requests in this frame

Frame: https://um2.eqads.com/um/cs&eq_cc=1
Frame ID: 9AE476C20A2FDDECA659592264385928
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: E32112BE8FBBB4A998A4A27C8063DBBF
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=c61aa380-6009-44cb-990a-49fd11b2da96&t=1638007783
Frame ID: EC09690F4057DB0FC52C6AD6CC3E4135
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 71AF051C28C3374285C8B4D256BEC67F
Requests: 3 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Frame ID: 4F10CFA5A9CEC87A73199CC66E9114C2
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=atm&i=YXp25wAAPk46CQBR&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR
Frame ID: 49AB36C1010F40C87B3212D2BB4D5BA7
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV84MGEyMjkyYy1jNDgxLTQ4MzYtYWVhZC0zMWM4NDA4NWM0Mzg=&gdpr=0&gdpr_consent=
Frame ID: 54B48BA1B796DBEE91BE795A6CA98FEF
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Frame ID: 54EC6A98F7BFE490EEE817222A2E6F54
Requests: 1 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Frame ID: 94AB411299DAD9C0B2D0130C1AF96534
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=sus&i=YXp26MCo5swAAAevNSoAAAAA
Frame ID: 0A3837E464E99A77156B551C74B0D72E
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=zet&i=5123196420252769156
Frame ID: 230EB657DADCDFC549CDF910CEEBDC80
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=rth&i=abyVPsSZ9Dstatw9ER1x&pi=gumgum&tc=1
Frame ID: 963019D4CFA9AF7533AE8799C5C88FA7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 1F48874CFD081645BB2AE264FA11D1EE
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2215FAC87DFA2433C4FB888B9B8E449E
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
Frame ID: E81CBF4CB481372557DC62D7983F19AA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Frame ID: 184FB26A9329E0923814FDCD06B3A35B
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 786275AC00478AD79D3F0F0D7889F72F
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 822861AB0BB8FCB90E322146C65F7B3F
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E39DE2D8C2167B1E666FD1E314779056
Requests: 6 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 01BEED782565A94554648EAF762F0676
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Hackers Using Squirrelwaffle Loader to Deploy Qakbot and Cobalt Strike

Page Statistics

328
Requests

78 %
HTTPS

0 %
IPv6

81
Domains

128
Subdomains

76
IPs

11
Countries

2804 kB
Transfer

6308 kB
Size

126
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50
  • https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292494536&d_campaign=24935727&d_site=5936378 HTTP 302
  • https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292494536&d_campaign=24935727&d_site=5936378
Request Chain 120
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0&C=1
Request Chain 121
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=YXp25e20L6u7mOkonYPcBAAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0
Request Chain 122
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEG1QMAioaklCXVB3Rs_DTq8&google_cver=1
Request Chain 123
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjEwMTk1NzkxNTY4NTM1Nzc1OA%3D%3D
Request Chain 133
  • https://um.simpli.fi/gp_match?google_gid=CAESEKaxpEOrgQgFU8ST6fGh8D0&google_cver=1&google_push=AYg5qPKnSvcNcAacPZGwbdFp-mpw32MB4kP--2d9upbOsZ0nd72PHSpqT9yDGfhfWANI-5OdkSbtSKIYvUMKGCB0mdj6x3l7y5iN HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=90105F77DE07453DB190875A6839F3E7&google_push=AYg5qPKnSvcNcAacPZGwbdFp-mpw32MB4kP--2d9upbOsZ0nd72PHSpqT9yDGfhfWANI-5OdkSbtSKIYvUMKGCB0mdj6x3l7y5iN
Request Chain 135
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEEsZSljXtXWWXjf318XBE6I&google_cver=1&google_push=AYg5qPLfu03fjHyLNnCFctx3_n7F84Fe8QOA8fr1GULGJLJUKp0WRZ9j2esvPjEPB9lgVTBjrGGhVjdvAWam_I4lnYXWh9GcmtiM HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLfu03fjHyLNnCFctx3_n7F84Fe8QOA8fr1GULGJLJUKp0WRZ9j2esvPjEPB9lgVTBjrGGhVjdvAWam_I4lnYXWh9GcmtiM&google_hm=JREYxwwpSZSwFrqNRyppzjc
Request Chain 136
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEO4S2T-Y0DIr3c0DhQI0Iho&google_cver=1&google_push=AYg5qPIZxMCK5jsHRCQzbNxgXWOYV_uRhQKzLsLNTqqFT7hr7Kd4FXFoNiKTO03xJmTGPYIwfmB3Bn4M8A96S7DJqoSWGSp4wP8yZw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDA1NzI5NDc3MzQ4MzY3MQ%3D%3D&google_push=AYg5qPIZxMCK5jsHRCQzbNxgXWOYV_uRhQKzLsLNTqqFT7hr7Kd4FXFoNiKTO03xJmTGPYIwfmB3Bn4M8A96S7DJqoSWGSp4wP8yZw
Request Chain 137
  • https://ads.travelaudience.com/google_pixel?google_gid=CAESENgDK_ySBqSfnQbQ_f5QG6k&google_cver=1&google_push=AYg5qPLhH4DQZadbuByafd9xX9Sj7AADt9uAZo8c3q9IVtTztY0C3Xn0bFMjCF-HqAJg8tNnc6CEjMrMF69phIuKTI1JdQSpxWJaXg HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QdLLH_7dSCqdgNWshSPmPw2&google_push=AYg5qPLhH4DQZadbuByafd9xX9Sj7AADt9uAZo8c3q9IVtTztY0C3Xn0bFMjCF-HqAJg8tNnc6CEjMrMF69phIuKTI1JdQSpxWJaXg
Request Chain 138
  • https://px.adhigh.net/p/gm/rub?google_gid=CAESEK7hsK2VwhuSUZLWD10BLQE&google_cver=1&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw HTTP 302
  • https://px.adhigh.net/p/gm/rub?google_gid=CAESEK7hsK2VwhuSUZLWD10BLQE&google_cver=1&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw&bounced=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw&google_hm=jUgN4rqs4UUAAikABlF8xmByJg%3D%3D
Request Chain 139
  • https://match.360yield.com/match/ebda?google_gid=CAESEHGQxDRBdIcEcaf6f8hSocQ&google_cver=1&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEHGQxDRBdIcEcaf6f8hSocQ&google_cver=1&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg
Request Chain 189
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
Request Chain 190
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
Request Chain 191
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7513717851230090471
Request Chain 194
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
Request Chain 195
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
Request Chain 196
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
Request Chain 197
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=710460537649607420
Request Chain 200
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
Request Chain 211
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID HTTP 302
  • https://ads.servenobid.com/sync?pid=312&uid=6101957915685357758
Request Chain 212
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D HTTP 302
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
Request Chain 213
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2218961230 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/c61aa380-6009-44cb-990a-49fd11b2da96 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003 HTTP 302
  • https://ads.servenobid.com/sync?pid=321&uid=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
Request Chain 216
  • https://p.rfihub.com/cm?pub=44007&in=1 HTTP 302
  • https://ads.servenobid.com/sync?pid=324&uid=5123196420252769156
Request Chain 218
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1---&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D HTTP 302
  • https://ads.servenobid.com/sync?pid=327&uid=124b8dda-45ee-4354-9ba8-33e920a174f9&gdpr=0&gdpr_consent=&us_privacy=1---
Request Chain 219
  • https://t.adx.opera.com/pub/sync?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D335%26uid%3D HTTP 302
  • https://ads.servenobid.com/sync?operaUid=3a5423448670419f9993bf003e0d0eb6&pid=335&uid=
Request Chain 222
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4074810829502671380
Request Chain 223
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Request Chain 224
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7024057294773483671
Request Chain 225
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 226
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=df86617a-76e7-4500-afd3-42bd134a913f
Request Chain 227
  • https://pixel.onaudience.com/?partner=214&mapped=04058E6D-CF71-44B3-9A35-BA9855CD0606 HTTP 302
  • https://pixel.onaudience.com/?partner=236&icm&cver&smartmap=1&redirect=ps.eyeota.net%2Fpixel%3Fgdpr%3D%26gdpr_consent%3D%26pid%3D3b2cb90%26t%3Dgif%26uid%3D%25m HTTP 302
  • https://ps.eyeota.net/pixel?gdpr=&gdpr_consent=&pid=3b2cb90&t=gif&uid=a3e93965d57101fd HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?gdpr=&gdpr_consent=&pid=3b2cb90&t=gif&uid=a3e93965d57101fd HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MlBYekdTTDFLY3huVHRzekJIUHkyb1JwV3B0SF9Rb0Q0alVyTGFrcG1tejQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90 HTTP 302
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&dc_mr=5&dc_orig=3b2cb90&referrer_pid=3b2cb90&google_gid=CAESED9oFEax3yvhWm2mpwGMEOk&google_cver=1 HTTP 302
  • https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&dc_rc=2&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90 HTTP 302
  • https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4353370598078843813&newuser=1&dc_rc=2&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90 HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10015&redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3D7vi0rg0%26uid%3D%5BMM_UUID%5D%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3D3b2cb90%26%26referrer_pid%3D3b2cb90 HTTP 302
  • https://ps.eyeota.net/match?bid=7vi0rg0&uid=df86617a-76e7-4500-afd3-42bd134a913f&dc_rc=3&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90 HTTP 302
  • https://sync-tm.everesttech.net/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D4%26dc_mr%3D5%26dc_orig%3D3b2cb90%26%26referrer_pid%3D3b2cb90 HTTP 302
  • https://ps.eyeota.net/match?uid=YXp25wAAPk46CQBR&bid=0rijhbu&dc_rc=4&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1 HTTP 302
  • https://ps.eyeota.net/match?uid=c61aa380-6009-44cb-990a-49fd11b2da96&bid=1e2n4ou
Request Chain 228
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDQwNThFNkQtQ0Y3MS00NEIzLTlBMzUtQkE5ODU1Q0QwNjA2&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 229
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJD6-cEA0zh7nP9u6XTkaPY&google_cver=1
Request Chain 231
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Request Chain 232
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c61aa380-6009-44cb-990a-49fd11b2da96
Request Chain 233
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7513717851230090471
Request Chain 234
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6101957915685357758&gdpr=0&gdpr_consent=
Request Chain 235
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wmKAY8Nl0jHZaoI7xGOaNZBi1mTZYdM3xWB3M66Z
Request Chain 236
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=04058E6D-CF71-44B3-9A35-BA9855CD0606&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=04058E6D-CF71-44B3-9A35-BA9855CD0606&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IbCDi6lE2uWoigdbkks3GeCSRKfKPmk-~A&gdpr=0&gdpr_consent=
Request Chain 237
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&gdpr_consent=&us_privacy=&gdpr=1 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
Request Chain 238
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXp25awCrY8zEsUSftc4LwAABFMAAAIB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&dcc=t
Request Chain 241
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1 HTTP 302
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Request Chain 242
  • https://beacon.lynx.cognitivlabs.com/ix.gif HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=6eb9fbbf-9547-4c55-b9c0-30604e7ad833&expiration=1666951783
Request Chain 245
  • https://um2.eqads.com/um/cs HTTP 302
  • https://um2.eqads.com/um/cs&eq_cc=1
Request Chain 247
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D86%26buid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=86&buid=6101957915685357758&gdpr=0&gdpr_consent=
Request Chain 248
  • https://pixel-sync.sitescout.com/dmp/pixelSync?gdpr=0&gdpr_consent=&nid=64&redir=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D68%26partneruserid%3D%7BuserId%7D HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&gdpr=0&gdpr_consent=&nid=64&redir=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D68%26partneruserid%3D%7BuserId%7D HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3Dcd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553%26partner_url%3Dhttps%253A%252F%252Fssbsync.smartadserver.com%252Fapi%252Fsync%253Fcallerid%253D9%2526gdpr%253D0%2526gdpr_consent%253D%2526partnerid%253D68%2526partneruserid%253Dcd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553&partner_url=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D68%26partneruserid%3Dcd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553 HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553&partner_url=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D68%26partneruserid%3Dcd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553 HTTP 302
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=68&partneruserid=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553
Request Chain 249
  • https://sync.mathtag.com/sync/img?gdpr=0&gdpr_consent=&mt_exid=39&redir=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D HTTP 302
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=25&partneruserid=df86617a-76e7-4500-afd3-42bd134a913f
Request Chain 250
  • https://c1.adform.net/serving/cookie/match?gdpr=0&gdpr_consent=&party=10&sspurl=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D22%26buid%3DYOUR_USER_ID HTTP 302
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=22&buid=7513717851230090471&gdpr=0&gdpr_consent=
Request Chain 257
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://rtb.gumgum.com/usersync?b=apn&i=6101957915685357758
Request Chain 258
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_80a2292c-c481-4836-aead-31c84085c438&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_80a2292c-c481-4836-aead-31c84085c438&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2 HTTP 302
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=958165c3-7dfc-4cfe-9d4c-54c577851884&ssp=gumgum2 HTTP 302
  • https://rtb.gumgum.com/usersync?b=bsw&i=b6081b06-acf6-48af-b02e-5f0275f032d3
Request Chain 259
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=sta&i=0-34513d64-ebd6-423a-4672-cea26625d739$ip$216.131.114.55
Request Chain 260
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_80a2292c-c481-4836-aead-31c84085c438&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=Dw2wLerKc6751uY7dBU9&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2RDXGJ3UYZLSJNRTMNZVGF2VSN3EIJKTSJTVONPXA4TJOZQWG6J5GEWS2LI&gdpr=0&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2RDXGJ3UYZLSJNRTMNZVGF2VSN3EIJKTSJTVONPXA4TJOZQWG6J5GEWS2LI HTTP 302
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Dw2wLerKc6751uY7dBU9&us_privacy=1---
Request Chain 261
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003&rndcb=3544070152 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=adconductor&user_id=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003&rndcb=3544070152 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=b6081b06-acf6-48af-b02e-5f0275f032d3&google_hm=YjYwODFiMDYtYWNmNi00OGFmLWIwMmUtNWYwMjc1ZjAzMmQz HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEAtOP7uxTfrX4_96-olG75c&google_cver=1&ssp=adconductor&bsw_param=b6081b06-acf6-48af-b02e-5f0275f032d3 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/b6081b06-acf6-48af-b02e-5f0275f032d3?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
Request Chain 262
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://rtb.gumgum.com/usersync?b=pln&i=HBFVgHlLLKdY&ev=1&pid=558355
Request Chain 263
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28xLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28xLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE%29 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_80a2292c-c481-4836-aead-31c84085c438&obuid=ENC(xLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE) HTTP 302
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
  • https://bttrack.com/Pixel/cookiesyncredir?rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dbidtellect%26uid%3D%7Bglobalid%7D%26obUid%3DxLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE
Request Chain 264
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=opx&i=0f393c45-16e0-4e83-a918-3e1900aaac35
Request Chain 266
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=vnt&i=2c07d654-37d7-11ec-9d14-fb2c7a265914
Request Chain 269
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=idi&i=050f484d-9723-4829-a4bc-9b176d08feca
Request Chain 270
  • https://ssbsync.smartadserver.com/api/sync?callerId=15 HTTP 302
  • https://rtb.gumgum.com/usersync?b=sad&i=780945751829422425&gdpr=1&gdpr_consent=
Request Chain 274
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=ttd&i=c61aa380-6009-44cb-990a-49fd11b2da96&t=1638007783
Request Chain 275
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 276
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://rtb.gumgum.com/usersync?b=mmh&i=df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Request Chain 277
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR HTTP 302
  • https://rtb.gumgum.com/usersync?b=atm&i=YXp25wAAPk46CQBR&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR
Request Chain 281
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://rtb.gumgum.com/usersync?b=sus&i=YXp26MCo5swAAAevNSoAAAAA
Request Chain 282
  • https://p.rfihub.com/cm?pub=42796&in=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=zet&i=5123196420252769156
Request Chain 283
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rth&i=abyVPsSZ9Dstatw9ER1x&pi=gumgum&tc=1
Request Chain 289
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBi2RdcJEVxUFz0x2eqV6M8&google_cver=1&google_push=AYg5qPKc4hdNkx9g68neWInyhPPM3_plDT96j48MirzI9rG53GksrUEkPAYro3nj-hahtf4eXft3ZQEGwq67p4Vxpa8_r47Z9ncH HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKc4hdNkx9g68neWInyhPPM3_plDT96j48MirzI9rG53GksrUEkPAYro3nj-hahtf4eXft3ZQEGwq67p4Vxpa8_r47Z9ncH&google_hm=jcB7qPKO3LvRJQnVav0KOw
Request Chain 290
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESED3gNyioToBzIZoTfBpvLcM&google_cver=1&google_push=AYg5qPI8Ba6OSu36_QkWFWhtJVGSk1zo2DWP50uv-arDkCUp5N7xQiw1b_f_OJs1ljAtrHlibN69gq5QdDVmUZMPQAWT4IOwBbU HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI8Ba6OSu36_QkWFWhtJVGSk1zo2DWP50uv-arDkCUp5N7xQiw1b_f_OJs1ljAtrHlibN69gq5QdDVmUZMPQAWT4IOwBbU
Request Chain 291
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK5f2EKNMAqWA_5I_dzC8Zs&google_cver=1&google_push=AYg5qPKspewi3UHvxMAhkQxbhL0ABciy6KH_ti4_KBgiZEkvrjcvmEooBqLYlxaD_Hl-9kpqGeOqtMMMGRwcgf4rmkGEeRroDSMr HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPKspewi3UHvxMAhkQxbhL0ABciy6KH_ti4_KBgiZEkvrjcvmEooBqLYlxaD_Hl-9kpqGeOqtMMMGRwcgf4rmkGEeRroDSMr
Request Chain 292
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
Request Chain 294
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 304
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVASBWK7-15-G28O&sigv=1&esig=2~7f65fa427baa7f6cb36831cc6c0edc64867edf88
Request Chain 305
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXp25wAAPk46CQBR
Request Chain 306
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=df86617a-76e7-4500-afd3-42bd134a913f&expires=28
Request Chain 308
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPwurVHy1okfjmcr4Z82enc&google_cver=1
Request Chain 309
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==
Request Chain 311
  • https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWZlNmM5ZTAzMzhjODAzMzc2YmJjZDc5NWY1YmM0NGE4NWIxMDViMg
Request Chain 326
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBi2RdcJEVxUFz0x2eqV6M8&google_cver=1&google_push=AYg5qPI9RgsBikrgtm-v9YGUMUWIBQcqhGeERP973O5AczhWHGDn0SdKnj-L6Io9jQ5-i6qlMLcmwDOcipfgqsUD5gHI51h51rM HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI9RgsBikrgtm-v9YGUMUWIBQcqhGeERP973O5AczhWHGDn0SdKnj-L6Io9jQ5-i6qlMLcmwDOcipfgqsUD5gHI51h51rM&google_hm=jcB7qPKO3LvRJQnVav0KOw
Request Chain 327
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESED3gNyioToBzIZoTfBpvLcM&google_cver=1&google_push=AYg5qPLk6C_pn_jT4Dyh6jKLGaQlBpJhRH9qTRuwfbIXpqgYEP6L0iaut1OHfYMpBV1ImpYDLwQoEa6stB1Q0BHjaa29wiXilN6J HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLk6C_pn_jT4Dyh6jKLGaQlBpJhRH9qTRuwfbIXpqgYEP6L0iaut1OHfYMpBV1ImpYDLwQoEa6stB1Q0BHjaa29wiXilN6J
Request Chain 328
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK5f2EKNMAqWA_5I_dzC8Zs&google_cver=1&google_push=AYg5qPJyV9t0ZdDj-DR81SYahoc2PqVjPngmvUnZg-oOYtJ00pZIQfcm07ZqKoH2VhV1CSFc6cpvFpx0ev9e4DjN4D30wclG918W HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPJyV9t0ZdDj-DR81SYahoc2PqVjPngmvUnZg-oOYtJ00pZIQfcm07ZqKoH2VhV1CSFc6cpvFpx0ev9e4DjN4D30wclG918W
Request Chain 329
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g
Request Chain 331
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

328 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request hackers-using-squirrelwaffle-loader-to.html
thehackernews.com/2021/10/ 		140 KB
62 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / WordPress VIP
Resource Hash
4523f860e8db1019c017be78408984c64f811a89724e8fc8d87bdf72c526758a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-type
text/html; charset=UTF-8
cf-ray
6a535ea8fc594108-PRG
cache-control
public, s-maxage=604800, max-age=0
expires
Thu, 28 Oct 2021 10:09:38 GMT
last-modified
Thu, 28 Oct 2021 09:06:24 GMT
link
</css/roboto.css>; as=style; rel=preload
strict-transport-security
max-age=15552000; includeSubDomains; preload
cf-cache-status
DYNAMIC
content-security-policy
upgrade-insecure-requests
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer-when-downgrade
x-content-type-options
nosniff
x-forwarded-for
216.131.114.55
x-frame-options
DENY
x-powered-by
WordPress VIP
x-xss-protection
1; mode=block
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zYHjKSFNjfd3KIqszQAf8wAu%2FI%2F8lQqliPSf3nu5wfzPdR9SWkqu49a8NjMx25lvMLwwcd%2BUHcI9vOG5dslNtz9pF%2BNNcrazeTv22A2t2YIQaJZypqlCEerwaFdfRyGgGwFN"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
server
cloudflare
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-h2-pushed
</css/roboto.css>
roboto.css
thehackernews.com/css/ 		77 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://thehackernews.com/css/roboto.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d8ab8467b889847c12c542bee765afc54acbaff1cc91ce3197ab4f2be8f08ff
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=giSG6r3s13V2Rw2C4o7cvQ%2FU6NbIB7RjKbTLFf0mucTeO%2BaSp3lelXznM4UNJN0YcZJvgfXtQKk2pnnpyGvQW3%2FkJizFWvZiXza6t0vc0wMg5A7bthOf416oHXc52Q%2FNaBRh"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=2592000, immutable, s-maxage=8640000
strict-transport-security
max-age=15552000; includeSubDomains; preload
cf-ray
6a535eabd89c4108-PRG
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
AVvXsEhwH6cDhMG-dk5SyFP2iiZbFAtcbLZRoT4tjxQd8zV4_G4CqqsdfDG9ZCqVUBpgnPwZoJo-bYEKM37pzrropIJZoMFmWMN8btr_vbWSVr4EFtfu6XxvGsZAxRhDEIYHMyIfxKoqiPltjVN5d0ln9B576pMudvP7mFJHgrJtwJyl96mcmjSGjOTNmDHc=s728...
thehackernews.com/new-images/img/a/ 		25 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEhwH6cDhMG-dk5SyFP2iiZbFAtcbLZRoT4tjxQd8zV4_G4CqqsdfDG9ZCqVUBpgnPwZoJo-bYEKM37pzrropIJZoMFmWMN8btr_vbWSVr4EFtfu6XxvGsZAxRhDEIYHMyIfxKoqiPltjVN5d0ln9B576pMudvP7mFJHgrJtwJyl96mcmjSGjOTNmDHc=s728-e1000
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f58fdfb817718728b8632b7506725b8b07226f68d2c03c84eb0e5012cd07c052
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
73114
cf-polished
qual=85, origFmt=jpeg, origSize=56589
x-forwarded-for
51.83.174.200
content-disposition
inline;filename="malware-attack.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
25404
x-xss-protection
0
expires
Tue, 23 Jul 2024 13:51:05 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v10ba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ALVn903Io%2BEu9tflmmy9uElsdZJjN2LKIimRxMV21ajxgX%2BkSwaGNnwMcATKZ0JF49pF7OhME4QQgba4oddtrbs3fL0%2FBG7GP54dBqsqBb%2B766mG019HOeH4fpFCws5YQCEh"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eac1a992788-PRG
access-control-expose-headers
Content-Length
AVvXsEj-IRciH06stEGwT1Ksqsqb8Yd1zf04OguZhHnkkOvVk-lAjvBG2s_RYtxjUiRB9IdZ4pXpj2XXRhOZg1ojKDnq421xI_8izV-liz9bcfTrRVImifhc0BTQhEInZwSjEgFqrPpKdpt6bUL1TOjWc7D2sU80DpmNSt-ngiHv_cCvS2HtFxR7PEqnvApo=s728...
thehackernews.com/new-images/img/a/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEj-IRciH06stEGwT1Ksqsqb8Yd1zf04OguZhHnkkOvVk-lAjvBG2s_RYtxjUiRB9IdZ4pXpj2XXRhOZg1ojKDnq421xI_8izV-liz9bcfTrRVImifhc0BTQhEInZwSjEgFqrPpKdpt6bUL1TOjWc7D2sU80DpmNSt-ngiHv_cCvS2HtFxR7PEqnvApo=s728-e1000
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f856d8043b78c674d0fff3663a149fd2716b7c0eecc24a2f88c8d469bd58d176
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
73114
cf-polished
qual=85, origFmt=jpeg, origSize=27325
x-forwarded-for
51.83.174.200
content-disposition
inline;filename="email.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
15064
x-xss-protection
0
expires
Tue, 23 Jul 2024 13:51:05 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v10b6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ol8Mni820jF1XEakbQ97DZtKhMWLtpzQuUWPzPAnENHknMmECH9mHhZq%2Bo1iJQnQ5NEJeDk9xqQAHjNvoPbvum41h7KvagDVqH3IJXCH0wOJ48SBuXoJ7nd%2B0RyhwIZqXIIz"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eac1a9f2788-PRG
access-control-expose-headers
Content-Length
dvbs_src.js
cdn.doubleverify.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292494536%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Aug 2021 12:31:26 GMT
Server
Microsoft-IIS/10.0
ETag
"60d09d781a8dd71:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1338
dvbs_src.js
cdn.doubleverify.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292495514%26sid%3D5936378%26dvregion%3D2%26unit%3D728x90
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Aug 2021 12:31:26 GMT
Server
Microsoft-IIS/10.0
ETag
"60d09d781a8dd71:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
1338
adpushup.js
cdn.adpushup.com/37020/ 		384 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adpushup.com/37020/adpushup.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.28.173 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adcfcc33dc718b3b521236b5fe56aeafa725ffdb1e58229be4cdd9e773a09c61

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 25 Oct 2021 12:45:22 GMT
server
cloudflare
age
249048
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
x-cf-geodata
CZ
cf-ray
6a535eac6834413e-PRG
expires
Thu, 28 Oct 2021 14:09:39 GMT
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		21 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ed58d405cc30d0472d4deed639ea4696b1c7e5614cc8f91b474142d36b1e697

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/ 		103 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a

Request headers

Referer
Origin
https://thehackernews.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
application/font-woff
rocket-loader.min.js
thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://thehackernews.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
last-modified
Tue, 19 Oct 2021 12:26:29 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"616eb975-302c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4tKrD82EdoQKtc9snQc5IJlbEPYR4P%2BWfT9k0W3IGcdLAgTGWZeVlk8ND3HXKH0eJvumn05KeiCx9%2FtdroOSTt%2FaiTzGtSfUUl4uZm1T6qOKeq%2F%2BWpzsbJSY2PceLk1NHF3d"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
6a535eac3ac92788-PRG
expires
Sat, 30 Oct 2021 10:09:39 GMT
truncated
/ 		442 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
dvbs_src_internal99.js
cdn.doubleverify.com/ 		61 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvbs_src_internal99.js
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292494536%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
158edd2a7562d2b16eadda8fb990eb8d20e53837dd1abdfd2c890fcc0980ede0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Aug 2021 12:31:43 GMT
Server
Microsoft-IIS/10.0
ETag
"802192821a8dd71:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=946080000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
19248
bst2tv3.html
cdn3.doubleverify.com/ Frame 4925 		1 KB
981 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn3.doubleverify.com/bst2tv3.html
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

Content-Type
text/html
Last-Modified
Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges
bytes
ETag
"01818ecfc6cf1:0"
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
634
Cache-Control
max-age=55369
Date
Thu, 28 Oct 2021 10:09:39 GMT
Connection
keep-alive
verify.js
rtb0.doubleverify.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_632351720573&jsTagObjCallback=__tagObject_callback_632351720573&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=632351720573&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=95&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=1&brh=2&fwc=0&flt=9&fec=393&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&dvp_exetime=13.30&callbackName=__verify_callback_632351720573
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
e036a8240c1bd93c196996f0e75ab3244c0c04c3ef27967a77fdfaf3a47645fd

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Pragma
no-cache
X-DV-Response
0
Content-Encoding
gzip
Date
Thu, 28 Oct 2021 10:09:39 GMT
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0
Transfer-Encoding
chunked
Expires
10/27/2021 10:09:39 AM
dv-match6.js
cdn.doubleverify.com/ Frame 9416 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-match6.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Mar 2018 04:45:12 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"03c84bdf3b8d31:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=69922
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1935
jquery-2.2.2.min.js
code.jquery.com/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-2.2.2.min.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.10 Phoenix, United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
hwcdn.net
Software
nginx /
Resource Hash
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
last-modified
Thu, 17 Mar 2016 17:52:17 GMT
server
nginx
etag
W/"56eaeed1-14e98"
vary
Accept-Encoding
x-hw
1635415779.dop168.fr8.t,1635415779.cds231.fr8.hn,1635415779.cds235.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
29880
pb.37020.1631637442652.js
cdn.adpushup.com/prebid/ 		314 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.28.173 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6285dce6b9fb557bd0c15683c62f9be0f2e0b760086854b59c952791ba9e8ae

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 14 Sep 2021 16:38:00 GMT
server
cloudflare
age
1125653
etag
W/"6140cfe8-4e812"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6a535ead2979413e-PRG
expires
Fri, 28 Oct 2022 10:09:39 GMT
3b029287-6490-4fa5-8cec-65fb2ede2aa7
https://thehackernews.com/ 		4 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://thehackernews.com/3b029287-6490-4fa5-8cec-65fb2ede2aa7
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
41f36457d5ec5bd7d115c29bea53e0d1ff77de7418837ef39e897f3b7d497e8a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Length
3743
bsevent.gif
tps20516.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20516.doubleverify.com/bsevent.gif?impid=f289594b7c9b4978b46d95d721cdc5f5&dvp_or2=1&cbust=1635415779452469
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
bsevent.gif
tps20516.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20516.doubleverify.com/bsevent.gif?impid=f289594b7c9b4978b46d95d721cdc5f5&vfdur=121&cbust=1635415779452516
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
bsevent.gif
tps20516.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20516.doubleverify.com/bsevent.gif?impid=f289594b7c9b4978b46d95d721cdc5f5&pltfrm=Linux%20x86_64&dvp_ac_version=0511&dvp_acibv=&bsigr=2177&cbust=1635415779454244
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
dcmads.js
www.googletagservices.com/dcm/ 		9 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
sffe /
Resource Hash
ba8e38c6c85b0384447b0174b6e16c72c56acbd084c40db40abedf89036f080c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 28 Oct 2021 09:16:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3219
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4451
x-xss-protection
0
last-modified
Thu, 21 Oct 2021 15:55:37 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Thu, 28 Oct 2021 10:16:00 GMT
quantcast.js
cdn.adpushup.com/pbuseridscripts/ 		450 B
347 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.28.173 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 28 Jun 2021 04:15:23 GMT
server
cloudflare
age
533015
etag
W/"60d94cdb-1c2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
cf-ray
6a535eadaa3f413e-PRG
expires
Thu, 28 Oct 2021 14:09:39 GMT
sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 		70 B
320 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
ap-cookie-status
cookies ap_uid and ap_usid not set due to GDPR
access-control-allow-methods
GET, POST
content-type
image/png
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-robots-tag
noindex
content-length
70
expires
0
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
sffe /
Resource Hash
0561ca6090bdbd5c06176653ce086a4a3fa950c091504d96af2fe5983a88f2ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1026 / 192 of 1000 / last-modified: 1635410443"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27272
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 28 Oct 2021 10:09:39 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		133 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
975b62423e82390a1b54f47625f46f5b4451a8ea69945b2e85008a194bb55edd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id
nY_PcrO6M1v8rxrnAfvFh4iOgrD_tFp3
content-encoding
gzip
etag
3900a2c2d757386fb762bfd86288f882
age
611
x-cache
Hit from cloudfront
server
Server
x-amz-rid
1401G6BZVATCACZ0QYNK
date
Thu, 28 Oct 2021 09:59:35 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
7c8dXSB_1PhKsfiv9O2B7QJwT7soIdVffcDI7W5rNmHE3gb4na5xsQ==
AGSKWxWGtL7zuZ1y1IcNdDu97XV3A1nSFYlAxzUsMF11iBnZwCEpDsaZDLJvauA2_Cx3VImW-PkAxWSsA1Yld5y1tqA=
fundingchoicesmessages.google.com/f/ 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxWGtL7zuZ1y1IcNdDu97XV3A1nSFYlAxzUsMF11iBnZwCEpDsaZDLJvauA2_Cx3VImW-PkAxWSsA1Yld5y1tqA=
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/37020/adpushup.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
d512c6b6d2444590659871eb3c3068ba7d7120f0ceca7decda56dff88fed22cd
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-wlJMhglytLBvNZS81TzUNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-wlJMhglytLBvNZS81TzUNQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'report-sample' 'nonce-wlJMhglytLBvNZS81TzUNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-wlJMhglytLBvNZS81TzUNQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
quant.js
secure.quantserve.com/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.134 , United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
72d43d4ff0adb982ce42d41ef08e5f88c1854e4c8ea6455771ace93761a067c4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
etag
"f5gpBRZmwYYTVm3LkZ0l2w=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Thu, 04 Nov 2021 10:09:39 GMT
impl_v81.js
www.googletagservices.com/dcm/ 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v81.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
sffe /
Resource Hash
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 28 Oct 2021 02:10:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
28739
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17189
x-xss-protection
0
last-modified
Mon, 18 Oct 2021 20:08:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 28 Oct 2022 02:10:40 GMT
config
c.amazon-adsystem.com/cdn/prod/ 		0
304 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:38 GMT
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
access-control-allow-origin
https://thehackernews.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-id
EP1cNLkB5sQPgmgMag3gGheTYjm97RuR9Nl7klndAHhb4wjEhVxkcw==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 04:04:20 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin
age
21920
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Thu, 07 Oct 2021 01:02:33 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
c91ZTIbLZrDqT0mloV_AD7.LNsTlhW69
via
1.1 a267c4458d5587daaaf85f1d134a02d4.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA50-C1
content-type
application/javascript
x-amz-cf-id
kgZjXb34oJqI-4OT1XT7s9BLNT7_wbN3Dh43HJUcbE-Lg7JicFBYfQ==
B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22...
ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/ 		44 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v81.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f6.1e100.net
Software
cafe /
Resource Hash
029a3e2487440bc7805e7c4fec65fe7dc48cc851dce7df5e59c9927ef71bd056
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21725
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_2021102501.js
securepubads.g.doubleclick.net/gpt/ 		356 KB
120 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
sffe /
Resource Hash
dcd346804a786db16b40af2672924a5b8787623f71d648a017da7e236e1b19b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
122594
x-xss-protection
0
last-modified
Mon, 25 Oct 2021 08:35:02 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 28 Oct 2021 10:09:39 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		143 B
131 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=thehackernews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
3e2662d2cc5114073ccdc2611e908b3b51990027b5cbb651c69954274e2123db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
106
x-xss-protection
0
expires
Thu, 28 Oct 2021 10:09:39 GMT
rules-p-54Nt-1NAaEEe0.js
rules.quantcount.com/ 		2 B
345 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-34.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:05:10 GMT
via
1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
server
AmazonS3
age
268
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA50-C1
content-length
2
x-amz-cf-id
SuPsdAkJDBsTsavAAkNwqrRf3rqoyRcm7J8MMvPFP0V9BvC5qmiaYw==
pixel;r=834890397;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=834890397;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-1592271633-1635415779591;pbc=;ns=0;ce=1;qjs=1;qv=bb78f58d-20211025154311;cm=;gdpr=0;ref=;d=thehackernews.com;je=0;sr=1600x1200x24;dst=0;et=1635415779591;tzo=0;ogl=site_name.The%20Hacker%20News%2Clocale.en_US%2Ctype.article%2Ctitle.Hackers%20Using%20Squirrelwaffle%20Loader%20to%20Deploy%20Qakbot%20and%20Cobalt%20Strike%2Cimage.https%3A%2F%2Fthehackernews%252Ecom%2Fnew-images%2Fimg%2Fa%2FAVvXsEhwH6cDhMG-dk5SyFP2iiZbFAtcbLZRo%2Cdescription.A%20widespread%20malicious%20email%20campaign%20is%20deploying%20a%20new%20malware%20loader%252C%20giving%20%2Curl.https%3A%2F%2Fthehackernews%252Ecom%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to%252Ehtml
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.134 , United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
AGSKWxXTX19iWo-KISRlnAGJjbTFTw42BnqubExU4OKrEAnGa0UaU3TY5m7H9jWOsCNJ7Fr9SdbLcx78qIaxNIc_gWM=
fundingchoicesmessages.google.com/el/ 		0
27 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXTX19iWo-KISRlnAGJjbTFTw42BnqubExU4OKrEAnGa0UaU3TY5m7H9jWOsCNJ7Fr9SdbLcx78qIaxNIc_gWM=?pvid=058C7455-67D7-4FD2-8584-9FD2E813CA23&anonid=D7FCDCBB-64A1-420B-9F92-18FF90E50B4E
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.WzwhLVl0EYc.es5.O/d=1/rs=AJlcJMwcTQRLT_WS1-E0Vnfa37vb6ryKaQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-iJdc2bbRn35tCLAHdvUy9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-iJdc2bbRn35tCLAHdvUy9A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
access-control-max-age
86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorLoggingHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-iJdc2bbRn35tCLAHdvUy9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-iJdc2bbRn35tCLAHdvUy9A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXTX19iWo-KISRlnAGJjbTFTw42BnqubExU4OKrEAnGa0UaU3TY5m7H9jWOsCNJ7Fr9SdbLcx78qIaxNIc_gWM=
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXTX19iWo-KISRlnAGJjbTFTw42BnqubExU4OKrEAnGa0UaU3TY5m7H9jWOsCNJ7Fr9SdbLcx78qIaxNIc_gWM=?pvid=058C7455-67D7-4FD2-8584-9FD2E813CA23&anonid=D7FCDCBB-64A1-420B-9F92-18FF90E50B4E
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.WzwhLVl0EYc.es5.O/d=1/rs=AJlcJMwcTQRLT_WS1-E0Vnfa37vb6ryKaQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-og+7OR9+9Ah0fWzYT83tUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-og+7OR9+9Ah0fWzYT83tUA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-og+7OR9+9Ah0fWzYT83tUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-og+7OR9+9Ah0fWzYT83tUA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 		70 B
131 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2MzU0MTU3Nzk2MTUsInBhY2tldElkIjoiMDAwMDkwOUMtMWRhZDE4YTEtZDY5My00ODA0LWFiZWEtZmZkMjA0NTUxMWJmIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIxLzEwL2hhY2tlcnMtdXNpbmctc3F1aXJyZWx3YWZmbGUtbG9hZGVyLXRvLmh0bWw/JndlYl92aWV3PXRydWUiLCJtb2RlIjoyLCJlcnJvckNvZGUiOjcsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiUE9TVCIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOm51bGx9
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
access-control-allow-methods
GET, POST
content-type
image/png
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-robots-tag
noindex
content-length
70
expires
0
AGSKWxXMBCICRQMcqPGKdt8AbE1KKl3iC-KjdsWsUnDGlfT35acoxpXj_qUL9OQgr9O3dsHSirna5yI6EL2fzRm-Rqk=
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXMBCICRQMcqPGKdt8AbE1KKl3iC-KjdsWsUnDGlfT35acoxpXj_qUL9OQgr9O3dsHSirna5yI6EL2fzRm-Rqk=?pvid=058C7455-67D7-4FD2-8584-9FD2E813CA23&anonid=D7FCDCBB-64A1-420B-9F92-18FF90E50B4E
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.WzwhLVl0EYc.es5.O/d=1/rs=AJlcJMwcTQRLT_WS1-E0Vnfa37vb6ryKaQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NnB7PNfCZ/SkWJWgaewa8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-NnB7PNfCZ/SkWJWgaewa8w' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NnB7PNfCZ/SkWJWgaewa8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-NnB7PNfCZ/SkWJWgaewa8w' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXMBCICRQMcqPGKdt8AbE1KKl3iC-KjdsWsUnDGlfT35acoxpXj_qUL9OQgr9O3dsHSirna5yI6EL2fzRm-Rqk=
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXMBCICRQMcqPGKdt8AbE1KKl3iC-KjdsWsUnDGlfT35acoxpXj_qUL9OQgr9O3dsHSirna5yI6EL2fzRm-Rqk=?pvid=058C7455-67D7-4FD2-8584-9FD2E813CA23&anonid=D7FCDCBB-64A1-420B-9F92-18FF90E50B4E
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.WzwhLVl0EYc.es5.O/d=1/rs=AJlcJMwcTQRLT_WS1-E0Vnfa37vb6ryKaQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ggFHa3EbyV04MQdGFwXJfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-ggFHa3EbyV04MQdGFwXJfg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-ggFHa3EbyV04MQdGFwXJfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-ggFHa3EbyV04MQdGFwXJfg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxV6G7XBVWf_Ns1W9YQJ6tm-SJa5hr8f8LgMabhovvDR58727vU3W3nolMeXnozCn8daEFA2L0bpjSz0dJmfv5M=
fundingchoicesmessages.google.com/f/ 		43 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxV6G7XBVWf_Ns1W9YQJ6tm-SJa5hr8f8LgMabhovvDR58727vU3W3nolMeXnozCn8daEFA2L0bpjSz0dJmfv5M=?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjM1NDE1Nzc5LDY0NzAwMDAwMF0sIjA1OEM3NDU1LTY3RDctNEZEMi04NTg0LTlGRDJFODEzQ0EyMyIsIkQ3RkNEQ0JCLTY0QTEtNDIwQi05RjkyLTE4RkY5MEU1MEI0RSIsbnVsbCxbbnVsbCxbN10sbnVsbCxudWxsLG51bGwsbnVsbCxmYWxzZV0sImh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vMjAyMS8xMC9oYWNrZXJzLXVzaW5nLXNxdWlycmVsd2FmZmxlLWxvYWRlci10by5odG1sIl0
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.WzwhLVl0EYc.es5.O/d=1/rs=AJlcJMwcTQRLT_WS1-E0Vnfa37vb6ryKaQ/m=kernel_loader,loader_js_executable
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
86aa3f44ba04ba7838a7829dc81e0d24bd708b4379915a3bb00dc6d19f95b939
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-H2BfEOB5OTUiP67ldppTIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-H2BfEOB5OTUiP67ldppTIg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-H2BfEOB5OTUiP67ldppTIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-H2BfEOB5OTUiP67ldppTIg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ 		120 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
sffe /
Resource Hash
eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37344
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1635161763799786"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 28 Oct 2021 10:09:42 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:00:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
533
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
3128
x-xss-protection
0
server
cafe
etag
3658073882064373855
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:00:46 GMT
view
googleads4.g.doubleclick.net/pcs/ 		0
524 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvdkFhLcSRpr9kHGotK72Ceiko33tet3QV8ek2wMOpH66Rb8bMkZfoW_TKVP0Gkz7oEoykZZzKc9iK8i3dyYlmWxZfIIqUbdbBmxl0ZKFoUV7YBdz8Y1AILnLiPtzdyzAV6KQ&sig=Cg0ArKJSzGShVuKdIFb6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211026.82818&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
dvtp_src.js
cdn.doubleverify.com/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js?ctx=607671&cmp=24935727&sid=5936378&plc=292494536&advid=6141273&adsrv=1&btreg=486197547&btadsrv=doubleclick&crt=144332637&tagtype=display&dvtagver=6.1.src&auevent=__AP1_np_dv_n63l5ggxwjPA__
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
5dd139490465c0d5b42eb905451078a5ee84b5c220d6af5b143af49247a8ecf5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Tue, 19 Oct 2021 15:58:26 GMT
Server
Microsoft-IIS/10.0
ETag
"0fda9262c5d71:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3288
ca
choices.truste.com/ 		28 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_144332637_292494536&js=st0
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-28.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
142d1e7fa6fb4095e158a4a127ed33b8cfb99e7801b5721e649400ab9a8aed7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
server
nginx
x-amz-cf-pop
FRA50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 5721f7035c3fc934bd3f96dbb04ba1e5.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-id
a8N_iGwlyAhbBiGuovApkfNydaHg5mETIpLkTXixRd7LKHzKxch0gQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 14:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
158035
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Wed, 26 Oct 2022 14:15:44 GMT
I_ABU_AVT_3_STB_MOB_300x250_S_N_EN_NA_ABS_AVT_TenthEdition_NA_NA_01-08_01_MF.jpg
s0.2mdn.net/6141273/ 		131 KB
131 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/6141273/I_ABU_AVT_3_STB_MOB_300x250_S_N_EN_NA_ABS_AVT_TenthEdition_NA_NA_01-08_01_MF.jpg
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
c2842ab20cc17cb61e32799c8cff642f37a20a933b12f678628b4666c0311f78
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 07:28:02 GMT
x-content-type-options
nosniff
age
9697
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
133793
x-xss-protection
0
last-modified
Fri, 08 Jan 2021 23:43:35 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 29 Oct 2021 07:28:02 GMT
firstevent
att.demdex.net/
Redirect Chain
  • https://att.demdex.net/event?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292494536&d_campaign=24935727&d_site=5936378
  • https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292494536&d_campaign=24935727&d_site=5936378
42 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292494536&d_campaign=24935727&d_site=5936378
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Server
34.249.252.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-249-252-185.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v019-02e73bb60.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
Hf8SICgmR88=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v019-005611014.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
bm8EL2R9Qyk=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://att.demdex.net/firstevent?d_event=imp&d_src=127123&d_bu=1020274&d_creative=144332637&d_placement=292494536&d_campaign=24935727&d_site=5936378
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
/
d.agkn.com/pixel/2387/ 		43 B
671 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.agkn.com/pixel/2387/?ct=US&st=IL&city=0&dma=87&zp=&bw=3&che=3047689761&col=24935727,5936378,292494536,486197547,144332637
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.159.27 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-159-27.eu-central-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:38 GMT
Server
Apache-Coyote/1.1
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Sat, 01 Jan 2000 00:00:00 GMT
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eae76cb616003cb3e918dfd9f58d63cc8e832aa9d11a9eda64b1476af57e746a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/jpeg
feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 		70 B
131 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2MzU0MTU3Nzk2NjgsInBhY2tldElkIjoiMDAwMDkwOUMtMWRhZDE4YTEtZDY5My00ODA0LWFiZWEtZmZkMjA0NTUxMWJmIiwic2l0ZUlkIjozNzAyMCwic2l0ZURvbWFpbiI6Imh0dHBzOi8vdGhlaGFja2VybmV3cy5jb20vIiwidXJsIjoiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIxLzEwL2hhY2tlcnMtdXNpbmctc3F1aXJyZWx3YWZmbGUtbG9hZGVyLXRvLmh0bWw/JndlYl92aWV3PXRydWUiLCJtb2RlIjoxLCJlcnJvckNvZGUiOjEsInJlZmVycmVyIjoiIiwicGFnZUdyb3VwIjoiUE9TVCIsInBsYXRmb3JtIjoiREVTS1RPUCIsImlzR2VuaWVlIjpmYWxzZSwic2VjdGlvbnMiOlt7InNlY3Rpb25JZCI6IjhjMmQ3Zjk0LWE5YzUtNDNiMi04M2E0LWNkY2Y3MTFhZTA1ZSIsInNlY3Rpb25OYW1lIjoiQVBfVF9SX3Jlc3BvbnNpdmVYcmVzcG9uc2l2ZV84YzJkNyIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJBRFBfMzcwMjBfcmVzcG9uc2l2ZVhyZXNwb25zaXZlXzhjMmQ3Zjk0LWE5YzUtNDNiMi04M2E0LWNkY2Y3MTFhZTA1ZSIsInNlcnZpY2VzIjpbMiwzXSwiYWRVbml0VHlwZSI6MX1dfQ==
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.97.225.52 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
access-control-allow-methods
GET, POST
content-type
image/png
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-robots-tag
noindex
content-length
70
expires
0
truncated
/ 		37 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/gif
bst2tv3.html
cdn3.doubleverify.com/ Frame 5A00 		1 KB
981 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn3.doubleverify.com/bst2tv3.html
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

Content-Type
text/html
Last-Modified
Tue, 02 Sep 2014 17:01:36 GMT
Accept-Ranges
bytes
ETag
"01818ecfc6cf1:0"
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
634
Cache-Control
max-age=55369
Date
Thu, 28 Oct 2021 10:09:39 GMT
Connection
keep-alive
verify.js
rtb0.doubleverify.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_7118389937&jsTagObjCallback=__tagObject_callback_7118389937&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=7118389937&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=95&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=7&brh=2&fwc=0&fcl=100&flt=9&fec=511&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&dvp_exetime=13.30&callbackName=__verify_callback_7118389937
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
c74bacc93c301754ac89484ca30b1ed35fc6bc92375e1bc4c72bed2f24bbf427

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Pragma
no-cache
X-DV-Response
0
Content-Encoding
gzip
Date
Thu, 28 Oct 2021 10:09:38 GMT
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0
Transfer-Encoding
chunked
Expires
10/27/2021 10:09:39 AM
dv-match6.js
cdn.doubleverify.com/ Frame 7F55 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-match6.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Sun, 11 Mar 2018 04:45:12 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"03c84bdf3b8d31:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=69922
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1935
dv-measurements1800.js
cdn.doubleverify.com/ Frame 4A96 		495 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements1800.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.201.201 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-201-201.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 /
Resource Hash
3c2c5e8ce71da5f920b37260c35faad806880a17d60b6b93e35e1200763a6733

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:39 GMT
Content-Encoding
gzip
Last-Modified
Wed, 06 Oct 2021 09:46:20 GMT
Server
Microsoft-IIS/10.0
ETag
"0fef5397bad71:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
91601
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
492 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&pid=q4OjkdLSNtoKn&cb=0&ws=1600x1200&v=7.69.01&t=3000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22730x290%22%2C%22728x280%22%2C%22728x250%22%2C%22728x90%22%2C%22690x90%22%2C%22690x250%22%2C%22690x280%22%2C%22675x90%22%2C%22675x280%22%2C%22675x250%22%2C%22670x90%22%2C%22670x280%22%2C%22670x250%22%2C%22650x90%22%2C%22650x280%22%2C%22650x250%22%2C%22650x150%22%2C%22630x90%22%2C%22630x280%22%2C%22630x250%22%2C%22602x100%22%2C%22600x90%22%2C%22600x280%22%2C%22600x250%22%2C%22580x90%22%2C%22570x90%22%2C%22550x150%22%2C%22468x60%22%2C%22336x280%22%2C%22320x50%22%2C%22320x100%22%2C%22300x50%22%2C%22300x100%22%2C%22300x75%22%2C%22300x250%22%2C%22250x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F103512698%2F22055889203%22%7D%5D&schain=1.0%2C1!adpushup.com%2Caeb138a66c47c1d438a8907993e81712%2C1%2C%2C%2C&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA50-C1
x-amz-rid
6B6V2B6N87CAW73XV6TV
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://thehackernews.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
23
x-amz-cf-id
Li34mDmQbRNjNGdmYX043ka_RfSb9QT_qfviXdeFichpuAHkSef4ug==
bsevent.gif
tps20521.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20521.doubleverify.com/bsevent.gif?impid=206baeb981c34304bb8c70069e27b195&vfdur=121&cbust=1635415779783520
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
bsevent.gif
tps20521.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20521.doubleverify.com/bsevent.gif?impid=206baeb981c34304bb8c70069e27b195&pltfrm=Linux%20x86_64&dvp_ac_version=0511&dvp_acibv=&bsigr=2177&cbust=1635415779785717
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthehackernews.com%2F&domain=thehackernews.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://thehackernews.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
https://thehackernews.com
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1612
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
vary
Accept-Encoding
latest.json
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20211028
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.89.20 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
708e39746f2d1acc9ceca7ce0366d4aa367a6fc58b0e3728f6a8f899e9b6c932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
25707
x-jsd-version
1.0.1143
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by
cache-fra19140-FRA
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"699-u2O7Y1bifkVQZc9Gh4C5ghlnptQ"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
6a535eb00b7d411f-PRG
json
gum.criteo.com/sid/ 		342 B
622 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthehackernews.com%2F&domain=thehackernews.com&cw=1&lsw=1
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
63c573fc8a47c667d112030a6d5456a4b32331a1267517f4ba03e2af7af9a184
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
application/json

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 28 Oct 2021 10:09:39 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2741
expires
0
v2
i.connectad.io/api/ 		95 B
645 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.connectad.io/api/v2
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.8.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51c157af74156e2c7a11f2e11ce0b4386b74ac2e5795e4d85a07c86dec7ad02f

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
6a535eb028eaf9da-PRG
content-type
application/json
via
1.1 google
arj
adpushup-d.openx.net/w/1.0/ 		173 B
561 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=e5deefc3-ee62-4b35-8b71-3fae573434c2&nocache=1635415779814&gdpr=0&pubcid=2ba8a76c-9772-4922-94b5-e61cacdd9e8e&quantcastid=P0-1592271633-1635415779591&schain=1.0%2C1!adpushup.com%2Caeb138a66c47c1d438a8907993e81712%2C1%2C%2C%2C&aus=730x290%2C728x280%2C728x250%2C728x90%2C690x90%2C690x250%2C690x280%2C675x90%2C675x280%2C675x250%2C670x90%2C670x280%2C670x250%2C650x90%2C650x280%2C650x250%2C650x150%2C630x90%2C630x280%2C630x250%2C602x100%2C600x90%2C600x280%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C336x280%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200&divids=ADP_37020_responsivexresponsive_00000001-34188c75-a86f-42aa-ad1b-fbdc26d7f431&aucs=&auid=541218336
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
554ec7ad6599457424007718c646bcd7ec33170c452dceb0e4c12f108b9f17ed

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
server
OXGW/16.217.1
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://thehackernews.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
c
prebid.a-mo.net/a/ 		0
171 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

x-nbr
1
date
Thu, 28 Oct 2021 10:09:39 GMT
server
envoy
vary
origin, Accept-Encoding
access-control-allow-origin
https://thehackernews.com
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
prebid
ib.adnxs.com/ut/v3/ 		138 B
821 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.15 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
bf2104612e9075a70d16cd2125a8494fe01e9b4d560c42c81873a8393850509e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:39 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
7196aaa9-8611-4211-b035-529962bfb9ea
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ 		0
190 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=24468521491
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.par.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://thehackernews.com
date
Thu, 28 Oct 2021 10:09:39 GMT
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Finatra
timing-allow-origin
*
vary
Origin
v1
dmx.districtm.io/b/ 		0
285 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD, POST, OPTIONS
access-control-allow-origin
https://thehackernews.com
access-control-allow-credentials
true
cf-ray
6a535eb02feb2798-PRG
access-control-allow-headers
Content-Type, Origin
view
googleads4.g.doubleclick.net/pcs/ 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvdkFhLcSRpr9kHGotK72Ceiko33tet3QV8ek2wMOpH66Rb8bMkZfoW_TKVP0Gkz7oEoykZZzKc9iK8i3dyYlmWxZfIIqUbdbBmxl0ZKFoUV7YBdz8Y1AILnLiPtzdyzAV6KQ&sig=Cg0ArKJSzGShVuKdIFb6EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=168&vt=11&dtpt=167&dett=2&cstd=0&cisv=r20211026.82818&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 86FA 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Tue, 26 Oct 2021 14:15:44 GMT
expires
Wed, 26 Oct 2022 14:15:44 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
158035
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
bsevent.gif
tps20521.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20521.doubleverify.com/bsevent.gif?impid=206baeb981c34304bb8c70069e27b195&dvp_or1=1&cbust=1635415779825162
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
bsevent.gif
tps20521.doubleverify.com/ 		807 B
1 KB 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps20521.doubleverify.com/bsevent.gif?impid=206baeb981c34304bb8c70069e27b195&dvp_or2=1&cbust=1635415779826891
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal99.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
213.254.244.14 , Ireland, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software
/
Resource Hash
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/gif
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
860
Expires
10/27/2021 10:09:39 AM
AGSKWxV7kTSfCQMJbSMCru2PwlgzOffj536BNHDss6I0idyDsyufgPn5460DqHoIvhHEOUE0qRtJ6yX8vSNkNriSzvKKjc6LN0zTS0I3haqvhZs1d-RBLE2Up1BSXOKwQ0cusmGr3D5VrzUe_0QAwis50que4-omsHbytZ3OBpDbmuh7lyUf2zgMSMmBzSAR
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxV7kTSfCQMJbSMCru2PwlgzOffj536BNHDss6I0idyDsyufgPn5460DqHoIvhHEOUE0qRtJ6yX8vSNkNriSzvKKjc6LN0zTS0I3haqvhZs1d-RBLE2Up1BSXOKwQ0cusmGr3D5VrzUe_0QAwis50que4-omsHbytZ3OBpDbmuh7lyUf2zgMSMmBzSAR?dmid=970e7566fd7b1e49
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabTcfV2SignalJs.de.Uug7jBo1UwY.es5.O/d=1/rs=AJlcJMyvmZeLPTgm4xYEGys_YSkxbZeHGw/m=iabtcfv2signalscript
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-oahgVxDe3VTLzZw3VLt9rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-oahgVxDe3VTLzZw3VLt9rA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-oahgVxDe3VTLzZw3VLt9rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-oahgVxDe3VTLzZw3VLt9rA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxWLfFkc_ooPfSDRowQdSQnzs7a5MoLcfNWYDqzT0rvllZZC6Sycd_AKXUufvZmuZ9_krfZAsNo1ltOX7gZeeWgV7-id2sNCqA6GCLVtmA31Sj3q9Kyg5jzKg3XyXIp6FDUovjP8uQosqBACQqLK-7-OZtJLlXLspECAacdhu25X-G6nN6OfGf7GZtu2
fundingchoicesmessages.google.com/f/ 		62 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxWLfFkc_ooPfSDRowQdSQnzs7a5MoLcfNWYDqzT0rvllZZC6Sycd_AKXUufvZmuZ9_krfZAsNo1ltOX7gZeeWgV7-id2sNCqA6GCLVtmA31Sj3q9Kyg5jzKg3XyXIp6FDUovjP8uQosqBACQqLK-7-OZtJLlXLspECAacdhu25X-G6nN6OfGf7GZtu2?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjM1NDE1Nzc5LDgzMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsbnVsbCwwXSwiaHR0cHM6Ly90aGVoYWNrZXJuZXdzLmNvbS8yMDIxLzEwL2hhY2tlcnMtdXNpbmctc3F1aXJyZWx3YWZmbGUtbG9hZGVyLXRvLmh0bWwiXQ
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorIabTcfV2SignalJs.de.Uug7jBo1UwY.es5.O/d=1/rs=AJlcJMyvmZeLPTgm4xYEGys_YSkxbZeHGw/m=iabtcfv2signalscript
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
05820eb7216b9b600e69feb77e12e3f5ce28208ae34c7710154e2393dd9b8d6e
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-W1Unda4rXCCLiakNUSIXpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-W1Unda4rXCCLiakNUSIXpA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-W1Unda4rXCCLiakNUSIXpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-W1Unda4rXCCLiakNUSIXpA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
visit.js
tps.doubleverify.com/ Frame 4A96 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=124&ttfrms=25&brid=3&brver=95.0.4638.54&bridua=3&bds=1&tstype=1&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&srcurlD=0&aUrlD=0&ssl=https:&dfs=1125&ddur=7&uid=1635415779859668&jsCallback=dvCallback_1635415779859937&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F95.0.4638.54%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&dvp_isOnHead=1&jsver=1800&tgjsver=1800&lvvn=28&m1=13&refD=0&referrer=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&fwc=0&fcl=195&flt=9&fec=521&fcifrms=11&brh=2&sdf=2&dvp_epl=167&noc=4&ctx=607671&cmp=24935727&sid=5936378&plc=292494536&crt=144332637&btreg=486197547&btadsrv=doubleclick&adsrv=1&advid=6141273&tagtype=display&errorURL=https://tps.doubleverify.com/visit.jpg&auevent=__AP1_np_dv_n63l5ggxwjPA__&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=47616615765.07529&dvp_tukv=62817123438.16833&dvp_uuid=660187339202.3461&dvp_tuid=639314492570
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.109.138 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software
/
Resource Hash
4aa0285a9abba06bd23a1e72b13bd2f08061729d5c3c49912903b9e9ad983104

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:40 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
max-age=0
Transfer-Encoding
chunked
Expires
10/27/2021 10:09:40 AM
truncated
/ 		194 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
rewind-1-728.png
thehackernews.com/images/-DVj5Uq05ZlA/YVHQqZ1yK1I/AAAAAAAA4Z0/_vfyQiMOAJUPXrS2DwuAwOa6sxkUDm9ogCLcBGAsYHQ/s728-e100/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/images/-DVj5Uq05ZlA/YVHQqZ1yK1I/AAAAAAAA4Z0/_vfyQiMOAJUPXrS2DwuAwOa6sxkUDm9ogCLcBGAsYHQ/s728-e100/rewind-1-728.png
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dc108ca91c3c3d94f0288874585fc05b570883a8838087d28185e7c22e06cae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
64057
cf-polished
origFmt=png, origSize=6163
x-forwarded-for
2a00:1028:8386:ecda:3599:336e:776d:38c0
content-disposition
inline; filename="rewind-1-728.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
4994
x-xss-protection
0
expires
Fri, 04 Feb 2022 16:22:02 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"ve1a3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bgrHM7Use8LY%2FgzowwVWVWUBnWrGNsbKSRxBMd6oCBzHh4Q7wmVbAET%2B8yvvE3%2B1bBHLB6Z9A4%2BeJESJasO%2B5fVYO%2FiWEjdyoYHJWLAjCm3n96P3OL84JqTWtoQxHUq7ZCh5"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb09b2a2788-PRG
access-control-expose-headers
Content-Length
AVvXsEio3Ozp339svnJMYCSHeeGkiMJwgMWxTa_7Htua5-cOe-hOS54HgUVsdXrAZSMWzt4tTo16NKMkit-7jkStzpLVt1sFkvCT_mL5j-zBFWBJL-N6OFVsJsKlemBbVEs-juMZALT4BTdQkX-YsbUFRdAqynyuFeAKm4zC75lojuteZYizyoDtx3rdnknY=w72-...
thehackernews.com/new-images/img/a/ 		1006 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEio3Ozp339svnJMYCSHeeGkiMJwgMWxTa_7Htua5-cOe-hOS54HgUVsdXrAZSMWzt4tTo16NKMkit-7jkStzpLVt1sFkvCT_mL5j-zBFWBJL-N6OFVsJsKlemBbVEs-juMZALT4BTdQkX-YsbUFRdAqynyuFeAKm4zC75lojuteZYizyoDtx3rdnknY=w72-h72-p-k-no-nu
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4b108456a80a95d52c740c71471e978360f02d72f1fd74d6c37cc9486c1b556
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:39 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74883
cf-polished
qual=85, origFmt=jpeg, origSize=2276
x-forwarded-for
31.130.168.30
content-disposition
inline;filename="phishing-kit.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1006
x-xss-protection
0
expires
Thu, 28 Oct 2021 13:21:36 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v109d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1NfwULuRrEnp%2B2IpbPtSePRjJK284PzcAKsumwOgzBumb9ruJAfSafBdM6h5u%2FDuyjxtdC8QraJ9F%2FJUrMaYrdaUiyUGC3zZe0vHorvV3tTCS2%2BEMVtmHoe%2Fa4Z39nCKUamE"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb09b2d2788-PRG
access-control-expose-headers
Content-Length
Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
pagead2.googlesyndication.com/bg/ Frame 86FA 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
sffe /
Resource Hash
673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:43:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
185190
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13325
x-xss-protection
0
last-modified
Tue, 19 Oct 2021 13:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Wed, 26 Oct 2022 06:43:09 GMT
AVvXsEjUDQlxDrLDgiD3bcNNdUqU7X_W07bPr_4YpEmc6g7ZQMcOx8HbNiShh7AJ_doBaLAdoEaWzaeqFqFqqvMMUkiwb7dSw81TuTXsmGmN8vUKxW3ZgUwoHYK4VkwtvDQABcZGAnJI2M5fPZuwrbkVBeY_ja6AgsApcarpug_aQOsQnMpmR9cr-4qlRuHb=w72-...
thehackernews.com/new-images/img/a/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEjUDQlxDrLDgiD3bcNNdUqU7X_W07bPr_4YpEmc6g7ZQMcOx8HbNiShh7AJ_doBaLAdoEaWzaeqFqFqqvMMUkiwb7dSw81TuTXsmGmN8vUKxW3ZgUwoHYK4VkwtvDQABcZGAnJI2M5fPZuwrbkVBeY_ja6AgsApcarpug_aQOsQnMpmR9cr-4qlRuHb=w72-h72-p-k-no-nu
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
78fb5f9fe609023ae2d3ac22cc05905b3315c2a0477f43d2e12ebb8ccbbd8395
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74884
cf-polished
qual=85, origFmt=jpeg, origSize=2583
x-forwarded-for
31.130.168.30
content-disposition
inline;filename="browser.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1774
x-xss-protection
0
expires
Thu, 28 Oct 2021 13:21:36 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v10aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjNDN3bklJwAQRnEYTIJf5%2FYXfXcvMunhrkPJsAhDdpmZ2qjgMy%2BFFcFTPUv4KC3umqcgGADUHXpWtFAoDzsJQbghSgfQM%2Fk9jka2diXKBTinT6W%2FacVOmnHYdrspdUQhowI"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb19d472788-PRG
access-control-expose-headers
Content-Length
AVvXsEhXfc_CbXRKoGKSRkbsQCF1DqcjaLkW16bc2lPuAnZYtbBV_uZrTCVIgbf7u4jI0EjUDw-oi5MwPQrWLCXHLp1MWKOYe1hZhCLWpX12I7Se365gsiM_K95oDZQF5f2yvy-2Fn_-iDiLLHocFv5BplckrAX82qNjNQI3UHi912AtzfWHXRRlPwdxjOS_=w72-...
thehackernews.com/new-images/img/a/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEhXfc_CbXRKoGKSRkbsQCF1DqcjaLkW16bc2lPuAnZYtbBV_uZrTCVIgbf7u4jI0EjUDw-oi5MwPQrWLCXHLp1MWKOYe1hZhCLWpX12I7Se365gsiM_K95oDZQF5f2yvy-2Fn_-iDiLLHocFv5BplckrAX82qNjNQI3UHi912AtzfWHXRRlPwdxjOS_=w72-h72-p-k-no-nu
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ed89e2958b0d6659369958097b47e859fdf27a50c7a00bed10fe8913edf9a0a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74883
cf-polished
qual=85, origFmt=jpeg, origSize=1816
x-forwarded-for
31.130.168.30
content-disposition
inline;filename="hacker-for-hire.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1202
x-xss-protection
0
expires
Thu, 28 Oct 2021 13:21:37 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v108e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gEN84WJGatOtvZ4b2k6Zcls4TI%2FUbhBTeWQbD%2FlMuWfv%2Bz9gleu3e0LBNr4DWdC8Vt9BR7aEJL9dK97cQPxJ4D%2FkaB2Y6HP%2FHU0eY3CAUcOUDnxMQgVi%2FkwyvORUVfUYHaiz"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb19d482788-PRG
access-control-expose-headers
Content-Length
AVvXsEicBFf0Gq0Ri072ayx4XDt85mD1W-hGICFRWoLMGbwG5mDl3mr5_n6jtUFUci2CGawYVgWYajnHDIUs5UZ7EKTmX8FXu06SIwIK1Dd4L2c-7LK3zte8QUb9L7ugBIYyc9M0bXPumY4qMoHRoz6zCU6cRL52Lr-toZ4llamAnIKCBBSQUeZ7PtPPvw3i=w72-...
thehackernews.com/new-images/img/a/ 		1020 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEicBFf0Gq0Ri072ayx4XDt85mD1W-hGICFRWoLMGbwG5mDl3mr5_n6jtUFUci2CGawYVgWYajnHDIUs5UZ7EKTmX8FXu06SIwIK1Dd4L2c-7LK3zte8QUb9L7ugBIYyc9M0bXPumY4qMoHRoz6zCU6cRL52Lr-toZ4llamAnIKCBBSQUeZ7PtPPvw3i=w72-h72-p-k-no-nu
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
809bff8bfc9ad4e13b0c0b17ccff5e7b68dedf852d6e85e4f9d6d23ddc3cbf10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74883
cf-polished
qual=85, origFmt=jpeg, origSize=1970
x-forwarded-for
31.130.168.30
content-disposition
inline;filename="winrara.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1020
x-xss-protection
0
expires
Thu, 28 Oct 2021 13:21:37 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v1083"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=afUOzV5CVxzVqmFb25sjR53CpV36id6wPe%2FxcuwMAP5k0xd9lIpF3VOhzIMuwshc2rP78t%2FjkakczMWqPlpcwtEhPKJh0Ec7u0IRIPN2KMjQMpMPTZCgGxToa2slxuQnptgs"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb19d492788-PRG
access-control-expose-headers
Content-Length
AVvXsEj1j0f9vvCKom-ieKlTv2nSYEv0y3dnMGBH-v5L2wGYEwlWJvfa9c37VgQTGq4ZezBz-H3AWCGFojrC7DsYULXIc0b8TJ23KWYrWpMJPjepkasL2dAROM1VBy0AMMTK0Oswl1I-Bk15JczsQ9LqiYLHx1y-8l33xvvLTONiFiKO69Onsznq5stUiLXf=w72-...
thehackernews.com/new-images/img/a/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEj1j0f9vvCKom-ieKlTv2nSYEv0y3dnMGBH-v5L2wGYEwlWJvfa9c37VgQTGq4ZezBz-H3AWCGFojrC7DsYULXIc0b8TJ23KWYrWpMJPjepkasL2dAROM1VBy0AMMTK0Oswl1I-Bk15JczsQ9LqiYLHx1y-8l33xvvLTONiFiKO69Onsznq5stUiLXf=w72-h72-p-k-no-nu
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8736cb93aa3da288664eb8b6fafa3ec1a3395f53215ce8784ac0dd9ef826e78
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
32243
cf-polished
qual=85, origFmt=jpeg, origSize=2494
x-forwarded-for
193.87.33.14
content-disposition
inline;filename="FIREFOX.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1146
x-xss-protection
0
expires
Fri, 29 Oct 2021 01:12:17 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v10ac"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ybi9HbaxjO6PXo%2FWD3sWHzSN803PM8sIrFdPKS0DInX4w%2B%2BRbcmroam9fkPMxSnVp6zcJhHIYscTz8qjbZGgW4d6Zryp%2BJj3uIYpHw7svkmqCeAY1cHKae7Hj1FbSczepMuv"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb19d4b2788-PRG
access-control-expose-headers
Content-Length
gen_204
pagead2.googlesyndication.com/pagead/ Frame 86FA 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B28ny43Z6YdvAIoiAjuwP5oSEgAwAAAAAOAHgBAI&bg=!o6CloOTNAAbUs_yW1LM7ACkAdvg8WmHTv4TJGY8NqIFntjdLBH34gAA7r6Dp-GKDQ4BtVMRIHVrgCQIAAABjUgAAAAxoAQcKAEaU69mzLbgSlhw57wJ8jaOioY7-xw7hWleGZ6kC4sUB0WqGLgluXWKAlMccrhVmhzD9ibJeJ4Dt6_eIXTwyx6W6rqZB6yY1mQLFLE-u679__qo4Bvwa-DCekOQM5g1wUfoawNAh5lxgCbuJwTCkWIdP2JJzCOxhnUI7zD6dGiJeQTlqpDwThJZZhFFRR3Dc_vHdQj7Y-6nnts1ssLQSRAZzqH_Ret79e0HoNkwTJIyzr6hEiYmt7j4Mvtm5d6LeDdhG9Lq5jEL_rpORpT5Olo5A-mvik_35IuR6Cz74zQGg1K95QcMKBxZFH3KaBOK2cSTx9QxAO53Ao2R5iQE4zhmy7XvLqOyHcd9zyYgNXV02aoYCQ77ZAP5kgGj_pdNiZvbnqnfKI3AK-epW6WBihhM_Iuph3EONO0Xb5jbWEIXWnonZsyhAp3RylghS9hbxCI3KE8cNuY6QhvMOhAOJkcPlyE3jKRihofdszqWzqiyM2C-T6T5Wrvl2KMp3gAJgN7km8WqA_MEyGwYlWP0Debj4WXW10dRLXBnXiKTI3tMS93OEks7Q206Zz_gHjZMb4VQpdKakockfnNeI7A-HDtD8KGTRWTOTpF7V6ZZuhmsfYwKINj22rSbElTC9On9kH1P_jmlwr7wZ2zhCzGv3VUrqmI5BLOCZJnUvKw2xhGHOkKRU2e_H1mY5M-uG1-OYzEROPZ4gBOtK0Q2Qu9aasdWm3DsBeHghIB4QfnY0FG16nOJtMrKcFEufz8EgWQ1_tXL9jeab4m62azpImGRn8fqqlsAdLu_zWFyxNR53ZKEZTdLwyHLdFbw3bBKcSONHbOog0lRYsGH34cAg9MqR03stoCVVpoEJcjKn3MTpA6XWNJX__1fNl7Kpo-cz--oz4HjVwDinNhw-YQ-DEA-naV-sMvoUWwHzk4rXsNgyIhrgkJFU-Tqm_0ZrEBHsKZdSW2mRAl3vPOah_-mWn30UbbPDh_2VJXhKgDgXrtcT4lcSUkIpC3JN6KhSt73JwR4f1fTdobxgwxayGM-f7eoRsA
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AVvXsEg8HqgMoSh8I0NuToWiC3CPNqgwcHQK5QIWnKK5o7OdbI7vij_pU5PwCCvN__URehnsSFtKLHgIZZTUCu2c0R1mM-ssS1pxgSUvCtcsfBa7gZu7wrBA8OwM7Q-zywj_2IPG8YhYtm5zqsoLDSJ0WBfPqbBJmQSPZs6E_3shDT2980nuTMFFTz4nf_AF=w72-...
thehackernews.com/new-images/img/a/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEg8HqgMoSh8I0NuToWiC3CPNqgwcHQK5QIWnKK5o7OdbI7vij_pU5PwCCvN__URehnsSFtKLHgIZZTUCu2c0R1mM-ssS1pxgSUvCtcsfBa7gZu7wrBA8OwM7Q-zywj_2IPG8YhYtm5zqsoLDSJ0WBfPqbBJmQSPZs6E_3shDT2980nuTMFFTz4nf_AF=w72-h72-p-k-no-nu
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10480fe2f1ebf5d7e8a856b4fc4653ede148b91500c030d06224be02f659b8e3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
74880
cf-polished
qual=85, origFmt=jpeg, origSize=2683
x-forwarded-for
31.130.168.30
content-disposition
inline;filename="npm.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1398
x-xss-protection
0
expires
Thu, 28 Oct 2021 13:21:40 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v1096"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fjJyFMsr660eHX1%2FxH7ESIArHTMSPyN836sIlqDUROB7E6hkff%2Ffl0trbit6DRNZ1vR2R50B0KYn7Cx4kTo4r3V74kzsT2qtiqNEiP6B9DN7SRhkEzwlgnVkf024t%2BarS0Xw"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535eb26e842788-PRG
access-control-expose-headers
Content-Length
ad_sky.-contrib-ads._banner_ad__ad_top_
fundingchoicesmessages.google.com/f/AGSKWxXH8VWNG86zhA6zTkuNtbxk_qvT80ji6pEICcigslQWdqMbB6rvjo5EGjFBUb9lqNhA3sRxZ47QITnADvhtI5NDv4_IuBmrpFhH5tFHkAI2kRUPqzXbsLsHHkll8gxubvygBPKYYME_1kJ1MfjZk6_0xhb4r... 		54 B
107 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxXH8VWNG86zhA6zTkuNtbxk_qvT80ji6pEICcigslQWdqMbB6rvjo5EGjFBUb9lqNhA3sRxZ47QITnADvhtI5NDv4_IuBmrpFhH5tFHkAI2kRUPqzXbsLsHHkll8gxubvygBPKYYME_1kJ1MfjZk6_0xhb4rX4gO19_fBtdJQZbfOuN28YcVjGnhy179p1CxcgRkTAUUBG08q3tSkJRrvubKdfOFw6nxedWsA2CXHetyrU=/_/lrec_ad./ad_sky.-contrib-ads._banner_ad__ad_top_
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
ad6fed00cea44422fcd9613c8daf01b800fe0b5bcc56b8944a4bcb4ca532f7f5
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-2zJKRhIabnzxZBkemOcNmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-2zJKRhIabnzxZBkemOcNmw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'report-sample' 'nonce-2zJKRhIabnzxZBkemOcNmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-2zJKRhIabnzxZBkemOcNmw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
google_top_exp.js
pagead2.googlesyndication.com/pagead/js/ 		47 B
93 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 03:32:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
23841
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
67
x-xss-protection
0
server
cafe
etag
13036835877489095579
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 03:32:19 GMT
AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
fundingchoicesmessages.google.com/el/ 		0
27 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Srmdc91ukd5qYY8ZbBklMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-Srmdc91ukd5qYY8ZbBklMw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
access-control-max-age
86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorLoggingHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Srmdc91ukd5qYY8ZbBklMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-Srmdc91ukd5qYY8ZbBklMw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
fundingchoicesmessages.google.com/el/ 		0
27 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-rHIselqcNPuShnYsgPlAwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-rHIselqcNPuShnYsgPlAwg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
access-control-max-age
86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorLoggingHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-rHIselqcNPuShnYsgPlAwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-rHIselqcNPuShnYsgPlAwg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-3DQ8K5fMIGgi+atUVtuxzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-3DQ8K5fMIGgi+atUVtuxzA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-3DQ8K5fMIGgi+atUVtuxzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-3DQ8K5fMIGgi+atUVtuxzA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxVEVXgmXZp-AxPc6_NK4cJCuA2Rpujw15GcW-YxEYmqHzjIBgK3s4OaQev5MF5a7m6n5ls4_ignTrIVBq2dtXzQJYcklfSyDjsCgGuYj6DlyO045F9s5ntQajMGYGbx5mys3-cV06oq47TEvR0camNfSAqadIniIiIkAoear3ry4ijGAzL-g8bCz_DF
fundingchoicesmessages.google.com/f/ 		42 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxVEVXgmXZp-AxPc6_NK4cJCuA2Rpujw15GcW-YxEYmqHzjIBgK3s4OaQev5MF5a7m6n5ls4_ignTrIVBq2dtXzQJYcklfSyDjsCgGuYj6DlyO045F9s5ntQajMGYGbx5mys3-cV06oq47TEvR0camNfSAqadIniIiIkAoear3ry4ijGAzL-g8bCz_DF?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjM1NDE1NzgwLDU3OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsWzEsWzcsOSw2XSxudWxsLDIsbnVsbCxudWxsLDBdLCJodHRwczovL3RoZWhhY2tlcm5ld3MuY29tLzIwMjEvMTAvaGFja2Vycy11c2luZy1zcXVpcnJlbHdhZmZsZS1sb2FkZXItdG8uaHRtbCJd
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
035b8ba2606296313085d7caa2a298bf4a9d71328c5250bc6db27ac193bc6026
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-3kSbYftVJ7PgD6jfwLkOog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-3kSbYftVJ7PgD6jfwLkOog' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorGlobalRouterHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorGlobalRouterHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorGlobalRouterHttp/external"}]}
content-type
application/javascript; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-3kSbYftVJ7PgD6jfwLkOog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'nonce-3kSbYftVJ7PgD6jfwLkOog' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVd53JD0ObjXddN1kc_OcApTRyYNTIVMl4XhJ3Sx9QKt7uva1sXTDcnyOB68kZ8oZTXXBx_RSOtrM_a1lCSy7tguZGrLNXYB7hWxIxiVvyNFj-1lvGezUm6-mUAAjBnFRaMmXl2y6DBeYe1nsLwXClMhIW0xlQwck4E8S1ZuXNfOFGXjdeHOQ1xqXO_
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingDetectionClientJs.de.F0RC8LglObs.es5.O/d=1/rs=AJlcJMxHFH7uuo3ba9fOXMfKffcrGol86g/m=detection
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-qNGzvWEo7RkxmbKd8el8dw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-qNGzvWEo7RkxmbKd8el8dw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-qNGzvWEo7RkxmbKd8el8dw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-qNGzvWEo7RkxmbKd8el8dw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXzvMpZJHqB7yNdsgFV3HE-Hm-F9r4jJa4MI48mzvo1FYw8nXvPmyJ-eEpjxoJ2_qRRSPZDpKPyGsmJ5SnQYFKTNLer6HQ2Z5fRxI6fnYGXuWDpLMWlX2IHHTr-g_42Uj1L39Gvim_fwUMtDlWx6ahC--Cv8DZJkvShxWIq72uvTMd7XIK6P490iU5G
fundingchoicesmessages.google.com/el/ 		0
27 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXzvMpZJHqB7yNdsgFV3HE-Hm-F9r4jJa4MI48mzvo1FYw8nXvPmyJ-eEpjxoJ2_qRRSPZDpKPyGsmJ5SnQYFKTNLer6HQ2Z5fRxI6fnYGXuWDpLMWlX2IHHTr-g_42Uj1L39Gvim_fwUMtDlWx6ahC--Cv8DZJkvShxWIq72uvTMd7XIK6P490iU5G
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingCookieRefreshClientJs.de.AMCHkzpP0Us.es5.O/d=1/rs=AJlcJMzdO7cQfKx-_rGJt661s7rMC5rr5A/m=cookie_refresh
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-dgZYbYUH101ioH4gFPtWnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-dgZYbYUH101ioH4gFPtWnA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
access-control-max-age
86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin; report-to="ContributorLoggingHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"ContributorLoggingHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ContributorLoggingHttp/external"}]}
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-dgZYbYUH101ioH4gFPtWnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-dgZYbYUH101ioH4gFPtWnA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
AGSKWxXzvMpZJHqB7yNdsgFV3HE-Hm-F9r4jJa4MI48mzvo1FYw8nXvPmyJ-eEpjxoJ2_qRRSPZDpKPyGsmJ5SnQYFKTNLer6HQ2Z5fRxI6fnYGXuWDpLMWlX2IHHTr-g_42Uj1L39Gvim_fwUMtDlWx6ahC--Cv8DZJkvShxWIq72uvTMd7XIK6P490iU5G
fundingchoicesmessages.google.com/el/ 		0
26 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXzvMpZJHqB7yNdsgFV3HE-Hm-F9r4jJa4MI48mzvo1FYw8nXvPmyJ-eEpjxoJ2_qRRSPZDpKPyGsmJ5SnQYFKTNLer6HQ2Z5fRxI6fnYGXuWDpLMWlX2IHHTr-g_42Uj1L39Gvim_fwUMtDlWx6ahC--Cv8DZJkvShxWIq72uvTMd7XIK6P490iU5G
Requested by
Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingCookieRefreshClientJs.de.AMCHkzpP0Us.es5.O/d=1/rs=AJlcJMzdO7cQfKx-_rGJt661s7rMC5rr5A/m=cookie_refresh
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-unObQNLFzighIiSIkcsSpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-unObQNLFzighIiSIkcsSpQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
pragma
no-cache
server
ESF
cross-origin-opener-policy
same-origin
x-frame-options
SAMEORIGIN
access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-security-policy
script-src 'report-sample' 'nonce-unObQNLFzighIiSIkcsSpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'nonce-unObQNLFzighIiSIkcsSpQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
expires
Mon, 01 Jan 1990 00:00:00 GMT
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
493 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&pid=q4OjkdLSNtoKn&cb=1&ws=1600x1200&v=7.69.01&t=3000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22730x290%22%2C%22728x280%22%2C%22728x250%22%2C%22728x90%22%2C%22690x90%22%2C%22690x250%22%2C%22690x280%22%2C%22675x90%22%2C%22675x280%22%2C%22675x250%22%2C%22670x90%22%2C%22670x280%22%2C%22670x250%22%2C%22650x90%22%2C%22650x280%22%2C%22650x250%22%2C%22650x150%22%2C%22630x90%22%2C%22630x280%22%2C%22630x250%22%2C%22602x100%22%2C%22600x90%22%2C%22600x280%22%2C%22600x250%22%2C%22580x90%22%2C%22570x90%22%2C%22550x150%22%2C%22468x60%22%2C%22336x280%22%2C%22320x50%22%2C%22320x100%22%2C%22300x50%22%2C%22300x100%22%2C%22300x75%22%2C%22300x250%22%2C%22250x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F103512698%2F22055889203%22%7D%5D&schain=1.0%2C1!adpushup.com%2Caeb138a66c47c1d438a8907993e81712%2C1%2C%2C%2C&pubid=2e7e1587-d92f-46dd-8721-80b53eccb87e&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-95-188.fra50.r.cloudfront.net
Software
Server /
Resource Hash
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
via
1.1 1f49a084ca923f375f74b42fa36ef429.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA50-C1
x-amz-rid
3T0146DFYTC715GMB1XZ
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://thehackernews.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
23
x-amz-cf-id
SeQ9OAd1isVtRPVa9V4rehfIeqr-9jjywr7EzqrpGnGx0ztfXTXEAg==
prebid
ib.adnxs.com/ut/v3/ 		139 B
822 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.15 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
fbef7c4e520944d043b57ff620e9d57e5df9dd08cef0d4d007d8bc252e545e63
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:40 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
b1e366eb-e9f5-4033-85db-83ee8f47116d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
139
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
auction
prebid-server.rubiconproject.com/openrtb2/ 		185 B
391 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.255.59 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-255-59.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
acee506b313212f502744cd3cf0860b72bc7d6dc3a9c44bf9f2e028c53e8de39

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
content-type
application/json
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
175
expires
0
fastlane.json
fastlane.rubiconproject.com/a/api/ 		284 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20616&site_id=332834&zone_id=1745264&size_id=15&alt_size_ids=2%2C1%2C13%2C14%2C16%2C19%2C43%2C44%2C117&gdpr=0&rp_schain=1.0,1!adpushup.com,aeb138a66c47c1d438a8907993e81712,1,,,&eid_pubcid.org=2ba8a76c-9772-4922-94b5-e61cacdd9e8e%5E1&eid_quantcast.com=P0-1592271633-1635415779591%5E1&rf=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&tk_flint=pbjs_lite_v4.43.0&x_source.tid=22a5d626-54aa-4fe7-b1dc-d5f6062fff4d&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9692058215181898
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.16.0 /
Resource Hash
22b931d340315ac4e339e36dca19ab10f5929b1cd8e585402eb9b7a59d53d0ad

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:40 GMT
Server
nginx/1.16.0
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
284
Expires
Wed, 17 Sep 1975 21:32:10 GMT
c
prebid.a-mo.net/a/ 		0
44 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

x-nbr
1
date
Thu, 28 Oct 2021 10:09:40 GMT
server
envoy
vary
origin, Accept-Encoding
access-control-allow-origin
https://thehackernews.com
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
v2
i.connectad.io/api/ 		96 B
500 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.connectad.io/api/v2
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.8.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d9d6600ad7b0a19123c1ebcc3481701e312b7a67a8fda8aebe8465c6805a005

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
6a535eb5bbb52790-PRG
content-type
application/json
via
1.1 google
v1
dmx.districtm.io/b/ 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dmx.districtm.io/b/v1
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD, POST, OPTIONS
access-control-allow-origin
https://thehackernews.com
access-control-allow-credentials
true
cf-ray
6a535eb589482798-PRG
access-control-allow-headers
Content-Type, Origin
translator
hbopenbid.pubmatic.com/ 		4 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
6ee4516e86690bed70ec3855404135a3680379dfefe752f8e019f57bf4b66790

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://thehackernews.com
date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
x-openrtb-version
2.3
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
application/json
adreq
ads.servenobid.com/ 		512 B
874 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.servenobid.com/adreq?cb=8630
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef334f7eae7dcc23de3513406fd84f43477435fb8c1be9e76f82a989ab1b594e

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://thehackernews.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
cdb
bidder.criteo.com/ 		0
190 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=24226749629
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
bidder.par.vip.prod.criteo.com
Software
Finatra /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://thehackernews.com
date
Thu, 28 Oct 2021 10:09:40 GMT
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Finatra
timing-allow-origin
*
vary
Origin
arj
adpushup-d.openx.net/w/1.0/ 		173 B
361 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=90d5f9e4-0493-4987-9762-e74e4550d1e9&nocache=1635415780728&gdpr=0&pubcid=2ba8a76c-9772-4922-94b5-e61cacdd9e8e&quantcastid=P0-1592271633-1635415779591&schain=1.0%2C1!adpushup.com%2Caeb138a66c47c1d438a8907993e81712%2C1%2C%2C%2C&aus=730x290%2C728x280%2C728x250%2C728x90%2C690x90%2C690x250%2C690x280%2C675x90%2C675x280%2C675x250%2C670x90%2C670x280%2C670x250%2C650x90%2C650x280%2C650x250%2C650x150%2C630x90%2C630x280%2C630x250%2C602x100%2C600x90%2C600x280%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C336x280%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200&divids=ADP_37020_responsivexresponsive_00000001-34188c75-a86f-42aa-ad1b-fbdc26d7f431&aucs=&auid=541218336
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
d32a8355aad932714ccb5ed1fda47adc1516c022059886391bba35224598f674

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:40 GMT
content-encoding
gzip
server
OXGW/16.217.1
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://thehackernews.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
165
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
bid
ap.lijit.com/rtb/ 		24 B
522 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.14.3 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
bb5afa94dd58b02ca4d882890b5c7cf0e4fd77a41106e09c4f7bddc6e41b8d45

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

Date
Thu, 28 Oct 2021 10:09:41 GMT
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://thehackernews.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap2sea1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
24
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=thehackernews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		15 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3077095890091583&correlator=3950696801962140&output=ldjh&impl=fifs&eid=31063136%2C31063213%2C31063274%2C31063282&vrg=2021102501&ptt=17&gdpr=0&sc=1&sfv=1-0-38&ecs=20211028&iu_parts=103512698%3A22548988896%2C22055889203&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C730x290%7C728x280%7C728x250%7C728x90%7C690x90%7C690x250%7C690x280%7C675x90%7C675x280%7C675x250%7C670x90%7C670x280%7C670x250%7C650x90%7C650x280%7C650x250%7C650x150%7C630x90%7C630x280%7C630x250%7C602x100%7C600x90%7C600x280%7C600x250%7C580x90%7C570x90%7C550x150%7C468x60%7C336x280%7C320x50%7C320x100%7C300x50%7C300x100%7C300x75%7C300x250%7C250x250%7C200x200&fluid=height&prev_scp=amznbid%3D2%26amznp%3D2%26adpushup_ran%3D1%26hb_ap_siteid%3D37020%26hb_ap_ran%3D1%26fluid%3D1%26refreshcount%3D0%26refreshrate%3D30%26hb_ap_format%3Dbanner%26hb_ap_pb%3D0.03%26hb_ap_adid%3D54ba24a50e5d4d8%26hb_ap_bidder%3Dpubmatic&eri=1&cust_params=da%3Dadx%26outbrain%3Dtrue&cookie_enabled=1&bc=31&abxe=1&lmt=1635411984&dt=1635415781233&dlt=1635415779181&idt=419&frm=20&biw=1600&bih=1200&oid=2&adxs=269&adys=2280&adks=1711461567&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&vis=1&dmc=8&scr_x=0&scr_y=0&psz=730x0&msz=730x0&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
d143e1ccd80ef6315a4940f247148de62e47e48f44d422490498441bc1d36e50
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:41 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8767
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D641 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.129 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f1.1e100.net
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Thu, 28 Oct 2021 10:09:41 GMT
expires
Fri, 28 Oct 2022 10:09:41 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
container.html
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D978 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.129 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f1.1e100.net
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin
*
content-length
3108
date
Thu, 28 Oct 2021 10:09:41 GMT
expires
Fri, 28 Oct 2022 10:09:41 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
pixel
googleads.g.doubleclick.net/xbbe/ Frame B114 		645 B
742 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYx4a0twEwAQ&v=APEucNVI3lFTOdHle_17zFUradHCmbszucw88gR2cuY9NI-eR1ueOUx-sf2bSdAyfdtRBDPD8uFXum1fQQlpYgT89ELBegJOW8AE5HaiLs1MslsHrYb_4oA
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Thu, 28 Oct 2021 10:09:41 GMT
server
cafe
cache-control
private
content-length
285
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ad
googleads.g.doubleclick.net/dbm/ Frame D978 		71 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bs9WHafgiQVCG4_nUUaE5IQbv4sF31aRkce1vcOaybvC7DRJJ0tBwya0nmpAww58v2iRTAxwfnAbLdWpcNCjFsekjts3AAzNrGMui1N3Sc5eN8CYJ5iLenTLhy53g2zt2Zh-WpfOADSvanFa285dWTOa44vg&dbm_d=AKAmf-BwM6Ew_Z6UIKeZjVYlXDyWRB_rD4IFSL0T7TxFo4hHWaSvjABeMvBE_rI4D80p2GPFrxTDKMF6TwY_NYQZhGpRU78T-zRL7m65TGFceUEA9UFz2AhJ1XPPIVOkG1ZYrb0CclCsJkgQE0hqKbTlZBlcgOdmzmdWcH90q9drjgctx4J_CT7InuP01y07D8aVkphZZh0t2F1dwjPl6BwV9sdzZ1luewukJRKqKpN3iUh4kqgq3v0ZWXXrmFGJWV34ompVSmpUc9TGas0JjzbrbeEIllLNz5p83dttn4bF6XNaOiIKB7iObvRVSyd772o4gVSi6WMozQuJkxL7KeJJN0SoCllIPTY-IKhqcjTwH5LdSZ8zbZvJSPdUqNE84SS0PnaP1jLhTsO_IfyTBqBYXfb2LUDt-F-MN6nzmCSt86WCuZDHsqcPYIoKJTQGMyRdH_H3Th_kFxylCljYRwoDtYuqQcirbP3hojDTefvqHBXggWnFyzTJeXgPO1NeXkigarm3qPdkuIelgx8omeZtkR4Jo4nU8mO733E7GHi3-EIGN772f1Nha3AVf8KhWYnQBa4H7DnYQu9TpEkbGk60Ug-PvZZ0YnbdcaF4weZ0fZaDvJbAls1AhhmDZ1JKb-XNX3ZEz2MdNcOlxQHkyz9ks-uEfn1LMgXDAuKEinUCzC1cusY9lgU9U_4e2ZGPqqxXSXagBW1IGFmhvuOMYrEvE1WBVDO8wiZdAQVtBCB5pqTu7k3oX7M83k9oFQ3VTWuPFCeFWht0zokH58bJU4bx0ZoVe_zkpRkJv5CAeJmqaezYbgpBzcD5bHqjcTmvP4iH95TaNV4XhR4HMGHhIRfIcAlKfuiCMRxUifI5NfSj7r1la3lhWQ2fGbJ749baGht4-LGhxDAPC0mpAd4ctD2erXysQa1HixKI1E5EtbucRnMDMMVQhJ6g6HsA0y_WApDEksPwAlr26myuShnLhzgsE_b8k2j_mUNvbvyTfSY-6fc04vMtbdzIp9YRPINAi4w1zL_QzUXxX6f-NFt1IQ2VmPEhteCChYSnuXl8PsA1PbxhPv1UtK22OzaPCQnsZmv_Sat5MUlxHxmA6ioDtJiu41v6NbNf0vWioK0KyQtEYHQNnmJQ6BuW52nj-oCsB1tribtalntt3Bdc7UTRSkE3TxcRzJtyEA-a4Fgh3tWYqFjo4_kw7qP580D18tvXtFU9THPWK3dFU5cifC2gDXm3oOQnMaNlsrJ1wpRimAP_vnUWM98hoXgPB_wYb29m4ski7QQIC_5hjUpTyKtYtrpgT_-kZXCSokwdyVQIRkoQPNy5xqVDHo-18OR7E828W0EQstu1rGujOdGS8tTtYc1P3KYrdH06DPfgG6RCLgS_d_yxnb2bBAlYnd8YOzmlpLpWjpUz1EPSZhOvvsJdF89mAqt1YQ_qhGNXKtxdwyrqWjwiKt4uPbTp5MYeio31048K7VQouZ_gdxqedmhUZpL24cjgq7O518PEjJD7zOPgB5YjnfnuNJA3C6VmaMinDt6BTuoVWJw4bFfLUuIEm-49gFCUZgFV7W2I7bhDSi-VYewN8NPsE0lCFW8tRxhgiHdIu2LbfzrI5g8J0MWp6WQUZ7I0rZE0pLogC94s04GYc8VcPNPts-fnJMBwNwkS97hJOZHS5xzR97DkuD1PtLUl_ElvkvGpi9rds45eyEtXCQPusnD9U7wMa8JAb8xyAJvpu5JVeFugvT-JuN3DNCcbcActYuYqNm1Vn7lDOWe--sK5ARj_nTSz-ceuFYO-IBEVplRtTZxf72e_ZmfG7CKXvDjcfGEYZ5EwV7c8AHBEEXhwulH_3L2Gr7qRZa8p8tQoze53iiu88BwnDHGiWamRP_hJFLN5ufPednUwN8HEA4e8hsGWKWtah5J3DrJNLL4yWHpvHy88uYoCmqEGYREL1ydQCGZ-P4ZnAUkyjCw4Pwin1m4NkIZT8gW4auzIIb4-cGBJ21a50bE8xJXDGoRHwQRhjZykQOxylayIMp1UVqNZa45wcV0Q8pUJ6IWVoLIxwNUv_qNeBiUBCsUWzj_xrzDSnGRb-KsOqWQSV90ubTTalBYMiUnSSAQ-W8JdPYMxitzPxuK1R5bNHCUvBMH17WwbOpz1fmeHpW6bvRi5u-x265otsuadL0lCYRhoul4M0EmDS3xnfvJKnmG_5E3Gx2zYlqKcoQSUiNeL0ofHbmi9153__wAV6PloxqfCDcfJEj4NE6kZrIrdnwoHrOuzB-rrZ_U7iP6aNfWJLGGF30ZBdb4X5SskiUlyN4vaH3NPD4mlnppIF-bUZdKGA1gBolU2luDHpPP80IB0b6Pe5h98Yx6uEHGu7H6t5lwTgYMBkDDhOmhAXCrPSqMOxA-0uj4WzLrRxTTo86OxEG6Ln0JZxA-UPVz-rb9y1Oq-CNXvcIw6L_Iu8vMA_1hg_iI7Zbfrdf_li5wljM9VghKE71gfNKTWc3ewI0J2BVPDyp-aC5P1vIZIvF-DrixUingjkkUS-D1CAnBOqjuP5-lr44Ycwr14Anb_tLMyTxbWDYoexZYyxI85cXZ72Whr7caX-40pQWgz7rOfASfTqnde8DXyliCuaXsBdc1QJbc7XJ2OmKzJdu7UjHCxtVBatxp0QpRfrOtRUx2nf-R3XtYkc61JV4Dmd9UrTYzAHw6bzySViEqK7SyYE_pUMBzTKawnaPXj_m70ScwZRCgwLOpW1x0BT9mq5Ts9pgfXEYwvj7TPyPSV2za9YLM6u0cgRTc4dHvr2UmgztfYQFcPC1jfHQsVjOUZZQTCQrQdIKAcObllf37k5D7_B7GU-XjC2LD03qgU9Z92SjewIa4Uwvl6voQSKKLDL6CSnLzQDeFEI-bvGM1qMBZga-_8sdOPpAzgYofd3d2B51ws-n0QB5jOOKiPtr6aCFgD87AHXoHslailMr_rE-bAq8A0K1NIxdeVzOqJKrdj24pUpKnAe2A__5wAhT_5MUVuuhd7nkvybACW9-DgsY2HbmP0Yp56Vxh43c7KAkSyrvta1CrXWPkF4_bdGqbkg1cCbzEzg2EWoxGNfodgtTc3&cid=CAASEuRofSfzUbZTHO_ofQjCaNTx-w&rfl=1%2Chttps%253A%252F%252Fthehackernews.com%252F%240
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
e992ede9861bc4711474f8aa1469226a448566fe3c282265f035d74d1ec3b27a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28953
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame D978 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D3OEzr430Ixq-frV0JS27wCMzgiWdr64DvB33o2cCDQmWq2RxekWiVTPBe7uhQYGItMrvZ-06Ii4QqnY2tSCoxZKwgIXu1oJoITDNiQJesPyPxxIg
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame D978 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
347
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:54 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame D978 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
343
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
6286
x-xss-protection
0
server
cafe
etag
17196531676875957370
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:58 GMT
l
www.google.com/ads/measurement/ Frame D978 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRpbChSNQb0vFBIhcHT7z-Ujf0uVLtYKtJsFmmVts4hufqWmgqyb8dAPMSNgPkvmFj3gh9tBQig6fS7SeNWGfsaGFDPmw
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D978 		120 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
sffe /
Resource Hash
eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37344
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1635161763799786"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 28 Oct 2021 10:09:42 GMT
rum
dsum-sec.casalemedia.com/ Frame B114
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0&C=1
43 B
1014 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0&C=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYx4a0twEwAQ&v=APEucNVI3lFTOdHle_17zFUradHCmbszucw88gR2cuY9NI-eR1ueOUx-sf2bSdAyfdtRBDPD8uFXum1fQQlpYgT89ELBegJOW8AE5HaiLs1MslsHrYb_4oA
Protocol
HTTP/1.1
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:41 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 28 Oct 2021 10:09:41 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
319
Expires
Thu, 28 Oct 2021 10:09:41 GMT
rum
dsum-sec.casalemedia.com/ Frame B114
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgdpr%3D0%26google_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=casale_media2_dsp_secure&google_cm&google_hm=YXp25e20L6u7mOkonYPcBAAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0
43 B
894 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYx4a0twEwAQ&v=APEucNVI3lFTOdHle_17zFUradHCmbszucw88gR2cuY9NI-eR1ueOUx-sf2bSdAyfdtRBDPD8uFXum1fQQlpYgT89ELBegJOW8AE5HaiLs1MslsHrYb_4oA
Protocol
HTTP/1.1
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:41 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 28 Oct 2021 10:09:41 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENP484pgo6du_pGOE6Gv068&google_cver=1&gdpr=0
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
324
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame B114
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEG1QMAioaklCXVB3Rs_DTq8&google_cver=1
43 B
1006 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEG1QMAioaklCXVB3Rs_DTq8&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYx4a0twEwAQ&v=APEucNVI3lFTOdHle_17zFUradHCmbszucw88gR2cuY9NI-eR1ueOUx-sf2bSdAyfdtRBDPD8uFXum1fQQlpYgT89ELBegJOW8AE5HaiLs1MslsHrYb_4oA
Protocol
HTTP/1.1
Server
185.33.221.15 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:41 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
9e7ccc47-d550-4423-8205-4a3acf0779db
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEG1QMAioaklCXVB3Rs_DTq8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame B114
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjEwMTk1NzkxNTY4NTM1Nzc1OA%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjEwMTk1NzkxNTY4NTM1Nzc1OA%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCz8jkYx4a0twEwAQ&v=APEucNVI3lFTOdHle_17zFUradHCmbszucw88gR2cuY9NI-eR1ueOUx-sf2bSdAyfdtRBDPD8uFXum1fQQlpYgT89ELBegJOW8AE5HaiLs1MslsHrYb_4oA
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:41 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
e6603a23-dea2-4312-a2a2-fb36b03c6ee9
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjEwMTk1NzkxNTY4NTM1Nzc1OA%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
express_html_inpage_rendering_lib_200_275.js
s0.2mdn.net/879366/ Frame D978 		106 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
Origin
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 14:26:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
71020
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
37892
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:44:52 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 28 Oct 2021 14:26:01 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/ Frame D978 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bs9WHafgiQVCG4_nUUaE5IQbv4sF31aRkce1vcOaybvC7DRJJ0tBwya0nmpAww58v2iRTAxwfnAbLdWpcNCjFsekjts3AAzNrGMui1N3Sc5eN8CYJ5iLenTLhy53g2zt2Zh-WpfOADSvanFa285dWTOa44vg&dbm_d=AKAmf-BwM6Ew_Z6UIKeZjVYlXDyWRB_rD4IFSL0T7TxFo4hHWaSvjABeMvBE_rI4D80p2GPFrxTDKMF6TwY_NYQZhGpRU78T-zRL7m65TGFceUEA9UFz2AhJ1XPPIVOkG1ZYrb0CclCsJkgQE0hqKbTlZBlcgOdmzmdWcH90q9drjgctx4J_CT7InuP01y07D8aVkphZZh0t2F1dwjPl6BwV9sdzZ1luewukJRKqKpN3iUh4kqgq3v0ZWXXrmFGJWV34ompVSmpUc9TGas0JjzbrbeEIllLNz5p83dttn4bF6XNaOiIKB7iObvRVSyd772o4gVSi6WMozQuJkxL7KeJJN0SoCllIPTY-IKhqcjTwH5LdSZ8zbZvJSPdUqNE84SS0PnaP1jLhTsO_IfyTBqBYXfb2LUDt-F-MN6nzmCSt86WCuZDHsqcPYIoKJTQGMyRdH_H3Th_kFxylCljYRwoDtYuqQcirbP3hojDTefvqHBXggWnFyzTJeXgPO1NeXkigarm3qPdkuIelgx8omeZtkR4Jo4nU8mO733E7GHi3-EIGN772f1Nha3AVf8KhWYnQBa4H7DnYQu9TpEkbGk60Ug-PvZZ0YnbdcaF4weZ0fZaDvJbAls1AhhmDZ1JKb-XNX3ZEz2MdNcOlxQHkyz9ks-uEfn1LMgXDAuKEinUCzC1cusY9lgU9U_4e2ZGPqqxXSXagBW1IGFmhvuOMYrEvE1WBVDO8wiZdAQVtBCB5pqTu7k3oX7M83k9oFQ3VTWuPFCeFWht0zokH58bJU4bx0ZoVe_zkpRkJv5CAeJmqaezYbgpBzcD5bHqjcTmvP4iH95TaNV4XhR4HMGHhIRfIcAlKfuiCMRxUifI5NfSj7r1la3lhWQ2fGbJ749baGht4-LGhxDAPC0mpAd4ctD2erXysQa1HixKI1E5EtbucRnMDMMVQhJ6g6HsA0y_WApDEksPwAlr26myuShnLhzgsE_b8k2j_mUNvbvyTfSY-6fc04vMtbdzIp9YRPINAi4w1zL_QzUXxX6f-NFt1IQ2VmPEhteCChYSnuXl8PsA1PbxhPv1UtK22OzaPCQnsZmv_Sat5MUlxHxmA6ioDtJiu41v6NbNf0vWioK0KyQtEYHQNnmJQ6BuW52nj-oCsB1tribtalntt3Bdc7UTRSkE3TxcRzJtyEA-a4Fgh3tWYqFjo4_kw7qP580D18tvXtFU9THPWK3dFU5cifC2gDXm3oOQnMaNlsrJ1wpRimAP_vnUWM98hoXgPB_wYb29m4ski7QQIC_5hjUpTyKtYtrpgT_-kZXCSokwdyVQIRkoQPNy5xqVDHo-18OR7E828W0EQstu1rGujOdGS8tTtYc1P3KYrdH06DPfgG6RCLgS_d_yxnb2bBAlYnd8YOzmlpLpWjpUz1EPSZhOvvsJdF89mAqt1YQ_qhGNXKtxdwyrqWjwiKt4uPbTp5MYeio31048K7VQouZ_gdxqedmhUZpL24cjgq7O518PEjJD7zOPgB5YjnfnuNJA3C6VmaMinDt6BTuoVWJw4bFfLUuIEm-49gFCUZgFV7W2I7bhDSi-VYewN8NPsE0lCFW8tRxhgiHdIu2LbfzrI5g8J0MWp6WQUZ7I0rZE0pLogC94s04GYc8VcPNPts-fnJMBwNwkS97hJOZHS5xzR97DkuD1PtLUl_ElvkvGpi9rds45eyEtXCQPusnD9U7wMa8JAb8xyAJvpu5JVeFugvT-JuN3DNCcbcActYuYqNm1Vn7lDOWe--sK5ARj_nTSz-ceuFYO-IBEVplRtTZxf72e_ZmfG7CKXvDjcfGEYZ5EwV7c8AHBEEXhwulH_3L2Gr7qRZa8p8tQoze53iiu88BwnDHGiWamRP_hJFLN5ufPednUwN8HEA4e8hsGWKWtah5J3DrJNLL4yWHpvHy88uYoCmqEGYREL1ydQCGZ-P4ZnAUkyjCw4Pwin1m4NkIZT8gW4auzIIb4-cGBJ21a50bE8xJXDGoRHwQRhjZykQOxylayIMp1UVqNZa45wcV0Q8pUJ6IWVoLIxwNUv_qNeBiUBCsUWzj_xrzDSnGRb-KsOqWQSV90ubTTalBYMiUnSSAQ-W8JdPYMxitzPxuK1R5bNHCUvBMH17WwbOpz1fmeHpW6bvRi5u-x265otsuadL0lCYRhoul4M0EmDS3xnfvJKnmG_5E3Gx2zYlqKcoQSUiNeL0ofHbmi9153__wAV6PloxqfCDcfJEj4NE6kZrIrdnwoHrOuzB-rrZ_U7iP6aNfWJLGGF30ZBdb4X5SskiUlyN4vaH3NPD4mlnppIF-bUZdKGA1gBolU2luDHpPP80IB0b6Pe5h98Yx6uEHGu7H6t5lwTgYMBkDDhOmhAXCrPSqMOxA-0uj4WzLrRxTTo86OxEG6Ln0JZxA-UPVz-rb9y1Oq-CNXvcIw6L_Iu8vMA_1hg_iI7Zbfrdf_li5wljM9VghKE71gfNKTWc3ewI0J2BVPDyp-aC5P1vIZIvF-DrixUingjkkUS-D1CAnBOqjuP5-lr44Ycwr14Anb_tLMyTxbWDYoexZYyxI85cXZ72Whr7caX-40pQWgz7rOfASfTqnde8DXyliCuaXsBdc1QJbc7XJ2OmKzJdu7UjHCxtVBatxp0QpRfrOtRUx2nf-R3XtYkc61JV4Dmd9UrTYzAHw6bzySViEqK7SyYE_pUMBzTKawnaPXj_m70ScwZRCgwLOpW1x0BT9mq5Ts9pgfXEYwvj7TPyPSV2za9YLM6u0cgRTc4dHvr2UmgztfYQFcPC1jfHQsVjOUZZQTCQrQdIKAcObllf37k5D7_B7GU-XjC2LD03qgU9Z92SjewIa4Uwvl6voQSKKLDL6CSnLzQDeFEI-bvGM1qMBZga-_8sdOPpAzgYofd3d2B51ws-n0QB5jOOKiPtr6aCFgD87AHXoHslailMr_rE-bAq8A0K1NIxdeVzOqJKrdj24pUpKnAe2A__5wAhT_5MUVuuhd7nkvybACW9-DgsY2HbmP0Yp56Vxh43c7KAkSyrvta1CrXWPkF4_bdGqbkg1cCbzEzg2EWoxGNfodgtTc3&cid=CAASEuRofSfzUbZTHO_ofQjCaNTx-w&rfl=1%2Chttps%253A%252F%252Fthehackernews.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:07:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
117
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
3128
x-xss-protection
0
server
cafe
etag
3658073882064373855
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:07:44 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/ Frame D978 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20211026/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bs9WHafgiQVCG4_nUUaE5IQbv4sF31aRkce1vcOaybvC7DRJJ0tBwya0nmpAww58v2iRTAxwfnAbLdWpcNCjFsekjts3AAzNrGMui1N3Sc5eN8CYJ5iLenTLhy53g2zt2Zh-WpfOADSvanFa285dWTOa44vg&dbm_d=AKAmf-BwM6Ew_Z6UIKeZjVYlXDyWRB_rD4IFSL0T7TxFo4hHWaSvjABeMvBE_rI4D80p2GPFrxTDKMF6TwY_NYQZhGpRU78T-zRL7m65TGFceUEA9UFz2AhJ1XPPIVOkG1ZYrb0CclCsJkgQE0hqKbTlZBlcgOdmzmdWcH90q9drjgctx4J_CT7InuP01y07D8aVkphZZh0t2F1dwjPl6BwV9sdzZ1luewukJRKqKpN3iUh4kqgq3v0ZWXXrmFGJWV34ompVSmpUc9TGas0JjzbrbeEIllLNz5p83dttn4bF6XNaOiIKB7iObvRVSyd772o4gVSi6WMozQuJkxL7KeJJN0SoCllIPTY-IKhqcjTwH5LdSZ8zbZvJSPdUqNE84SS0PnaP1jLhTsO_IfyTBqBYXfb2LUDt-F-MN6nzmCSt86WCuZDHsqcPYIoKJTQGMyRdH_H3Th_kFxylCljYRwoDtYuqQcirbP3hojDTefvqHBXggWnFyzTJeXgPO1NeXkigarm3qPdkuIelgx8omeZtkR4Jo4nU8mO733E7GHi3-EIGN772f1Nha3AVf8KhWYnQBa4H7DnYQu9TpEkbGk60Ug-PvZZ0YnbdcaF4weZ0fZaDvJbAls1AhhmDZ1JKb-XNX3ZEz2MdNcOlxQHkyz9ks-uEfn1LMgXDAuKEinUCzC1cusY9lgU9U_4e2ZGPqqxXSXagBW1IGFmhvuOMYrEvE1WBVDO8wiZdAQVtBCB5pqTu7k3oX7M83k9oFQ3VTWuPFCeFWht0zokH58bJU4bx0ZoVe_zkpRkJv5CAeJmqaezYbgpBzcD5bHqjcTmvP4iH95TaNV4XhR4HMGHhIRfIcAlKfuiCMRxUifI5NfSj7r1la3lhWQ2fGbJ749baGht4-LGhxDAPC0mpAd4ctD2erXysQa1HixKI1E5EtbucRnMDMMVQhJ6g6HsA0y_WApDEksPwAlr26myuShnLhzgsE_b8k2j_mUNvbvyTfSY-6fc04vMtbdzIp9YRPINAi4w1zL_QzUXxX6f-NFt1IQ2VmPEhteCChYSnuXl8PsA1PbxhPv1UtK22OzaPCQnsZmv_Sat5MUlxHxmA6ioDtJiu41v6NbNf0vWioK0KyQtEYHQNnmJQ6BuW52nj-oCsB1tribtalntt3Bdc7UTRSkE3TxcRzJtyEA-a4Fgh3tWYqFjo4_kw7qP580D18tvXtFU9THPWK3dFU5cifC2gDXm3oOQnMaNlsrJ1wpRimAP_vnUWM98hoXgPB_wYb29m4ski7QQIC_5hjUpTyKtYtrpgT_-kZXCSokwdyVQIRkoQPNy5xqVDHo-18OR7E828W0EQstu1rGujOdGS8tTtYc1P3KYrdH06DPfgG6RCLgS_d_yxnb2bBAlYnd8YOzmlpLpWjpUz1EPSZhOvvsJdF89mAqt1YQ_qhGNXKtxdwyrqWjwiKt4uPbTp5MYeio31048K7VQouZ_gdxqedmhUZpL24cjgq7O518PEjJD7zOPgB5YjnfnuNJA3C6VmaMinDt6BTuoVWJw4bFfLUuIEm-49gFCUZgFV7W2I7bhDSi-VYewN8NPsE0lCFW8tRxhgiHdIu2LbfzrI5g8J0MWp6WQUZ7I0rZE0pLogC94s04GYc8VcPNPts-fnJMBwNwkS97hJOZHS5xzR97DkuD1PtLUl_ElvkvGpi9rds45eyEtXCQPusnD9U7wMa8JAb8xyAJvpu5JVeFugvT-JuN3DNCcbcActYuYqNm1Vn7lDOWe--sK5ARj_nTSz-ceuFYO-IBEVplRtTZxf72e_ZmfG7CKXvDjcfGEYZ5EwV7c8AHBEEXhwulH_3L2Gr7qRZa8p8tQoze53iiu88BwnDHGiWamRP_hJFLN5ufPednUwN8HEA4e8hsGWKWtah5J3DrJNLL4yWHpvHy88uYoCmqEGYREL1ydQCGZ-P4ZnAUkyjCw4Pwin1m4NkIZT8gW4auzIIb4-cGBJ21a50bE8xJXDGoRHwQRhjZykQOxylayIMp1UVqNZa45wcV0Q8pUJ6IWVoLIxwNUv_qNeBiUBCsUWzj_xrzDSnGRb-KsOqWQSV90ubTTalBYMiUnSSAQ-W8JdPYMxitzPxuK1R5bNHCUvBMH17WwbOpz1fmeHpW6bvRi5u-x265otsuadL0lCYRhoul4M0EmDS3xnfvJKnmG_5E3Gx2zYlqKcoQSUiNeL0ofHbmi9153__wAV6PloxqfCDcfJEj4NE6kZrIrdnwoHrOuzB-rrZ_U7iP6aNfWJLGGF30ZBdb4X5SskiUlyN4vaH3NPD4mlnppIF-bUZdKGA1gBolU2luDHpPP80IB0b6Pe5h98Yx6uEHGu7H6t5lwTgYMBkDDhOmhAXCrPSqMOxA-0uj4WzLrRxTTo86OxEG6Ln0JZxA-UPVz-rb9y1Oq-CNXvcIw6L_Iu8vMA_1hg_iI7Zbfrdf_li5wljM9VghKE71gfNKTWc3ewI0J2BVPDyp-aC5P1vIZIvF-DrixUingjkkUS-D1CAnBOqjuP5-lr44Ycwr14Anb_tLMyTxbWDYoexZYyxI85cXZ72Whr7caX-40pQWgz7rOfASfTqnde8DXyliCuaXsBdc1QJbc7XJ2OmKzJdu7UjHCxtVBatxp0QpRfrOtRUx2nf-R3XtYkc61JV4Dmd9UrTYzAHw6bzySViEqK7SyYE_pUMBzTKawnaPXj_m70ScwZRCgwLOpW1x0BT9mq5Ts9pgfXEYwvj7TPyPSV2za9YLM6u0cgRTc4dHvr2UmgztfYQFcPC1jfHQsVjOUZZQTCQrQdIKAcObllf37k5D7_B7GU-XjC2LD03qgU9Z92SjewIa4Uwvl6voQSKKLDL6CSnLzQDeFEI-bvGM1qMBZga-_8sdOPpAzgYofd3d2B51ws-n0QB5jOOKiPtr6aCFgD87AHXoHslailMr_rE-bAq8A0K1NIxdeVzOqJKrdj24pUpKnAe2A__5wAhT_5MUVuuhd7nkvybACW9-DgsY2HbmP0Yp56Vxh43c7KAkSyrvta1CrXWPkF4_bdGqbkg1cCbzEzg2EWoxGNfodgtTc3&cid=CAASEuRofSfzUbZTHO_ofQjCaNTx-w&rfl=1%2Chttps%253A%252F%252Fthehackernews.com%252F%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
1f15dc13ebdca8972b7eeb648108b804feb40f890ae25cc14cf5a3b1379726a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
10
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
9298
x-xss-protection
0
server
cafe
etag
5575107075035495308
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:09:31 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame D978 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 14:15:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
158037
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Wed, 26 Oct 2022 14:15:44 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 109A 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 28 Oct 2021 08:58:57 GMT
expires
Fri, 29 Oct 2021 08:58:57 GMT
content-type
text/html; charset=ISO-8859-1
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
4244
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
truncated
/ Frame D978 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
218dd79df6aa444af4532bd4d7f816a354a7cade42c7dab331146b9ecb21becb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame E239 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin
*
content-length
8395
date
Tue, 26 Oct 2021 14:15:44 GMT
expires
Wed, 26 Oct 2022 14:15:44 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
158037
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
index.html
s0.2mdn.net/sadbundle/3562589601325679975/ Frame 1E90 		115 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
ef1eefe12720b4c3d2987a398334bd11225805b03c48e21e57fb3852b3a5710b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-type
text/html
access-control-allow-origin
*
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin
*
date
Fri, 22 Oct 2021 15:45:47 GMT
expires
Sat, 22 Oct 2022 15:45:47 GMT
last-modified
Mon, 11 Oct 2021 12:32:48 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
content-encoding
gzip
server
sffe
x-xss-protection
0
content-length
22829
age
498234
cache-control
public, max-age=31536000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
view
googleads4.g.doubleclick.net/pcs/ Frame D978 		0
24 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuIRm1ha2mvCg7MJTxX0yac98ngqdrJ0DAJUq9PVYBrTqn6xloXcZ1s3_2tNYIlfDv6vKhizBOeHA9pEDif-7jjdUVc31d-qtSQ1PFcHCUaehF3rb6hNU1eROfvz73kep29I9TNt96t3vix6_BgEYuqTR7F-DA883PEzgKhOaS0MexoWHBTtxuhOS0mWLmWJ-eYMiEJg8HTmpkb_oDCi1xrhr5oQihJULiUS9jOyhJFPECvGfXU-jR2v6vuOJwi4dMWpXZ9F5gjDBdJe1uV_8fc79l_rE-gcPYduTRhPmStOgEtobGFtdQPbRVA1KBJRnzCRIOO7U77nRQh8AUcys4mENXQyakrungF5ETf4vGBsZXBkBvArZJUuM9qb_3FrOUmMwNCOx7LiQuv88L-4RvT75PbYodMZb9uFf_T-2MB-heKqId_RZ8kiGnD4CF7h1HQC7slxUrgfHpXS2VBCUo7z2wIv8VH5loVrbC6COx25_7_IamLnyMaeIQU6CbSAl8-HzwQomL7D_wj57hobyGjZYW1qt-5S9naTVK3xzu4JR_3bC-Z4X0W__oaQdGNvTGMIq90tMYNcvcX6a_HfGYtBBmR3UUUcR8uh2P5b6JoONArnh4_v5wSv0EDeRlJRCThTFwj1rwH9hr6JamNajYlSSFxsNsm1BdsAJ0G5Bb_zFQ2HNB3SS3cAmfa5Sitkn6s3QrCx9SBJ3-eUx7KIiAV4AzjupwKLoWH6-3jeYsUgCsaRbEt8oGeYsA8eNhdy_EhgpbTd62rXmZ6RCCjj7L9vAVQ9YvPrFJMOTdcVTj1phcYW5xwGNzSa8ywJXSgWU0RjwGXc9NtjbB6R8kVPbhv0cnHVAGEdg6YoAu1sjbjDdHta5Q2xqwBkJAe0JLNHA9ZFATi01U1imor5nKOh4A2lK-3kp-FYICNTcO0BbBFe-uPvKBziWh67L_o9aYYnDdNMekfcMS1-7ytw1Xi5VijV3pOEnSm3FzMFN9XBruAuasODKl6ii3yNh7NqplzcFjkJWKci0m_ADlr4FfkZKdzsnrcwz3usNfmmyGlCdLCj5TGzk-5OVECANaVb0gkyQjSC1P5Ch5-ggpYtENFjsy5PUqa6CoECOBeYcmE2tj7q3FW_JhJq15Qs2C1L4ibHzSzaK89VdIZGvizEhA4PKY5a8EyjAQwYgtw8AWxCh0FVS-CA3EYsxfNxLJMa0K-YaM7GQhcU6vf5pYs0RyfD4S7CA&sai=AMfl-YRlAtFQXELe1HcKx9_QUI3XOmg0QBYJrWMIQAbNht2ZVqB_qGFOIlt7lfAhb5wuJD5Izy5WJot4XD3i0Yih9cuPs2cot4YtnSuY7_gwnLkCfneiKXPuyrN-ONcVGqTxISGWQwa3XYQSQy1oS0W_5-XOr-24qkdXXnIx00F_e2xsTAuDv2-l&sig=Cg0ArKJSzKRzWDHDDmjJEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=40&cbvp=1&cstd=37&cisv=r20211026.70772&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date
Thu, 28 Oct 2021 10:09:41 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
pixel
cm.g.doubleclick.net/ Frame 109A
Redirect Chain
  • https://um.simpli.fi/gp_match?google_gid=CAESEKaxpEOrgQgFU8ST6fGh8D0&google_cver=1&google_push=AYg5qPKnSvcNcAacPZGwbdFp-mpw32MB4kP--2d9upbOsZ0nd72PHSpqT9yDGfhfWANI-5OdkSbtSKIYvUMKGCB0mdj6x3l7y5iN
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=90105F77DE07453DB190875A6839F3E7&google_push=AYg5qPKnSvcNcAacPZGwbdFp-mpw32MB4kP--2d9upbOsZ0nd72PHSpqT9yDGfhfWANI-5OdkSbtSKIYvUMKGCB...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=90105F77DE07453DB190875A6839F3E7&google_push=AYg5qPKnSvcNcAacPZGwbdFp-mpw32MB4kP--2d9upbOsZ0nd72PHSpqT9yDGfhfWANI-5OdkSbtSKIYvUMKGCB0mdj6x3l7y5iN
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Thu, 28 Oct 2021 10:09:41 GMT
x-content-type-options
nosniff
server
openresty
location
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=90105F77DE07453DB190875A6839F3E7&google_push=AYg5qPKnSvcNcAacPZGwbdFp-mpw32MB4kP--2d9upbOsZ0nd72PHSpqT9yDGfhfWANI-5OdkSbtSKIYvUMKGCB0mdj6x3l7y5iN
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Wed, 27 Oct 2021 10:09:41 GMT
google
match.adsrvr.org/track/cmf/ Frame 109A 		70 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEASJd2rhgPeWh7VdRv--SOo&google_cver=1&google_push=AYg5qPIfOQMYZCML43Bq58DLiOiiqo-Rjlckqde04OM1Favr3SAqscWx3CYo8ic_7AdrcbuXAGVmT_pr5OTkr6_b502HOgsfNiCz
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 109A
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEEsZSljXtXWWXjf318XBE6I&google_cver=1&google_push=AYg5qPLfu03fjHyLNnCFctx3_n7F84Fe8QOA8fr1GULGJLJUKp0WRZ9j2esvPjEPB9lgVTBjrGGhVjdvAWa...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLfu03fjHyLNnCFctx3_n7F84Fe8QOA8fr1GULGJLJUKp0WRZ9j2esvPjEPB9lgVTBjrGGhVjdvAWam_I4lnYXWh9GcmtiM&google_hm=JREYxwwpSZSwFrqNRyppzjc
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLfu03fjHyLNnCFctx3_n7F84Fe8QOA8fr1GULGJLJUKp0WRZ9j2esvPjEPB9lgVTBjrGGhVjdvAWam_I4lnYXWh9GcmtiM&google_hm=JREYxwwpSZSwFrqNRyppzjc
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:40 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLfu03fjHyLNnCFctx3_n7F84Fe8QOA8fr1GULGJLJUKp0WRZ9j2esvPjEPB9lgVTBjrGGhVjdvAWam_I4lnYXWh9GcmtiM&google_hm=JREYxwwpSZSwFrqNRyppzjc
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
clear
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 109A
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEO4S2T-Y0DIr3c0DhQI0Iho&google_cver=1&google_push=AYg5qPIZxMCK5jsHRCQzbNxgXWOYV_uRhQKzLsLNTqqFT7hr7Kd4FXFoNiKTO03xJmTGPYIwfmB3Bn4M8A96S7...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDA1NzI5NDc3MzQ4MzY3MQ%3D%3D&google_push=AYg5qPIZxMCK5jsHRCQzbNxgXWOYV_uRhQKzLsLNTqqFT7hr7Kd4FXFoNiKTO03xJmTGPYIwfmB3Bn4M8A96S7DJqo...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDA1NzI5NDc3MzQ4MzY3MQ%3D%3D&google_push=AYg5qPIZxMCK5jsHRCQzbNxgXWOYV_uRhQKzLsLNTqqFT7hr7Kd4FXFoNiKTO03xJmTGPYIwfmB3Bn4M8A96S7DJqoSWGSp4wP8yZw
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzAyNDA1NzI5NDc3MzQ4MzY3MQ%3D%3D&google_push=AYg5qPIZxMCK5jsHRCQzbNxgXWOYV_uRhQKzLsLNTqqFT7hr7Kd4FXFoNiKTO03xJmTGPYIwfmB3Bn4M8A96S7DJqoSWGSp4wP8yZw
Date
Thu, 28 Oct 2021 10:09:41 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame 109A
Redirect Chain
  • https://ads.travelaudience.com/google_pixel?google_gid=CAESENgDK_ySBqSfnQbQ_f5QG6k&google_cver=1&google_push=AYg5qPLhH4DQZadbuByafd9xX9Sj7AADt9uAZo8c3q9IVtTztY0C3Xn0bFMjCF-HqAJg8tNnc6CEjMrMF69phIuK...
  • https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QdLLH_7dSCqdgNWshSPmPw2&google_push=AYg5qPLhH4DQZadbuByafd9xX9Sj7AADt9uAZo8c3q9IVtTztY0C3Xn0bFMjCF-HqAJg8tNnc6CEjMrMF69phIuKTI1JdQSpxWJaXg
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QdLLH_7dSCqdgNWshSPmPw2&google_push=AYg5qPLhH4DQZadbuByafd9xX9Sj7AADt9uAZo8c3q9IVtTztY0C3Xn0bFMjCF-HqAJg8tNnc6CEjMrMF69phIuKTI1JdQSpxWJaXg
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Thu, 28 Oct 2021 10:09:41 GMT
via
1.1 google
x-engine-version
0.0.0
server
nginx/1.15.12
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=QdLLH_7dSCqdgNWshSPmPw2&google_push=AYg5qPLhH4DQZadbuByafd9xX9Sj7AADt9uAZo8c3q9IVtTztY0C3Xn0bFMjCF-HqAJg8tNnc6CEjMrMF69phIuKTI1JdQSpxWJaXg
x-host
tde-deliveryengine-production-7f8fcb5db4-v5jb2
alt-svc
clear
content-length
0
pixel
cm.g.doubleclick.net/ Frame 109A
Redirect Chain
  • https://px.adhigh.net/p/gm/rub?google_gid=CAESEK7hsK2VwhuSUZLWD10BLQE&google_cver=1&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw
  • https://px.adhigh.net/p/gm/rub?google_gid=CAESEK7hsK2VwhuSUZLWD10BLQE&google_cver=1&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wem...
  • https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw&google_hm=jUgN4rqs4UUAAikABlF8x...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw&google_hm=jUgN4rqs4UUAAikABlF8xmByJg%3D%3D
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
server
nginx
access-control-allow-origin
*
x-backend-id
f9-ru
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=gint&google_push=AYg5qPL5ve-QpPCIBufqbasUKBHRp4xRWeIePfZjsMapwzPeIaBTvrZhCPKQn7WxSupzia9OvCos2rHLnpPZ-ccA66CVEfJWC3Wemw&google_hm=jUgN4rqs4UUAAikABlF8xmByJg%3D%3D
cache-control
no-cache, no-store
access-control-allow-credentials
true
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 109A
Redirect Chain
  • https://match.360yield.com/match/ebda?google_gid=CAESEHGQxDRBdIcEcaf6f8hSocQ&google_cver=1&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfm...
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEHGQxDRBdIcEcaf6f8hSocQ&google_cver=1&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt1...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame 109A 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IEvsSUH1LHQCT1ls8ZmsSTCS_NPILsmxVZeMaMiHTI5to_IB84eH13umcpY9OVHewGhvml
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:41 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
pagead2.googlesyndication.com/bg/ Frame E239 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
sffe /
Resource Hash
673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:43:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
185192
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13325
x-xss-protection
0
last-modified
Tue, 19 Oct 2021 13:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Wed, 26 Oct 2022 06:43:09 GMT
css
fonts.googleapis.com/ Frame 1E90 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:700,500,regular
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.170 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f10.1e100.net
Software
ESF /
Resource Hash
cf624cca88c1828e4dc1a61151d2ce6e826191ba2223f4cf4cdacc1d8a52981b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 08:17:54 GMT
server
ESF
date
Thu, 28 Oct 2021 10:09:41 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires
Thu, 28 Oct 2021 10:09:41 GMT
DcmEnabler_01_247.js
s0.2mdn.net/879366/ Frame 1E90 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/DcmEnabler_01_247.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 14:26:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
71019
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
10136
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:45:03 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 28 Oct 2021 14:26:02 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 1E90 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f131.1e100.net
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 01:55:14 GMT
x-content-type-options
nosniff
age
548067
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 01:55:14 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 1E90 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,regular
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.131 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f131.1e100.net
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 02:46:35 GMT
x-content-type-options
nosniff
age
544986
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 22 Oct 2022 02:46:35 GMT
TS-Online-EN.png
s0.2mdn.net/sadbundle/3562589601325679975/ Frame 1E90 		628 KB
629 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/3562589601325679975/TS-Online-EN.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
1459a4c2d036e9bf1a897002f1e18a3b502c9661bacd06e616bd08d422058dd9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 21 Oct 2021 22:04:48 GMT
x-content-type-options
nosniff
age
561893
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
643563
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 12:32:48 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 21 Oct 2022 22:04:48 GMT
BitdefenderLogo_white-_2_.png
s0.2mdn.net/sadbundle/3562589601325679975/ Frame 1E90 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/3562589601325679975/BitdefenderLogo_white-_2_.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
09390420931de1a5876504eb4ebc8af93bd0464e7837af05c971b8afd33f6dbf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 15:45:09 GMT
x-content-type-options
nosniff
age
498272
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
28426
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 12:32:48 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 22 Oct 2022 15:45:09 GMT
OP_20Ans_Ban_336x280_Vec.jpg
s0.2mdn.net/sadbundle/3562589601325679975/ Frame 1E90 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/3562589601325679975/OP_20Ans_Ban_336x280_Vec.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
1a8d5cd982c8f774f8d3e9024812353f1fdd9d5033e20c84bb57aedcd473b236
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 22 Oct 2021 15:45:09 GMT
x-content-type-options
nosniff
age
498272
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
20146
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 12:32:48 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 22 Oct 2022 15:45:09 GMT
OP_20Ans_Ban_336x280_Vec_F3.jpg
s0.2mdn.net/sadbundle/3562589601325679975/ Frame 1E90 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/3562589601325679975/OP_20Ans_Ban_336x280_Vec_F3.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
sffe /
Resource Hash
bab66612be34a35f9bc5f36858ba5002b2ddeefe301acc3f2e33fe235d5656b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/3562589601325679975/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 21 Oct 2021 23:04:06 GMT
x-content-type-options
nosniff
age
558335
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
11277
x-xss-protection
0
last-modified
Mon, 11 Oct 2021 12:32:48 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 21 Oct 2022 23:04:06 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame E239 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQNlc5XZ6YebvKoqcgQeQ4o_gBAAAAAA4AeAEAg&bg=!ExClEFTNAAbUs_yW1LM7ACkAdvg8WjI-6eIbN50Zb9ApEIUTMWOYqNHMaJdFtNq-xGYE6FmDiEZg-QIAAABvUgAAAAxoAQcKAG0Gz2k7otwY3-9Nf2C64k0gJjTXV1huRydL2-YL4UerwM70U6zzZybzlzuE33zvrvc14MNUzX9ywLUiHN1jisxj74txPvK5-A2CyhqJHUx5xRYcgwSC3NVuKGmKYjSN5DcDgRnt-wPcJztU2fTomQL8IA82phFfdKGYmGVZwxhZuSHNJYno45WHmxh9R80a1jNHwEk5zzGvUMyYxK0FPSfJF0Wtr63C9D5OKbPJVxSv8k6_8f89ZiyDLSomYxM5OIuPrLfRY2d6N9j-4elM53ikG_7gixZydAySyWrKw59ohKRHSrxIFdJaUUnImLdDAjAwy7V_x0gpMSr8788bpox6_lqVHwmfCI0f1cdNl3yHHRFG0ZQM8UkK4F6L-2JSF9sdfAxXpelzgwlOHp0uBjCfWSBpTRYPWu5WR0JwQVcu9h-ipmTyljAuWnD4bPe06dm9a-tF-V-JSJI1_OuznazRdhdTMGf8xYcocmYWotvjHW6t805JPy_BCuBiWTe8ky722pTb7r6hZX2ILP4860OCmd-yrCH1Muns9MkaFaH-02keztoPbccyxRenh6qX7Je-SgP1cdjgAJS7-oOdeHhPRDQD-nEA3qfPeFDf_2V2orxrj42LX9wNucWGTY0z45vx_lF4FP90tXwKeSFLVsAArUO17ic10Fb5T7xmtpDeElEyrWS7oDma5k_z7VF9lwfuf4gDZBtWg-p2zN_BjFyqYnwCnngVxZptC96tVNHuVsycw3Sk7oIPceAUrh2PRZEpVpR5PX9sxdZwz5_0HQqBIqolrZY5Q-Z-DKySELA7EYZ7f6qSKAxMY9BTxgx4MJ6k_Gr7CqNhfCsXbaFqybf5ivAv8pdM-SuWEDj6V9sxEOEDRvLs51aO5LbQ0bdGx5GwlhpIeDAPAZPd6aAdiQRY2AWFM95eh0-RLPaVslnGCf2eobMEK9e8v3sbinfO73c-Vm_s-0Wzgz5bKeFe1FinBw3oTY7FfTklM3tL8uGY69w0eczBCyEHRofdYwB2ResRALKoItRugysH8kP9VcSuyY7rezA5GyO96WtmzYDFB_DuQjPvqT_Du1y6Wkz_BcnPNcdXMyOEeRdyVZ-rD5Wledsw2BH6B8hA06501WhG2PR02TgoPhIO4F483XJt8K3A8rMnGV-VoR5k8Jc
Requested by
Host: e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
URL: https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:41 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame D978 		0
23 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuIRm1ha2mvCg7MJTxX0yac98ngqdrJ0DAJUq9PVYBrTqn6xloXcZ1s3_2tNYIlfDv6vKhizBOeHA9pEDif-7jjdUVc31d-qtSQ1PFcHCUaehF3rb6hNU1eROfvz73kep29I9TNt96t3vix6_BgEYuqTR7F-DA883PEzgKhOaS0MexoWHBTtxuhOS0mWLmWJ-eYMiEJg8HTmpkb_oDCi1xrhr5oQihJULiUS9jOyhJFPECvGfXU-jR2v6vuOJwi4dMWpXZ9F5gjDBdJe1uV_8fc79l_rE-gcPYduTRhPmStOgEtobGFtdQPbRVA1KBJRnzCRIOO7U77nRQh8AUcys4mENXQyakrungF5ETf4vGBsZXBkBvArZJUuM9qb_3FrOUmMwNCOx7LiQuv88L-4RvT75PbYodMZb9uFf_T-2MB-heKqId_RZ8kiGnD4CF7h1HQC7slxUrgfHpXS2VBCUo7z2wIv8VH5loVrbC6COx25_7_IamLnyMaeIQU6CbSAl8-HzwQomL7D_wj57hobyGjZYW1qt-5S9naTVK3xzu4JR_3bC-Z4X0W__oaQdGNvTGMIq90tMYNcvcX6a_HfGYtBBmR3UUUcR8uh2P5b6JoONArnh4_v5wSv0EDeRlJRCThTFwj1rwH9hr6JamNajYlSSFxsNsm1BdsAJ0G5Bb_zFQ2HNB3SS3cAmfa5Sitkn6s3QrCx9SBJ3-eUx7KIiAV4AzjupwKLoWH6-3jeYsUgCsaRbEt8oGeYsA8eNhdy_EhgpbTd62rXmZ6RCCjj7L9vAVQ9YvPrFJMOTdcVTj1phcYW5xwGNzSa8ywJXSgWU0RjwGXc9NtjbB6R8kVPbhv0cnHVAGEdg6YoAu1sjbjDdHta5Q2xqwBkJAe0JLNHA9ZFATi01U1imor5nKOh4A2lK-3kp-FYICNTcO0BbBFe-uPvKBziWh67L_o9aYYnDdNMekfcMS1-7ytw1Xi5VijV3pOEnSm3FzMFN9XBruAuasODKl6ii3yNh7NqplzcFjkJWKci0m_ADlr4FfkZKdzsnrcwz3usNfmmyGlCdLCj5TGzk-5OVECANaVb0gkyQjSC1P5Ch5-ggpYtENFjsy5PUqa6CoECOBeYcmE2tj7q3FW_JhJq15Qs2C1L4ibHzSzaK89VdIZGvizEhA4PKY5a8EyjAQwYgtw8AWxCh0FVS-CA3EYsxfNxLJMa0K-YaM7GQhcU6vf5pYs0RyfD4S7CA&sai=AMfl-YRlAtFQXELe1HcKx9_QUI3XOmg0QBYJrWMIQAbNht2ZVqB_qGFOIlt7lfAhb5wuJD5Izy5WJot4XD3i0Yih9cuPs2cot4YtnSuY7_gwnLkCfneiKXPuyrN-ONcVGqTxISGWQwa3XYQSQy1oS0W_5-XOr-24qkdXXnIx00F_e2xsTAuDv2-l&sig=Cg0ArKJSzKRzWDHDDmjJEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=233&vt=11&dtpt=193&dett=3&cstd=37&cisv=r20211026.70772&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
event.png
tps11046.doubleverify.com/ Frame 4A96 		67 B
419 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps11046.doubleverify.com/event.png?impid=9591605df6cd493a8d1cd334c6ef1638&gdpr=&gdpr_consent=&dvp_gdv2_Func=1&dvp_gdv2_Applies=0&dvp_gdv2_Succ=1&dvp_gdv2_Dur=0&dvp_gdv2_Doms=0&dvp_gdv2_Dome=0&vdur=552&eoid=9&msrjs=1800&pltfrm=Linux%20x86_64&dvp_ac_version=0511&dvp_acibv=&bsigr=34359738497&sdf=2&vit=2&isvelg=1&tltms=7&tetms=9&msltms=17&vltms=552&sei=289&vetms=10&engms=1&engisel=1&ttfurm=2582&cbust=1635415782420502
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.109.138 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software
/
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:42 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/png
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
98
Expires
10/27/2021 10:09:42 AM
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.19.94 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
4386279
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
27964
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15d95"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6doUQX6%2BuXszaKfP86Nvh6Lv6yYQhd6crtmL6q5n9jRvvxLLkLNxe7mhRNlVNjoxQswB7xpi6x3S7nTWHOSfHmn%2BX50tyNI0a5WIb8waMerx3lOCsE3xyYt9TifFpU0mxuFBegiu"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6a535ec30ea44114-PRG
expires
Tue, 18 Oct 2022 10:09:42 GMT
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 26 Oct 2021 23:24:02 GMT
server
Golfe2
age
548
date
Thu, 28 Oct 2021 10:00:34 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Thu, 28 Oct 2021 12:00:34 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		144 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: thehackernews.com
URL: https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
dfce93c5632ef0a345e287efa4d250609ba3f00e8af81f7c029f6c5a9ec2e48a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
51548
x-xss-protection
0
server
cafe
etag
2936736750464090309
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 28 Oct 2021 10:09:42 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		11 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021102501&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
a615ad6d4202a6400183db13a2ce3d08853a1686bd8c7cf6996a85df9a75f91b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
8488
x-xss-protection
0
publishertag.prebid.js
static.criteo.net/js/ld/ 		85 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
2581d556ceadd8cdd3eb15509ff94501871552563a71381393fc7b59611cbc1e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
last-modified
Mon, 04 Oct 2021 12:34:24 GMT
server
nginx
etag
W/"615af4d0-1535c"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Fri, 29 Oct 2021 10:09:42 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021102501.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1624308425655142"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
6467
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
expires
Thu, 28 Oct 2021 10:09:42 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1455813882&t=pageview&_s=1&dl=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&dp=%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html&ul=en-us&de=UTF-8&dt=Hackers%20Using%20Squirrelwaffle%20Loader%20to%20Deploy%20Qakbot%20and%20Cobalt%20Strike&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAAABAAAAAC~&jid=1588323669&gjid=57699118&cid=466266947.1635415781&tid=UA-27389293-1&_gid=1184689371.1635415783&_r=1&cd1=2.0&z=1573672084
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.238 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:42 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/ 		269 KB
96 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
d534ae509b079f2ac710e2f869ba11338a51c7ba502291d712a824695068056c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
98546
x-xss-protection
0
server
cafe
etag
915476669301625806
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Oct 2021 10:09:42 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211026/r20190131/ Frame 8E6A 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211026/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Wed, 27 Oct 2021 16:23:50 GMT
expires
Wed, 10 Nov 2021 16:23:50 GMT
content-type
text/html; charset=UTF-8
etag
15765991816257340444
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4703
x-xss-protection
0
age
63952
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
collect
stats.g.doubleclick.net/j/ 		2 B
441 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-27389293-1&cid=466266947.1635415781&jid=1588323669&gjid=57699118&_gid=1184689371.1635415783&_u=YAhAAAAAAAAAAC~&z=291424665
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Thu, 28 Oct 2021 10:09:42 GMT
content-type
text/plain
access-control-allow-origin
https://thehackernews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/224/ Frame F436 		12 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
cross-origin-opener-policy-report-only
same-origin; report-to="adspam-signals-scs"
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length
5029
date
Thu, 28 Oct 2021 09:28:56 GMT
expires
Fri, 28 Oct 2022 09:28:56 GMT
last-modified
Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2446
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
aframe
www.google.com/recaptcha/api2/ Frame D253 		783 B
536 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f4.1e100.net
Software
GSE /
Resource Hash
f9f344b4407561250d26dbe5d6044f1c605e17c01c8641e1bb540f4d8b767444
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-PYUntZaMJ76/0kvS6Ml35w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires
Thu, 28 Oct 2021 10:09:42 GMT
date
Thu, 28 Oct 2021 10:09:42 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-PYUntZaMJ76/0kvS6Ml35w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
514
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
syncframe
gum.criteo.com/ Frame C733 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=thehackernews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

cache-control
private, max-age=3600
content-type
text/html; charset=utf-8
content-encoding
gzip
vary
Accept-Encoding
strict-transport-security
max-age=31536000
cross-origin-resource-policy
cross-origin
cross-origin-embedder-policy
require-corp
server-processing-duration-in-ticks
1710
date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
4683
publishertag.prebid.js
static.criteo.net/js/ld/ 		85 KB
27 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
2581d556ceadd8cdd3eb15509ff94501871552563a71381393fc7b59611cbc1e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
last-modified
Mon, 04 Oct 2021 12:34:24 GMT
server
nginx
etag
W/"615af4d0-1535c"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Fri, 29 Oct 2021 10:09:43 GMT
owasp-banner.png
thehackernews.com/images/-GKdwFODXENU/YW_Rf1m_eHI/AAAAAAAA4dg/PXvwBOhkiQgXuk3J4YLpDAzjWu1tYBlLwCLcBGAsYHQ/s300-e100/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/images/-GKdwFODXENU/YW_Rf1m_eHI/AAAAAAAA4dg/PXvwBOhkiQgXuk3J4YLpDAzjWu1tYBlLwCLcBGAsYHQ/s300-e100/owasp-banner.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ec8fa6e02da7947731c15494a568893d2da42b13bbbf9b4c695139b04c81420
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
73853
cf-polished
origFmt=png, origSize=15674
x-forwarded-for
185.14.232.121
content-disposition
inline; filename="owasp-banner.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
13262
x-xss-protection
0
expires
Wed, 02 Feb 2022 17:41:11 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"ve1da"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mKvNT1dx8C%2FMr5X7m%2BHFS8TA9%2BKAVsh3%2BZ2CqNmLgQjYFltHXqUzf%2F01xqoeWYbuwgTPaq814ZZyV%2FZ%2Fr4B%2BRKItVxzQcUwmCeq4oPHchrK1WXDH7NC%2B75QiSbWK5JAaa8oU"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535ec3cb1b2788-PRG
access-control-expose-headers
Content-Length
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-27389293-1&cid=466266947.1635415781&jid=1588323669&_u=YAhAAAAAAAAAAC~&z=260908859
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookie.js
partner.googleadservices.com/gampad/ 		207 B
446 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=thehackernews.com&callback=_gfp_s_&client=ca-pub-7983783048239650&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f2.1e100.net
Software
cafe /
Resource Hash
918ea9df695a93d6c6e8017662a5d7615ea6c4f45fc937a04ea33bfbf87c8dd8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
199
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=thehackernews.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 78B0 		69 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
a52ca07f327c5d2ebbadb0d1e58c1b513f4151f372d20cf24b3fd3fd13a5c4d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 28 Oct 2021 10:09:43 GMT
server
cafe
content-length
27189
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
json
gum.criteo.com/sid/ Frame C733 		428 B
529 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=publishertag&domain=thehackernews.com&sn=ChromeSyncframe&so=3&topUrl=thehackernews.com&bundle=_xpYO19RUGE4M2FsSlV2VXB3aGFUemN4WGkwcmZWSUZ3TW1JWUNhQmROZXJaMncxWmJPa1VYMThDSmpReDBVYVlCRGxSeHY2T09STVlPVmNldU9KWXJPemFsS09GQlJ0S0RwcHFVSHlWY245JTJGZ2NOdSUyRnpYa2hlUklhdHJtTHV3aTJOUUs&cw=1&lsw=1
Requested by
Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=thehackernews.com&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
a30311accf3d51d4b54905d55ec11cd023d20c41d75e23e906fb53d55e67004a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=thehackernews.com&gdpr=0&gdpr_consent=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Thu, 28 Oct 2021 10:09:42 GMT
vary
Accept-Encoding
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
3175
expires
0
ads
googleads.g.doubleclick.net/pagead/ Frame EEA4 		147 KB
34 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&adk=1812271804&adf=3025194257&lmt=1635411984&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782952&bpp=1&bdt=3771&idt=105&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&prev_fmts=300x250&nras=1&correlator=7818631033191&frm=20&pv=1&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=3&uci=a!3&fsb=1&dtd=110
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
c59f31ea8d949ea12098c0be6ce921e4f55b92deba853de946c0e8db2358157b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Thu, 28 Oct 2021 10:09:43 GMT
server
cafe
content-length
34322
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
sodar
pagead2.googlesyndication.com/pagead/ Frame D253 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021102501&jk=3077095890091583&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
pagead2.googlesyndication.com/bg/ Frame F436 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
sffe /
Resource Hash
673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:43:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
185194
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13325
x-xss-protection
0
last-modified
Tue, 19 Oct 2021 13:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Wed, 26 Oct 2022 06:43:09 GMT
rid
match.adsrvr.org/track/ 		109 B
543 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
b104883bf15dee8faff0e9e8d9cc7365c3a428e8515a22d177d9bb990ade196f

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://thehackernews.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Sat, 27 Nov 2021 10:09:43 GMT
sync.html
public.servenobid.com/ Frame 6210 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.213.44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
62e80665b87cd3ba3216099a8d7d8d49631637850117df6526220a25ad64ca02

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

cache-control
max-age=86400
content-type
text/html
content-encoding
br
last-modified
Tue, 19 Oct 2021 23:28:23 GMT
accept-ranges
bytes
etag
"13cd8e143b2f2a8c22cd45d472e451d7"
server
AmazonS3
x-cache
TCP_HIT
x-amz-id-2
0THlCK5MQkuoO+NUXddYdoe4VRRDJ8saXAwUDZUMAK0W32+KPe8rgOExq1Ns+519tC7vpAPp81o=
x-amz-request-id
P7YW8Q0RZM0DTXWZ
x-amz-meta-codebuild-content-sha256
c88dd8a49566eadf403bc97c479681bdd643e735f434ed7fb3d8da4586607f7f
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:228f5c44-f575-4ceb-83e5-299cc499d3b0
x-amz-meta-codebuild-content-md5
d9d771c5e8b997733ee954ff415262ad
x-azure-ref-originshield
0L3F6YQAAAADS7Xjsxj9rT4hITgdcHgIITE9OMjFFREdFMTUwOAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref
053Z6YQAAAAA6sGy1Z4KCSbXPlLY6i1/HUFJHMDFFREdFMDcxMgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date
Thu, 28 Oct 2021 10:09:42 GMT
index.html
cdn.districtm.io/ids/ Frame F0F4 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Origin
access-control-allow-methods
GET, HEAD, POST, OPTIONS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
6a535ec4ab182798-PRG
async_usersync.html
acdn.adnxs.com/dmp/ Frame 7748 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Mon, 25 Oct 2021 05:07:02 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Thu, 28 Oct 2021 10:09:43 GMT
Age
18173
X-Served-By
cache-lga21933-LGA, cache-fra19169-FRA
X-Cache
HIT, HIT
X-Cache-Hits
3, 163904
X-Timer
S1635415783.163222,VS0,VE0
Vary
Accept-Encoding
connectmyusers.php
cdn.connectad.io/ Frame A3A2 		1 KB
745 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.connectad.io/connectmyusers.php?
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.8.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html; charset=UTF-8
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6a535ec4ad5af9da-PRG
content-encoding
gzip
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pd
eu-u.openx.net/w/1.0/ Frame A9ED 		668 B
731 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
ef02e71406ebc56ea9ff0fb60672d22ea0576a6217a2c7f25418e4b5403021b5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.217.1
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html
content-length
419
content-encoding
gzip
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/dmp/ Frame E665 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

Connection
keep-alive
Content-Length
17053
Server
nginx/1.18.0 (Ubuntu)
Content-Type
text/html
Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
W/"5fc7ff8f-cf34"
Expires
Mon, 25 Oct 2021 05:07:02 GMT
Cache-Control
max-age=86402
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Accept-Ranges
bytes
Date
Thu, 28 Oct 2021 10:09:43 GMT
Age
18173
X-Served-By
cache-lga21925-LGA, cache-hhn4073-HHN
X-Cache
HIT, HIT
X-Cache-Hits
217196, 362875
X-Timer
S1635415783.163354,VS0,VE0
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A890 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=18439
expires
Thu, 28 Oct 2021 15:17:02 GMT
date
Thu, 28 Oct 2021 10:09:43 GMT
vary
Accept-Encoding
connectmyusers.php
cdn.connectad.io/ Frame A368 		1 KB
703 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.connectad.io/connectmyusers.php?
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.8.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html; charset=UTF-8
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6a535ec4ad58f9da-PRG
content-encoding
gzip
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
usync.html
eus.rubiconproject.com/ Frame 5915 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-42-132.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40334-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Thu, 28 Oct 2021 10:09:43 GMT
Connection
keep-alive
Vary
Accept-Encoding
index.html
cdn.districtm.io/ids/ Frame 5AE3 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.190.66 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Origin
access-control-allow-methods
GET, HEAD, POST, OPTIONS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
6a535ec4ab1b2798-PRG
pd
eu-u.openx.net/w/1.0/ Frame F1F3 		668 B
719 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Requested by
Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.37020.1631637442652.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
ef02e71406ebc56ea9ff0fb60672d22ea0576a6217a2c7f25418e4b5403021b5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

vary
Accept, Accept-Encoding
server
OXGW/16.217.1
p3p
CP="CUR ADM OUR NOR STA NID"
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html
content-length
419
content-encoding
gzip
via
1.1 google
alt-svc
clear
AVvXsEhFbKcTSfAp-HJewUqAoPVObTFyFMik4KOCbP0o_Mfi60BZ5TmmN-ko9gG7NtXgFA-semHlWU6yH7UuLTh9r_cLlNOuN6Hhuy-QCMercsG9RPjTtLto-Z67rIr4QZWwbQbM41Xy4QKFNgDABOrzjNzre4hvMbJ9pKqNdd5M14dBIK-qfVTF8JvhemW7=w72-...
thehackernews.com/new-images/img/a/ 		944 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thehackernews.com/new-images/img/a/AVvXsEhFbKcTSfAp-HJewUqAoPVObTFyFMik4KOCbP0o_Mfi60BZ5TmmN-ko9gG7NtXgFA-semHlWU6yH7UuLTh9r_cLlNOuN6Hhuy-QCMercsG9RPjTtLto-Z67rIr4QZWwbQbM41Xy4QKFNgDABOrzjNzre4hvMbJ9pKqNdd5M14dBIK-qfVTF8JvhemW7=w72-h72-p-k-no-nu
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.26.1.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64bf067678f8a8675f48a8f3dd20e4b3e352a44a69da1c658efad8fe00aa0710
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/2021/10/hackers-using-squirrelwaffle-loader-to.html?&web_view=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
11335
cf-polished
qual=85, origFmt=jpeg, origSize=1918
x-forwarded-for
217.138.220.201
content-disposition
inline;filename="hacking.jpg"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
944
x-xss-protection
0
expires
Fri, 29 Oct 2021 07:00:48 GMT
cf-bgj
imgq:85,h2pri
server
cloudflare
etag
"v10a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BzgoxCtphgWUHlLtvFQdE3vMfmGr2gVol8V%2FvGT%2FHyNGECeFbPBIeCP3zi9ggLAMdhhT6QqKz0Ncpymg90MXJ%2FaRWzuU%2BI0LsStWErEarAFe0ieXC9Jg5M2QuNOf4gkypoi%2F"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
vary
Accept, Accept-Encoding
cache-control
public, max-age=8640000, immutable, s-maxage=8640000
accept-ranges
bytes
cf-ray
6a535ec4bd162788-PRG
access-control-expose-headers
Content-Length
sd
eu-u.openx.net/w/1.0/ Frame A9ED
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
MT3 4044 0c7f252 master cdg-pixel-x5 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 28 Oct 2021 10:09:42 GMT
sd
us-u.openx.net/w/1.0/ Frame A9ED
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
43 B
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame A9ED
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7513717851230090471
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7513717851230090471
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7513717851230090471
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame A9ED 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=f8049835-3ef5-76d5-ce63-2ef4c8faad73&gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame A9ED 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDQ2YjRiZmYtZjc4Mi0yODcxLWRiODMtNzQ0ZDAyMTg2MzEz
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame A9ED
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame F1F3
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
MT3 4044 0c7f252 master cdg-pixel-x16 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=df86617a-76e7-4500-afd3-42bd134a913f
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 28 Oct 2021 10:09:42 GMT
sd
us-u.openx.net/w/1.0/ Frame F1F3
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=o9i04qLf5rC40La6pdmutPHY4uW42-e2pNqU0dMu
pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame F1F3
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=710460537649607420
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=710460537649607420
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=710460537649607420
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame F1F3 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=f8049835-3ef5-76d5-ce63-2ef4c8faad73&gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame F1F3 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZDQ2YjRiZmYtZjc4Mi0yODcxLWRiODMtNzQ0ZDAyMTg2MzEz
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame F1F3
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=43a9730a-6c22-4066-b849-41c7558b6858&gdpr=0
Protocol
H2
Server
35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.217.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
server
OXGW/16.217.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBj-S44Z9e6MLU5SXtaUG30&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 5915 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-42-132.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ca92d77c2d1c7c39f86a0feab4223131bea068006d0c58a75c9e951132e07731

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Oct 2021 21:13:51 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=39954
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9393
Expires
Thu, 28 Oct 2021 21:15:37 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame A890 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=16733512&p=158261&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
acd85cde473594808e5ee45d46e836b8060fb5f651db09785c72d9f7be63f901

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-type
text/html; charset=UTF-8
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
async_usersync
ib.adnxs.com/ Frame 7748 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.15 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
bd7599ab-2931-46c1-b410-972dcf622e6e
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame E665 		0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.15 , Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
720.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
ba2e5268-c889-41e5-86a2-6fb32305f929
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
1
sync-eu.connectad.io/syncer/ Frame 36F2 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/syncer/1
Requested by
Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.8.174 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://cdn.connectad.io/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
no-cache, private
via
1.1 google
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6a535ec58e69f9da-PRG
13926
g2.gumgum.com/usync/ Frame 6EE7 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1a11226facc83902ade3cf7b9a57bb6864287a59ca459793cf7a3c0ff9943269

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
etag
W/"0f659c56756f0dd9acf268ea1a782bec8"
timing-allow-origin
*
content-encoding
gzip
ps
pixel.33across.com/ Frame 2379 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.173 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip173.208-100-17.static.steadfastdns.net
Software
33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

x-33x-status
2000208
server
33XP005
date
Thu, 28 Oct 2021 10:09:42 GMT
/
onetag-sys.com/usync/ Frame 1AE4 		2 KB
823 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1---&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.38.120.206 , Germany, ASN16276 (OVH, FR),
Reverse DNS
ip206.ip-51-38-120.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

content-type
text/html
cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
strict-transport-security
max-age=15552000
sync
ssbsync.smartadserver.com/api/ Frame 0540 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
2d5a1a5977d4cfb69ad8c5f7d11b967964fba44e4807552b50257e2589d7bbf1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-type
text/html
content-length
1029
usermatch
ssum-sec.casalemedia.com/ Frame 476D 		1 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
467ede4bc51469a8db27267f107f6a5e630a9685acf37e97380125cffb196fcd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/

Response headers

Server
Apache
Content-Type
text/html
Dropped-Udsids
230|241|39|73|40|196|8|111
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary
Is-Traffic-Usersync
Content-Length
1473
Expires
Thu, 28 Oct 2021 10:09:43 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Connection
keep-alive
sync
ads.servenobid.com/ Frame 6210
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
  • https://ads.servenobid.com/sync?pid=312&uid=6101957915685357758
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=312&uid=6101957915685357758
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
cba4991a-07b7-43e1-9370-d82c71c3009c
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ads.servenobid.com/sync?pid=312&uid=6101957915685357758
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
merge
ce.lijit.com/ Frame 6210
Redirect Chain
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
0
577 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Server
63.251.14.3 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2sea1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1---&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2sea1
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
sync
ads.servenobid.com/ Frame 6210
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2218961230
  • https://sync.1rx.io/usersync/tradedesk/c61aa380-6009-44cb-990a-49fd11b2da96
  • https://sync.targeting.unrulymedia.com/csync/RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3DRX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
  • https://ads.servenobid.com/sync?pid=321&uid=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=321&uid=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=321&uid=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
date
Thu, 28 Oct 2021 10:09:43 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXb02f58ab15454718bc4fa03ec5a893a5003
content-type
text/html
101954
jadserve.postrelease.com/suid/ Frame 6210 		43 B
427 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/suid/101954?ntv_r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D322%26uid%3DNTV_USER_ID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.217.216.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-217-216-1.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
durationmedia
cs.admanmedia.com/sync/ Frame 6210 		0
0
sync
ads.servenobid.com/ Frame 6210
Redirect Chain
  • https://p.rfihub.com/cm?pub=44007&in=1
  • https://ads.servenobid.com/sync?pid=324&uid=5123196420252769156
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=324&uid=5123196420252769156
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Location
https://ads.servenobid.com/sync?pid=324&uid=5123196420252769156
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
usa
sync.go.sonobi.com/ Frame 6210 		0
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
sync
ads.servenobid.com/ Frame 6210
Redirect Chain
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1---&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
  • https://ads.servenobid.com/sync?pid=327&uid=124b8dda-45ee-4354-9ba8-33e920a174f9&gdpr=0&gdpr_consent=&us_privacy=1---
0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=327&uid=124b8dda-45ee-4354-9ba8-33e920a174f9&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=327&uid=124b8dda-45ee-4354-9ba8-33e920a174f9&gdpr=0&gdpr_consent=&us_privacy=1---
date
Thu, 28 Oct 2021 10:09:42 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
1
server
envoy
content-length
0
sync
ads.servenobid.com/ Frame 6210
Redirect Chain
  • https://t.adx.opera.com/pub/sync?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D335%26uid%3D
  • https://ads.servenobid.com/sync?operaUid=3a5423448670419f9993bf003e0d0eb6&pid=335&uid=
0
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?operaUid=3a5423448670419f9993bf003e0d0eb6&pid=335&uid=
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
Tengine
access-control-allow-origin
*
access-control-allow-methods
POST, GET
content-type
text/html; charset=utf-8
location
https://ads.servenobid.com/sync?operaUid=3a5423448670419f9993bf003e0d0eb6&pid=335&uid=
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
117
expires
Mon, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021102501&jk=3077095890091583&bg=!XF-lXxvNAAbUs_yW1LM7ACkAdvg8Wgdc258p2pTexCg69daBB8PLoYEtt66Vkf8foOnX2T3J0Dz1VQIAAACpUgAAABVoAQcKACgW8rLUACi3qKz31haOvd295fepfnSlykzKXU_FzcZU5qbJuzej8OjpmQKwErMvaysksPpSPq2JzMuf2S9DYsPuTs4fqu78XP6TmSLkJ5lAioYC9qCrEQHZ8Hj2leG7FGSZVcVcdrIxxBO12IfcW15sPAoqHj5lTVT7n-VuXI_m0XP1W_ryHPcAgbZBP2awjeuPdWpwKDuOV8NWtc9UjCMnExUp28eTNwG0Nh5Kbfv34Es7Uxhx6P0abRyma1IW1jwC98vrC2zGND6xhsmvV4xccph5ihvCf2tIxYRyP6kzQ2sbrEL4Aa5_GnU21xXwWqNPWWaSQVgdaetCMjgFhKvhea-r3QQU-eJC8LoXa0KL23bo0HWWMn2Ab_s8pM0XFEM3RSWosXrSVj23HoRN6tITIaURKqmeDIyqtoD3gGGE0dD0cOfVsNn_oozEIUxWcLG9uL2ie8CJVXlccRur3Mza7NwXt1YhoadbC9bCDtOyCIE46qON6lT6_mlOmCxRVntb4YbEAxE_TG6WncVkbZ_YoK6SxUyWYU6GTZQBEOZQGkiKSzvxnIFUnh5TtG6Df8ZWaZSnpSt-5_uXWrlIF78KReW13GNeNfzfSgsRZubKvRIMjx5Fr-5mEb3TlU0prmAdFKaNXkKUhbukqS2-vbmDA7xfLzmgIQ-5Z8mgSTvnupU3n7SkBtCsukwLBivHV7T3pLqP_WyR77IuppISaykzhEanLjDIntzzeWQ_lvJJgIPmc1I86ZF3j2fleQ9vaWdf9IehmY1nPkFdST0gMc7eA-eUuWdvo6ibBWmbzAHETYSFP54-gHr6yqdzORS5Iuo-61eoITsr6_gxyR1QJOAi_w6DhvO-Hy65tSWxxsWj8mqG3nkTiJyY2pEg_wIi3-twiBYCOMsU1rMI7Wxk4Pkidc6XOSE49Mi1GIWYy4QPp-cz2UaZHgd5g81FC_xYJU33oSF7fyS6YqHFNA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
match
c1.adform.net/serving/cookie/ Frame BDC1 		35 B
467 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?party=14&cid=04058E6D-CF71-44B3-9A35-BA9855CD0606
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
expires
-1
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
strict-transport-security
max-age=31536000; includeSubDomains
Pug
image2.pubmatic.com/AdServer/ Frame 4725
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4074810829502671380
42 B
210 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4074810829502671380
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
lhrpug022:0:441
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4074810829502671380
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
Pug
simage2.pubmatic.com/AdServer/ Frame 44E7
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
42 B
110 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Thu, 28 Oct 2021 10:09:42 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
amspug016:0:379
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

date
Thu, 28 Oct 2021 10:09:42 GMT
server
Kestrel
content-length
0
cache-control
no-cache
pragma
no-cache
expires
Thu, 28 Oct 2021 00:00:00 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1936863
Pug
simage2.pubmatic.com/AdServer/ Frame F29C
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7024057294773483671
42 B
210 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7024057294773483671
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
date
Thu, 28 Oct 2021 10:09:42 GMT
content-type
image/gif; charset=utf-8
content-length
42
x-lat
amspug008:0:532
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-store, no-cache, private

Redirect headers

Server
nginx
Date
Thu, 28 Oct 2021 10:09:43 GMT
Transfer-Encoding
chunked
Connection
keep-alive
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=7024057294773483671
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A890
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
last-modified
Tue, 15 Jun 2021 06:08:03 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3945-5c4c7cc02bd56"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=18439
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5054
expires
Thu, 28 Oct 2021 15:17:02 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=df86617a-76e7-4500-afd3-42bd134a913f
0
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=df86617a-76e7-4500-afd3-42bd134a913f
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
MT3 4044 0c7f252 master cdg-pixel-x28 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=df86617a-76e7-4500-afd3-42bd134a913f
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 28 Oct 2021 10:09:42 GMT
match
ps.eyeota.net/ Frame A890
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=04058E6D-CF71-44B3-9A35-BA9855CD0606
  • https://pixel.onaudience.com/?partner=236&icm&cver&smartmap=1&redirect=ps.eyeota.net%2Fpixel%3Fgdpr%3D%26gdpr_consent%3D%26pid%3D3b2cb90%26t%3Dgif%26uid%3D%25m
  • https://ps.eyeota.net/pixel?gdpr=&gdpr_consent=&pid=3b2cb90&t=gif&uid=a3e93965d57101fd
  • https://ps.eyeota.net/pixel/bounce/?gdpr=&gdpr_consent=&pid=3b2cb90&t=gif&uid=a3e93965d57101fd
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MlBYekdTTDFLY3huVHRzekJIUHkyb1JwV3B0SF9Rb0Q0alVyTGFrcG1tejQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&...
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&dc_mr=5&dc_orig=3b2cb90&referrer_pid=3b2cb90&google_gid=CAESED9oFEax3yvhWm2mpwGMEOk&google_cver=1
  • https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&dc_rc=2&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90
  • https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4353370598078843813&newuser=1&dc_rc=2&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90
  • https://sync.mathtag.com/sync/img?mt_exid=10015&redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3D7vi0rg0%26uid%3D%5BMM_UUID%5D%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3D3b2cb90%26%26referrer_pid%3D3b2cb90
  • https://ps.eyeota.net/match?bid=7vi0rg0&uid=df86617a-76e7-4500-afd3-42bd134a913f&dc_rc=3&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90
  • https://sync-tm.everesttech.net/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D4%26dc_mr%3D5%26dc_orig%3D3b2cb90%26%26referrer_pid%...
  • https://ps.eyeota.net/match?uid=YXp25wAAPk46CQBR&bid=0rijhbu&dc_rc=4&dc_mr=5&dc_orig=3b2cb90&&referrer_pid=3b2cb90
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1
  • https://ps.eyeota.net/match?uid=c61aa380-6009-44cb-990a-49fd11b2da96&bid=1e2n4ou
70 B
440 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?uid=c61aa380-6009-44cb-990a-49fd11b2da96&bid=1e2n4ou
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
3.122.214.165 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-122-214-165.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:44 GMT
Content-Type
image/gif
Content-Length
70
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ps.eyeota.net/match?uid=c61aa380-6009-44cb-990a-49fd11b2da96&bid=1e2n4ou
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
191
Pug
image2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDQwNThFNkQtQ0Y3MS00NEIzLTlBMzUtQkE5ODU1Q0QwNjA2&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug006:0:323
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJD6-cEA0zh7nP9u6XTkaPY&google_cver=1
42 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJD6-cEA0zh7nP9u6XTkaPY&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug001:0:583
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJD6-cEA0zh7nP9u6XTkaPY&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame A890 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.253.128.188 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),
Reverse DNS
bc.80.fd9f.ip4.static.sl-reverse.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Wed, 27 Oct 2021 10:09:43 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
42 B
497 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
no-store, no-cache, private
x-lat
amspug009:0:451
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
MT3 4044 0c7f252 master cdg-pixel-x12 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 28 Oct 2021 10:09:42 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c61aa380-6009-44cb-990a-49fd11b2da96
42 B
447 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c61aa380-6009-44cb-990a-49fd11b2da96
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
cache-control
no-store, no-cache, private
x-lat
amspug014:0:376
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c61aa380-6009-44cb-990a-49fd11b2da96
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
simage2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7513717851230090471
42 B
542 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7513717851230090471
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:41 GMT
cache-control
no-store, no-cache, private
x-lat
amspug013:0:384
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7513717851230090471
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
image2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6101957915685357758&gdpr=0&gdpr_consent=
42 B
211 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6101957915685357758&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug002:0:1125
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 720.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
e56656bf-33a0-42c4-9034-a6bfb22e8729
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=6101957915685357758&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wmKAY8Nl0jHZaoI7xGOaNZBi1mTZYdM3xWB3M66Z
42 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wmKAY8Nl0jHZaoI7xGOaNZBi1mTZYdM3xWB3M66Z
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
no-store, no-cache, private
x-lat
lhrpug003:0:607
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=wmKAY8Nl0jHZaoI7xGOaNZBi1mTZYdM3xWB3M66Z
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame A890
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=04058E6D-CF71-44B3-9A35-BA9855CD0606&redir=true&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=04058E6D-CF71-44B3-9A35-BA9855CD0606&redir=true&gdpr=0&gdpr_consent=&verify=true
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IbCDi6lE2uWoigdbkks3GeCSRKfKPmk-~A&gdpr=0&gdpr_consent=
0
48 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IbCDi6lE2uWoigdbkks3GeCSRKfKPmk-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Server
198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
ATS/7.1.2.138
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-IbCDi6lE2uWoigdbkks3GeCSRKfKPmk-~A&gdpr=0&gdpr_consent=
Connection
keep-alive
Content-Length
0
usermatchredir
ssum-sec.casalemedia.com/ Frame 476D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&gdpr_consent=&us_privacy=&gdpr=1
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Thu, 28 Oct 2021 10:09:43 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
343
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 476D
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXp25awCrY8zEsUSftc4LwAABFMAAAIB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
1CV106WM3PCH52E72Y6H
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
G3FX24NPNSADXB846A0W
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 476D 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
YXp25awCrY8zEsUSftc4LwAABFMAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 476D 		43 B
869 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/YXp25awCrY8zEsUSftc4LwAABFMAAAIB?gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.244.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-244-74.eu-west-1.compute.amazonaws.com
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
crum
dsum-sec.casalemedia.com/ Frame 476D
Redirect Chain
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Thu, 28 Oct 2021 10:09:43 GMT

Redirect headers

date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx
access-control-allow-origin
*
transfer-encoding
chunked
access-control-allow-methods
POST, GET, OPTIONS
p3p
CP="NOI DEV OUR BUS UNI"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control
no-cache
content-type
text/html; charset=UTF-8
access-control-allow-headers
Origin
keep-alive
timeout=10
crum
dsum-sec.casalemedia.com/ Frame 476D
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/ix.gif
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=6eb9fbbf-9547-4c55-b9c0-30604e7ad833&expiration=1666951783
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=6eb9fbbf-9547-4c55-b9c0-30604e7ad833&expiration=1666951783
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
HTTP/1.1
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 28 Oct 2021 10:09:43 GMT

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=6eb9fbbf-9547-4c55-b9c0-30604e7ad833&expiration=1666951783
date
Thu, 28 Oct 2021 10:09:43 GMT
server
Kestrel
content-length
0
match
c1.adform.net/serving/cookie/ Frame 476D 		0
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c1.adform.net/serving/cookie/match?party=29&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
sync
ads.servenobid.com/ Frame 476D 		0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=333&uid=YXp25awCrY8zEsUSftc4LwAABFMAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
cs&eq_cc=1
um2.eqads.com/um/ Frame 9AE4
Redirect Chain
  • https://um2.eqads.com/um/cs
  • https://um2.eqads.com/um/cs&eq_cc=1
186 B
370 B 		Document
General
Check archive.org
Download Go to
Full URL
https://um2.eqads.com/um/cs&eq_cc=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.213.10.151 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-213-10-151.compute-1.amazonaws.com
Software
/
Resource Hash
9b19294685dfc3568f9e0ba438b00db567a2589495f7f128059a33877aa41ff7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html; charset=utf-8
content-length
186
cache-control
no-cache, must-revalidate
expires
Sat, 6 May 1995 12:00:00 GMT
last-modified
Thu, 28 Oct 2021 10:09:43 GMT
pragma
no-cache

Redirect headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html; charset=utf-8
content-length
41
location
/um/cs&eq_cc=1
sync
ads.servenobid.com/ Frame 0540 		0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=317&uid=780945751829422425&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
sync
ssbsync.smartadserver.com/api/ Frame 0540
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D86%26buid%3D$UID&gdpr=0&gdpr_consent=
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=86&buid=6101957915685357758&gdpr=0&gdpr_consent=
0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=86&buid=6101957915685357758&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
0

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
8267f106-c55d-4209-a272-18052ee542f7
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=86&buid=6101957915685357758&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ssbsync.smartadserver.com/api/ Frame 0540
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?gdpr=0&gdpr_consent=&nid=64&redir=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D68%26...
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&gdpr=0&gdpr_consent=&nid=64&redir=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partner...
  • https://loadm.exelator.com/load/?p=204&g=700&j=r&buid=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553&ru=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_i...
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553&partner_url=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcaller...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553&partner_url=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3F...
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=68&partneruserid=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553
1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=68&partneruserid=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-length
1029
content-type
text/html

Redirect headers

location
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=68&partneruserid=cd67fb8b-2107-40d6-9b9b-7e53ba171b4e-617a76e7-5553
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 google
alt-svc
clear
content-length
0
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sync
ssbsync.smartadserver.com/api/ Frame 0540
Redirect Chain
  • https://sync.mathtag.com/sync/img?gdpr=0&gdpr_consent=&mt_exid=39&redir=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D25%26partnerus...
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=25&partneruserid=df86617a-76e7-4500-afd3-42bd134a913f
1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=25&partneruserid=df86617a-76e7-4500-afd3-42bd134a913f
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
1029
content-type
text/html

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
MT3 4044 0c7f252 master cdg-pixel-x27 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=25&partneruserid=df86617a-76e7-4500-afd3-42bd134a913f
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 28 Oct 2021 10:09:42 GMT
sync
ssbsync.smartadserver.com/api/ Frame 0540
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?gdpr=0&gdpr_consent=&party=10&sspurl=https%3A%2F%2Fssbsync.smartadserver.com%2Fapi%2Fsync%3Fcallerid%3D9%26gdpr%3D0%26gdpr_consent%3D%26partnerid%3D22%26b...
  • https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=22&buid=7513717851230090471&gdpr=0&gdpr_consent=
0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=22&buid=7513717851230090471&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1---&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
0

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
nginx
location
https://ssbsync.smartadserver.com/api/sync?callerid=9&gdpr=0&gdpr_consent=&partnerid=22&buid=7513717851230090471&gdpr=0&gdpr_consent=
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
10103269202872240163
tpc.googlesyndication.com/simgad/ Frame 78B0 		39 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/10103269202872240163?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkZDIWUVdVuObdSdmwTh8610RVhuA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
sffe /
Resource Hash
eefd49ea99f443961949941d4ea636be5ec755f09ac983d1a2cf4b775c4fc27e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 07:43:41 GMT
x-content-type-options
nosniff
age
8762
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
40335
x-xss-protection
0
last-modified
Mon, 06 Sep 2021 11:10:30 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Fri, 28 Oct 2022 07:43:41 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/ Frame 78B0 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 09:46:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1373
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7700
x-xss-protection
0
server
cafe
etag
14378044041589781240
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 09:46:50 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 78B0 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
349
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:54 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 78B0 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
345
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
6286
x-xss-protection
0
server
cafe
etag
17196531676875957370
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:58 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 78B0 		120 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
sffe /
Resource Hash
eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37344
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1635161763799786"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 28 Oct 2021 10:09:43 GMT
one_click_handler_one_afma_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 78B0 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/one_click_handler_one_afma_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
742932c0bf5cb01d0a7336c0841c46734b514a4a8cb3840a21f297d1194fd1df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 16:25:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
63852
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
11248
x-xss-protection
0
server
cafe
etag
2547035740638252473
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 10 Nov 2021 16:25:31 GMT
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
  • https://rtb.gumgum.com/usersync?b=apn&i=6101957915685357758
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=apn&i=6101957915685357758
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
X-Proxy-Origin
216.131.114.55; 216.131.114.55; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
5fc6ca60-f7b2-447c-b3ef-7daf65aaa3bc
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb.gumgum.com/usersync?b=apn&i=6101957915685357758
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_80a2292c-c481-4836-aead-31c84085c438&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_80a2292c-c481-4836-aead-31c84085c438&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=958165c3-7dfc-4cfe-9d4c-54c577851884&ssp=gumgum2
  • https://rtb.gumgum.com/usersync?b=bsw&i=b6081b06-acf6-48af-b02e-5f0275f032d3
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=bsw&i=b6081b06-acf6-48af-b02e-5f0275f032d3
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
//rtb.gumgum.com/usersync?b=bsw&i=b6081b06-acf6-48af-b02e-5f0275f032d3
Date
Thu, 28 Oct 2021 10:09:43 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=sta&i=0-34513d64-ebd6-423a-4672-cea26625d739$ip$216.131.114.55
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sta&i=0-34513d64-ebd6-423a-4672-cea26625d739$ip$216.131.114.55
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=sta&i=0-34513d64-ebd6-423a-4672-cea26625d739$ip$216.131.114.55
Date
Thu, 28 Oct 2021 10:09:43 GMT
Connection
keep-alive
Content-Length
123
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_80a2292c-c481-4836-aead-31c84085c438&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=Dw2wLerKc6751uY7dBU9&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2RDXGJ3UYZLSJNRTMNZVGF2VSN3EIJKTSJTVONPXA...
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Dw2wLerKc6751uY7dBU9&us_privacy=1---
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Dw2wLerKc6751uY7dBU9&us_privacy=1---
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:44 GMT
P3p
CP="We do not support P3P header."
Location
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Dw2wLerKc6751uY7dBU9&us_privacy=1---
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
118
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003&rndcb=3544070152
  • https://x.bidswitch.net/ul_cb/sync?ssp=adconductor&user_id=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003&rndcb=3544070152
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=b6081b06-acf6-48af-b02e-5f0275f032d3&google_hm=YjYwODFiMDYtYWNmNi00OGFmLWIwMmUtNWYwMjc1ZjAz...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEAtOP7uxTfrX4_96-olG75c&google_cver=1&ssp=adconductor&bsw_param=b6081b06-acf6-48af-b02e-5f0275f032d3
  • https://sync.1rx.io/usersync/bidswitch/b6081b06-acf6-48af-b02e-5f0275f032d3?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
  • https://rtb.gumgum.com/usersync?b=rhy&i=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=rhy&i=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=rhy&i=RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
date
Thu, 28 Oct 2021 10:09:43 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXb02f58ab15454718bc4fa03ec5a893a5003
content-type
text/html
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://rtb.gumgum.com/usersync?b=pln&i=HBFVgHlLLKdY&ev=1&pid=558355
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=pln&i=HBFVgHlLLKdY&ev=1&pid=558355
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
de-DE
location
https://rtb.gumgum.com/usersync?b=pln&i=HBFVgHlLLKdY&ev=1&pid=558355
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6c44d49bd7-277wd
expires
-1
cookiesyncredir
bttrack.com/Pixel/ Frame 6EE7
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28xLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_80a2292c-c481-4836-aead-31c84085c438&obuid=ENC(xLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE)
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
  • https://bttrack.com/Pixel/cookiesyncredir?rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dbidtellect%26uid%3D%7Bglobalid%7D%26obUid%3DxLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-...
35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/Pixel/cookiesyncredir?rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dbidtellect%26uid%3D%7Bglobalid%7D%26obUid%3DxLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Server
192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
46.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

X-ServerName
Track004-dc3
Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:25 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1

Redirect headers

Location
https://bttrack.com/Pixel/cookiesyncredir?rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dbidtellect%26uid%3D%7Bglobalid%7D%26obUid%3DxLbYWRvoDsTsE-MJpSIUgEeyeE18AMbaRgdXOjtLv5gMzwlrv7dGv-NJfE83uIpE
Date
Thu, 28 Oct 2021 10:09:44 GMT
X-TraceId
0107673db18d6581e9143177f7865aa5
Content-Length
0
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://rtb.gumgum.com/usersync?b=opx&i=0f393c45-16e0-4e83-a918-3e1900aaac35
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=opx&i=0f393c45-16e0-4e83-a918-3e1900aaac35
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
server
OXGW/16.217.1
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://rtb.gumgum.com/usersync?b=opx&i=0f393c45-16e0-4e83-a918-3e1900aaac35
content-type
image/gif
alt-svc
clear
content-length
0
via
1.1 google
gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 6EE7 		43 B
322 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.244.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-244-74.eu-west-1.compute.amazonaws.com
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
  • https://rtb.gumgum.com/usersync?b=vnt&i=2c07d654-37d7-11ec-9d14-fb2c7a265914
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=vnt&i=2c07d654-37d7-11ec-9d14-fb2c7a265914
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=vnt&i=2c07d654-37d7-11ec-9d14-fb2c7a265914
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
2c07d655-37d7-11ec-9d14-fb2c7a265914
services
sync.technoratimedia.com/ Frame 6EE7 		0
293 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
132.226.41.106 Amsterdam, Netherlands, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
794985024
access-control-allow-origin
https://g2.gumgum.com/
access-control-allow-credentials
true
142
match.deepintent.com/usersync/ Frame 6EE7 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 Albuquerque, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
0
server
b
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://rtb.gumgum.com/usersync?b=idi&i=050f484d-9723-4829-a4bc-9b176d08feca
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=idi&i=050f484d-9723-4829-a4bc-9b176d08feca
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=idi&i=050f484d-9723-4829-a4bc-9b176d08feca
date
Thu, 28 Oct 2021 10:09:43 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
usersync
rtb.gumgum.com/ Frame 6EE7
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=15
  • https://rtb.gumgum.com/usersync?b=sad&i=780945751829422425&gdpr=1&gdpr_consent=
35 B
237 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sad&i=780945751829422425&gdpr=1&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

location
https://rtb.gumgum.com/usersync?b=sad&i=780945751829422425&gdpr=1&gdpr_consent=
date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
0
sync
ads.servenobid.com/ Frame 6EE7 		0
357 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=309&uid=e_80a2292c-c481-4836-aead-31c84085c438
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.228.75.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-228-75-94.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
adview
googleads.g.doubleclick.net/pagead/ Frame 78B0 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=Czmyc53Z6YbSKBNCT3gPnr52ACaa9mKxloaKdzM8OkI-o-GcQASDn--UbYMmGgIDwo-wSoAHuodOVA8gBAqkC8kQSFLtAfz6oAwHIA8kEqgT8AU_Q1LRjIg0aP7R_HHbbVY8-sLt5wrb_F_az9oiG5fDYpZUmYxnvDMjVsm-kdVBEsz27DO0eYnph5T9llguXqSl2E7Thlg8wFvHTBIUl8_ys7LCi70JJdVmocF86h8z2QcQ9OfaBbd1sH79WxRnxXpPhCAAAMWGVG_bUfVIIsSoS0sdvACLpHsvOnZfcbd5xWGn6hSUkLU6kaj80Gy_BxLVWp2hV9govOAJpth-4jHw4S0E8rUSvaxoEyarjmzEuKOmAGrtYCXRYacWezF7cVTO9C9KLweSPTY6hnxXsBvEpKPkFgYAddoisTCPoNBhg4NUyzpyzeGrLTiVT-sAEitzLyt4DkgUECAQYAZIFBAgFGASgBgKAB_rdrGqoB_DZG6gH8tkbqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwUQ-LbIAtIIBwiAYRABGF-ACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItNzk4Mzc4MzA0ODIzOTY1MBgA&sigh=lMfDKCR_OKg&uach_m=[UACH]
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Thu, 28 Oct 2021 10:09:43 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E321 		14 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

last-modified
Tue, 15 Jun 2021 06:08:03 GMT
etag
"1300708-3945-5c4c7cc02bd56"
server
Apache/2.2.15 (CentOS)
accept-ranges
bytes
content-encoding
gzip
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
5054
content-type
text/html; charset=UTF-8
cache-control
max-age=18439
expires
Thu, 28 Oct 2021 15:17:02 GMT
date
Thu, 28 Oct 2021 10:09:43 GMT
vary
Accept-Encoding
usersync
rtb.gumgum.com/ Frame EC09
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=ttd&i=c61aa380-6009-44cb-990a-49fd11b2da96&t=1638007783
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=ttd&i=c61aa380-6009-44cb-990a-49fd11b2da96&t=1638007783
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
text/html
content-length
209
location
https://rtb.gumgum.com/usersync?b=ttd&i=c61aa380-6009-44cb-990a-49fd11b2da96&t=1638007783
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
usync.html
eus.rubiconproject.com/ Frame 71AF
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-42-132.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

Server
Apache/2.2.15 (CentOS)
Last-Modified
Tue, 26 Oct 2021 17:01:05 GMT
ETag
"40334-119-5cf446c48f640"
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Thu, 28 Oct 2021 10:09:43 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://eus.rubiconproject.com/usync.html?p=gumgum
Date
Thu, 28 Oct 2021 10:09:43 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
usersync
rtb.gumgum.com/ Frame 4F10
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://rtb.gumgum.com/usersync?b=mmh&i=df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=mmh&i=df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Content-Type
image/gif
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=360
Server
MT3 4044 0c7f252 master cdg-pixel-x3 config:1.0.0
Cache-Control
no-cache
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://rtb.gumgum.com/usersync?b=mmh&i=df86617a-76e7-4500-afd3-42bd134a913f&gdpr=0&gdpr_consent=
Expires
Thu, 28 Oct 2021 10:09:42 GMT
usersync
rtb.gumgum.com/ Frame 49AB
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR
  • https://rtb.gumgum.com/usersync?b=atm&i=YXp25wAAPk46CQBR&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=atm&i=YXp25wAAPk46CQBR&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

server
Varnish
retry-after
0
location
https://rtb.gumgum.com/usersync?b=atm&i=YXp25wAAPk46CQBR&gdpr=0&gdpr_consent=&_test=YXp25wAAPk46CQBR
accept-ranges
bytes
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 varnish
x-served-by
cache-hhn4054-HHN
x-cache
HIT
x-cache-hits
0
x-timer
S1635415784.557475,VS0,VE0
cache-control
no-cache
pragma
no-cache
content-length
0
pixel
cm.g.doubleclick.net/ Frame 54B4 		170 B
188 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV84MGEyMjkyYy1jNDgxLTQ4MzYtYWVhZC0zMWM4NDA4NWM0Mzg=&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
image/png
date
Thu, 28 Oct 2021 10:09:43 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
server
HTTP server (unknown)
content-length
170
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
ssc-cms.33across.com/ps/ Frame 54EC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.100.17.173 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip173.208-100-17.static.steadfastdns.net
Software
33XP001 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

x-33x-status
2000208
server
33XP001
date
Thu, 28 Oct 2021 10:09:43 GMT
um
cs.emxdgt.com/ Frame 94AB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

content-type
text/html
date
Thu, 28 Oct 2021 10:09:42 GMT
content-length
0
usersync
rtb.gumgum.com/ Frame 0A38
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://rtb.gumgum.com/usersync?b=sus&i=YXp26MCo5swAAAevNSoAAAAA
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=sus&i=YXp26MCo5swAAAevNSoAAAAA
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 28 Oct 2021 10:09:44 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Server
nginx
Date
Thu, 28 Oct 2021 10:09:44 GMT
Content-Length
0
Connection
keep-alive
Cache-Control
private
Location
https://rtb.gumgum.com/usersync?b=sus&i=YXp26MCo5swAAAevNSoAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time
2
X-SO-HostName
a-ad40146.dc2p.scaleout.jp
X-SO-LB-Hostname
a-tgng40008.dc2p.scaleout.jp
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":24,"gdpr":true,"ipv4":"0.0.0.0","key":"YXp26MCo5swAAAevNSoAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40146"}
X-SO-Key
YXp26MCo5swAAAevNSoAAAAA
X-SO-IP
216.131.114.55
X-SO-Cluster-ID
24
X-SO-Upstream-ID
a-ad40146
usersync
rtb.gumgum.com/ Frame 230E
Redirect Chain
  • https://p.rfihub.com/cm?pub=42796&in=1
  • https://rtb.gumgum.com/usersync?b=zet&i=5123196420252769156
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=zet&i=5123196420252769156
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://rtb.gumgum.com/usersync?b=zet&i=5123196420252769156
Content-Length
0
Server
Jetty(9.3.29.v20201019)
usersync
rtb.gumgum.com/ Frame 9630
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://rtb.gumgum.com/usersync?b=rth&i=abyVPsSZ9Dstatw9ER1x&pi=gumgum&tc=1
35 B
237 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=rth&i=abyVPsSZ9Dstatw9ER1x&pi=gumgum&tc=1
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.194.104.251 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-194-104-251.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-type
image/gif;charset=UTF-8
content-length
35
server
nginx
p3p
CP="This is not a P3P policy"
cache-control
private, no-store, must-revalidate, max-age=0
expires
0
pragma
no-cache
timing-allow-origin
*

Redirect headers

date
Thu, 28 Oct 2021 10:09:43 GMT Thu, 28 Oct 2021 10:09:43 GMT
location
https://rtb.gumgum.com/usersync?b=rth&i=abyVPsSZ9Dstatw9ER1x&pi=gumgum&tc=1
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
event.png
tps11046.doubleverify.com/ Frame 4A96 		67 B
419 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tps11046.doubleverify.com/event.png?impid=9591605df6cd493a8d1cd334c6ef1638&gdpr=&gdpr_consent=&msrcanlm=714&msrcannum=7&eoid=12&ismms=36&isumms=35&isvelg=1&nvr=6&elmtp=6&isbxdms=2636&b11=2720&adhgt=250&adwdth=300&norwdth=300&norhgt=250&engisel=1&vsos=4&dvp_vsosnmr=16&dvp_mvpw=device-width&dvp_mvpis=1&lftb=2720&sftb=2720&msrdp=12&naral=192&vct=1&vphgt=1200&vpwdth=1600&scrhgt=1200&scrwdth=1600&strp=100&advisonl=true&isiabvms=936&isuiabvms=936&ispmxpms=936&engalms=34&engscrlms=39&dvp_hdnAd=0&dvp_pageEng=true&dvp_dpr=1&cbust=1635415783430787
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements1800.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.109.138 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS
Software
/
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

Referer
https://thehackernews.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
image/png
Access-Control-Allow-Origin
https://thehackernews.com
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Content-Length
98
Expires
10/27/2021 10:09:43 AM
s
googleads.g.doubleclick.net/pagead/drt/ Frame 1F48 		143 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Thu, 28 Oct 2021 09:37:38 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1925
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 2215 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 28 Oct 2021 08:58:57 GMT
expires
Fri, 29 Oct 2021 08:58:57 GMT
content-type
text/html; charset=ISO-8859-1
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
4246
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
truncated
/ Frame 78B0 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7c7164a751058bf19b539ffd64d2225afc1a9baaf05bfc208ad7fdc97831c674

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
usync.js
eus.rubiconproject.com/ Frame 71AF 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.42.132 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-42-132.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
ca92d77c2d1c7c39f86a0feab4223131bea068006d0c58a75c9e951132e07731

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 27 Oct 2021 21:13:51 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=39954
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9393
Expires
Thu, 28 Oct 2021 21:15:37 GMT
pixel
cm.g.doubleclick.net/ Frame 2215
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBi2RdcJEVxUFz0x2eqV6M8&google_cver=1&google_push=AYg5qPKc4hdNkx9g68neWInyhPPM3_plDT96j48MirzI9rG53GksrUEkPA...
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKc4hdNkx9g68neWInyhPPM3_plDT96j48MirzI9rG53GksrUEkPAYro3nj-hahtf4eXft3ZQEGwq67p4Vxpa8_r47Z9ncH&google_hm=jcB7qP...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKc4hdNkx9g68neWInyhPPM3_plDT96j48MirzI9rG53GksrUEkPAYro3nj-hahtf4eXft3ZQEGwq67p4Vxpa8_r47Z9ncH&google_hm=jcB7qPKO3LvRJQnVav0KOw
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKc4hdNkx9g68neWInyhPPM3_plDT96j48MirzI9rG53GksrUEkPAYro3nj-hahtf4eXft3ZQEGwq67p4Vxpa8_r47Z9ncH&google_hm=jcB7qPKO3LvRJQnVav0KOw
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 2215
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI8Ba6OSu36_QkWFWhtJVGSk1zo2DWP50uv-arDkCUp5N7xQiw1b_f_OJs1ljAtrHlibN69gq5QdDVmUZMPQAWT4IOwBbU
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI8Ba6OSu36_QkWFWhtJVGSk1zo2DWP50uv-arDkCUp5N7xQiw1b_f_OJs1ljAtrHlibN69gq5QdDVmUZMPQAWT4IOwBbU
date
Thu, 28 Oct 2021 10:09:43 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 2215
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK5f2EKNMAqWA_5I_dzC8Zs&google_cver=1&google_push=AYg5qPKspewi3UHvxMAhkQxbhL0ABciy6KH_ti4_KBgiZEkvrjcvmEooBqLYlxaD_Hl-9kpqGeO...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPKspewi3UHvxMAhkQxbhL0ABciy6KH_ti4_KBgiZEkvrjcvmEooBqLYlxaD_Hl-9kpqGeOqtMMMGRwcgf4rmkGEeRroDSMr
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPKspewi3UHvxMAhkQxbhL0ABciy6KH_ti4_KBgiZEkvrjcvmEooBqLYlxaD_Hl-9kpqGeOqtMMMGRwcgf4rmkGEeRroDSMr
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPKspewi3UHvxMAhkQxbhL0ABciy6KH_ti4_KBgiZEkvrjcvmEooBqLYlxaD_Hl-9kpqGeOqtMMMGRwcgf4rmkGEeRroDSMr
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
dbbc2dbf689859fb5870b364473d5441
Expires
0
pixel
cm.g.doubleclick.net/ Frame 2215
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame 2215 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KwWSTr1RRiprGrXAze3NmrFVtX6HUJ7reAbuyuRpweaDtZ4C_a
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
si
googleads.g.doubleclick.net/pagead/drt/ Frame 1F48
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Thu, 28 Oct 2021 10:09:43 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Thu, 28 Oct 2021 10:09:43 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
pagead2.googlesyndication.com/bg/ Frame E81C 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-7983783048239650&output=html&h=250&slotname=4149586040&adk=2569898456&adf=3546401298&pi=t.ma~as.4149586040&w=300&fwrn=4&fwrnh=100&lmt=1635411984&rafmt=3&psa=0&format=300x250&url=https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue&flash=0&fwr=0&rh=250&rw=300&rpe=1&resp_fmts=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635415782933&bpp=5&bdt=3752&idt=96&shv=r20211026&mjsv=m202110210101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D164db623a43b7ff9%3AT%3D1635415781%3AS%3DALNI_MZBhA_uponcwABZ-6kgyxfDZrDWrA&correlator=7818631033191&frm=20&pv=2&ga_vid=466266947.1635415781&ga_sid=1635415781&ga_hid=1455813882&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=1031&ady=749&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062945%2C31063261%2C31063301%2C31063306&oid=2&pvsid=3077095890091583&pem=722&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=HKEqdETLko&p=https%3A//thehackernews.com&dtd=110
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
sffe /
Resource Hash
673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Tue, 26 Oct 2021 06:43:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
185194
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
13325
x-xss-protection
0
last-modified
Tue, 19 Oct 2021 13:08:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="botguard-scs"
expires
Wed, 26 Oct 2022 06:43:09 GMT
ca
choices.trustarc.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_144332637_292494536&js=st_1pm&sz=300x250&c=te-6fe1
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_144332637_292494536&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-109.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
73b4981ae8baf268db12da6ce1b0af45f733ba5056e46d089609a56f772fd018

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
server
nginx
x-amz-cf-pop
FRA50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
2289
x-amz-cf-id
mDP2XyQHfhnxhDghn3ySWpLwb66WQkEYigDu9AGRD3svOjovEL34NQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=att_hs&pid=att01&cid=24935727_144332637_292494536&js=st_2
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=att01&aid=att_hs&cid=24935727_144332637_292494536&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-109.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
content-encoding
gzip
server
nginx
x-amz-cf-pop
FRA50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
via
1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-id
90jC3OAaMCeRT0wDpMjAQyQR2zkJYMhCA2WeFB1N5NAkgVeUHi9FdA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ 		43 B
384 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=att_hs&pid=att01&cid=24935727_144332637_292494536&w=300&h=250&c=c8ce
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-109.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
x-amz-cf-id
I6MGLAKwX3HtJbL0UvOhHm-MqCmkLyRJzx3TAtnWcCP_LaP_8NKZhw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 9AE4 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=40&external_user_id=22e926d2-1eb6-4188-b45f-2dadf2835f8e&expiration=1643364583
Requested by
Host: um2.eqads.com
URL: https://um2.eqads.com/um/cs&eq_cc=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://um2.eqads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 28 Oct 2021 10:09:43 GMT
reactive_library_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/ 		143 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/reactive_library_fy2019.js?bust=31063261
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
64f6144c806861d21d81a5f8baa789fde29083d36845329bf192d83c30b2b0dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
52721
x-xss-protection
0
server
cafe
etag
11170126466841849592
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Thu, 28 Oct 2021 10:09:43 GMT
activeview
pagead2.googlesyndication.com/pcs/ 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuVUpBug87e0bWdbXSjM2d8uiyj71_15Y02aZadNBRyehv72iwmR7jgvXeQOk-imXWLdnHeR6nkns0RuF9uzms&sig=Cg0ArKJSzNEveA4HLgGHEAE&id=lidar2&mcvt=1000&p=471,1031,721,1331&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211025&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=473486474&rs=6&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635415778528&rpt=4304&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=thehackernews.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f2.1e100.net
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/ Frame 184F 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110210101/show_ads_impl_fy2019.js?bust=31063261
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://thehackernews.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Wed, 27 Oct 2021 16:35:41 GMT
expires
Wed, 10 Nov 2021 16:35:41 GMT
content-type
text/html; charset=UTF-8
etag
15765991816257340444
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4703
x-xss-protection
0
age
63242
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
v1
ads.yahoo.com/cms/ Frame 5915
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVASBWK7-15-G28O&sigv=1&esig=2~7f65fa427baa7f6cb36831cc6c0edc64867edf88
0
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVASBWK7-15-G28O&sigv=1&esig=2~7f65fa427baa7f6cb36831cc6c0edc64867edf88
Protocol
H2
Server
87.248.118.22 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
e1.ycpi.vip.deb.yahoo.com
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:44 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KVASBWK7-15-G28O&sigv=1&esig=2~7f65fa427baa7f6cb36831cc6c0edc64867edf88
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5daa34953a867809056448757b76591b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 5915
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
  • https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXp25wAAPk46CQBR
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXp25wAAPk46CQBR
Protocol
HTTP/1.1
Server
8.39.36.141 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbbc2dbf689859fb5870b364473d5441
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
via
1.1 varnish
server
Varnish
x-timer
S1635415784.879620,VS0,VE0
x-served-by
cache-hhn4054-HHN
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YXp25wAAPk46CQBR
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
tap.php
pixel.rubiconproject.com/ Frame 5915
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
  • https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=df86617a-76e7-4500-afd3-42bd134a913f&expires=28
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=df86617a-76e7-4500-afd3-42bd134a913f&expires=28
Protocol
HTTP/1.1
Server
8.39.36.141 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbbc2dbf689859fb5870b364473d5441
Content-Type
image/gif

Redirect headers

Date
Thu, 28 Oct 2021 10:09:43 GMT
Server
MT3 4044 0c7f252 master cdg-pixel-x14 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=df86617a-76e7-4500-afd3-42bd134a913f&expires=28
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Thu, 28 Oct 2021 10:09:42 GMT
709414.gif
id.rlcdn.com/ Frame 5915 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
tap.php
pixel.rubiconproject.com/ Frame 5915
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPwurVHy1okfjmcr4Z82enc&google_cver=1
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPwurVHy1okfjmcr4Z82enc&google_cver=1
Protocol
HTTP/1.1
Server
8.39.36.141 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbbc2dbf689859fb5870b364473d5441
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPwurVHy1okfjmcr4Z82enc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 5915
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5daa34953a867809056448757b76591b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
rubicon
match.adsrvr.org/track/cmf/ Frame 5915 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:43 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 5915
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWZlNmM5ZTAzMzhjODAzMzc2YmJjZDc5NWY1YmM0NGE4NWIxMDViMg
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWZlNmM5ZTAzMzhjODAzMzc2YmJjZDc5NWY1YmM0NGE4NWIxMDViMg
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWZlNmM5ZTAzMzhjODAzMzc2YmJjZDc5NWY1YmM0NGE4NWIxMDViMg
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
5daa34953a867809056448757b76591b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
css2
fonts.googleapis.com/ Frame 184F 		4 KB
635 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.170 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f10.1e100.net
Software
ESF /
Resource Hash
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 09:47:10 GMT
server
ESF
date
Thu, 28 Oct 2021 10:09:43 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires
Thu, 28 Oct 2021 10:09:43 GMT
feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 184F 		205 B
743 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.195 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f3.1e100.net
Software
sffe /
Resource Hash
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 27 Oct 2021 20:44:32 GMT
x-content-type-options
nosniff
age
48311
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 27 Oct 2022 20:44:32 GMT
settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 184F 		604 B
696 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.195 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f3.1e100.net
Software
sffe /
Resource Hash
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 24 Oct 2021 16:08:40 GMT
x-content-type-options
nosniff
age
324063
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
604
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Mon, 24 Oct 2022 16:08:40 GMT
interstitial_ad_frame_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/ Frame 184F 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/elements/html/interstitial_ad_frame_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
d39f8ffc0e3917e02c8b37ae4ab17e6ce426b7dbc5c9d1add33bdb84e64eda28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
362
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7942
x-xss-protection
0
server
cafe
etag
8532613868780843553
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:41 GMT
css
fonts.googleapis.com/ Frame 7862 		3 KB
580 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.170 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f10.1e100.net
Software
ESF /
Resource Hash
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 08:55:21 GMT
server
ESF
date
Thu, 28 Oct 2021 10:09:43 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires
Thu, 28 Oct 2021 10:09:43 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 7862 		2 KB
914 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:00:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
553
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
885
x-xss-protection
0
server
cafe
etag
638833322182864030
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:00:30 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/ Frame 7862 		18 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 09:46:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1373
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7700
x-xss-protection
0
server
cafe
etag
14378044041589781240
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 09:46:50 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 7862 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
349
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1426
x-xss-protection
0
server
cafe
etag
18061233391346882222
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:54 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/ Frame 7862 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20211026/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f1.1e100.net
Software
cafe /
Resource Hash
2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:03:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
345
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
6286
x-xss-protection
0
server
cafe
etag
17196531676875957370
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 11 Nov 2021 10:03:58 GMT
l
www.google.com/ads/measurement/ Frame 7862 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSq9CjjBgOIplsL7hGD1VTG3xissyFDe_o7G4gSek9fjZUsbkMjY1dp7nMGjA7QeUHd6w58XwXgYfewMJRBgC4bF2dcrg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7862 		120 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f2.1e100.net
Software
sffe /
Resource Hash
eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37344
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1635161763799786"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 28 Oct 2021 10:09:43 GMT
9a3fbb06dccc6bd708ce8a7c18eecc3a.js
www.gstatic.com/mysidia/ Frame 7862 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/mysidia/9a3fbb06dccc6bd708ce8a7c18eecc3a.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.195 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f3.1e100.net
Software
sffe /
Resource Hash
dfb5f646e583b7f7566b512d01ad4fe7a8bb81b83d8225cb31efe8375c1aa7ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 09:36:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1988
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11281
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 10:17:29 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="mysidia"
expires
Wed, 26 Jan 2022 09:36:35 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 8228 		143 B
163 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Thu, 28 Oct 2021 09:37:38 GMT
server
cafe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1925
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame E39D 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 28 Oct 2021 08:58:57 GMT
expires
Fri, 29 Oct 2021 08:58:57 GMT
content-type
text/html; charset=ISO-8859-1
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
4246
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
pixel
cm.g.doubleclick.net/ Frame E39D
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBi2RdcJEVxUFz0x2eqV6M8&google_cver=1&google_push=AYg5qPI9RgsBikrgtm-v9YGUMUWIBQcqhGeERP973O5AczhWHGDn0SdKnj...
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI9RgsBikrgtm-v9YGUMUWIBQcqhGeERP973O5AczhWHGDn0SdKnj-L6Io9jQ5-i6qlMLcmwDOcipfgqsUD5gHI51h51rM&google_hm=jcB7qPK...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI9RgsBikrgtm-v9YGUMUWIBQcqhGeERP973O5AczhWHGDn0SdKnj-L6Io9jQ5-i6qlMLcmwDOcipfgqsUD5gHI51h51rM&google_hm=jcB7qPKO3LvRJQnVav0KOw
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPI9RgsBikrgtm-v9YGUMUWIBQcqhGeERP973O5AczhWHGDn0SdKnj-L6Io9jQ5-i6qlMLcmwDOcipfgqsUD5gHI51h51rM&google_hm=jcB7qPKO3LvRJQnVav0KOw
pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame E39D
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLk6C_pn_jT4Dyh6jKLGaQlBpJhRH9qTRuwfbIXpqgYEP6L0iaut1OHfYMpBV1ImpYDLwQoEa6stB1Q0BHjaa29wiXilN6J
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=BAWObc9xRLOaNbqYVc0GBg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLk6C_pn_jT4Dyh6jKLGaQlBpJhRH9qTRuwfbIXpqgYEP6L0iaut1OHfYMpBV1ImpYDLwQoEa6stB1Q0BHjaa29wiXilN6J
date
Thu, 28 Oct 2021 10:09:42 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame E39D
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK5f2EKNMAqWA_5I_dzC8Zs&google_cver=1&google_push=AYg5qPJyV9t0ZdDj-DR81SYahoc2PqVjPngmvUnZg-oOYtJ00pZIQfcm07ZqKoH2VhV1CSFc6cp...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPJyV9t0ZdDj-DR81SYahoc2PqVjPngmvUnZg-oOYtJ00pZIQfcm07ZqKoH2VhV1CSFc6cpvFpx0ev9e4DjN4D30wclG918W
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPJyV9t0ZdDj-DR81SYahoc2PqVjPngmvUnZg-oOYtJ00pZIQfcm07ZqKoH2VhV1CSFc6cpvFpx0ev9e4DjN4D30wclG918W
Protocol
H3
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ZBU0JXSzctMTUtRzI4Tw==&google_push=AYg5qPJyV9t0ZdDj-DR81SYahoc2PqVjPngmvUnZg-oOYtJ00pZIQfcm07ZqKoH2VhV1CSFc6cpvFpx0ev9e4DjN4D30wclG918W
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
dbbc2dbf689859fb5870b364473d5441
Expires
0
pixel
cm.g.doubleclick.net/ Frame E39D
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3r...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame E39D 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JktQjkX7Hiupi2GF2W23ZUAYl2bMwn3Lq1JiA8BloWO8WdPkLu
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:44 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
si
googleads.g.doubleclick.net/pagead/drt/ Frame 8228
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
16 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211026/r20110914/zrt_lookup.html?fsb=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Thu, 28 Oct 2021 10:09:44 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Thu, 28 Oct 2021 10:09:44 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Thu, 28 Oct 2021 10:09:44 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
sync.php
pixel.rubiconproject.com/exchange/ Frame 71AF 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
8.39.36.141 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
dbbc2dbf689859fb5870b364473d5441
Content-Type
image/gif
activeview
pagead2.googlesyndication.com/pcs/ Frame 78B0 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssPU-h0Ew4xGYB1Li4dFSHz2bc8ZjTcNasqqJ548Wz8mZPr_s-J7VeiyLBSUwAig7LWgI5XDLRWL9Ybi4EN5ZB1Rc00oEiIjpOg0n9l-5oFYG615PA&sai=AMfl-YTvDGahdR1oUEw-pT0sgzpZ4FFZpeszdBwys2KBl7xponbqPGxyVT4Nx4kIbd03zk0t7w9wQVtQKS0o1QXJF82aHwQasaLIIkHzU1f_VzJn57TtDFIpT8aBmOs&sig=Cg0ArKJSzDMDPruK1XoREAE&cid=CAASFeRoQVzmFhD9M6zWcDlaG1YOgT0_nw&id=lidar2&mcvt=1001&p=0,0,250,300&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20211025&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=2569898456&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635415783044&rpt=431&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 28 Oct 2021 10:09:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
choices.trustarc.com/ Frame 01BE 		287 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-109.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
public
date
Wed, 20 Oct 2021 06:27:51 GMT
via
1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
server
nginx
age
704513
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
FRA50-C1
timing-allow-origin
*
content-length
287
x-amz-cf-id
KQNa7cz4-tXtaajsajJ70LTCcd-yWdEzSGijVHxinn1h5TbwQKlR9w==
expires
Fri, 19 Nov 2021 06:27:51 GMT
get
choices.trustarc.com/ Frame 01BE 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-109.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma
public
date
Thu, 14 Oct 2021 13:35:20 GMT
via
1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
server
nginx
age
1197264
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
FRA50-C1
timing-allow-origin
*
content-length
739
x-amz-cf-id
r6kUn7fdoZrgg8Wg9yYp58W5LWmM045-j47GpWNm5M6OptUOrEIeng==
expires
Sat, 13 Nov 2021 13:35:21 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame A890 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=158261&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158261&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 28 Oct 2021 10:09:44 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg
Domain
cs.admanmedia.com
URL
https://cs.admanmedia.com/sync/durationmedia?redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D328%26uid%3D%7B%24UID%7D
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g

Verdicts & Comments Add Verdict or Comment

209 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 object| 26 object| 27 object| 28 object| 29 object| 30 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| adpushup string| share_url string| share_title object| dvPerf object| _dv_win object| dv_config object| dvbsScriptsInternal object| dvbsProcessed object| _dvScripts function| dv_rolloutManager function| doesBrowserSupportHTML5Push function| dv_GetParam function| dv_Contains function| dv_GetDynamicParams function| dv_createIframe function| dv_GetRnd function| dv_SendErrorImp function| dv_CreateAndGetErrorImp function| dv_getDVUniqueKey function| dv_getDVErrorGlobalScope function| dv_onLoad function| dv_onResponse function| dv_getScriptSRC object| IQPAParams function| dv_AppendIQPAParams function| dv_onError function| dv_getDVBSErrAddress function| dv_sendImgImp function| dv_sendScriptRequest function| dv_getPropSafe function| dvBsType function| dv_baseHandler function| dvbs_src_main object| dv_baseHandlerIns object| dv_handlersDefs object| dv_baseHandler__575446261534 object| $dvbs function| __tagObject_callback_632351720573 function| __verify_callback_632351720573 number| depth function| setImmediate function| clearImmediate function| $ function| jQuery string| currentState function| _apPbJsChunk object| _apPbJs object| _pbjsGlobals string| nobidVersion object| nobid object| dvObj function| np764531 string| impId number| htmlRate number| runTag number| lab number| sources string| adid number| urlTypeId number| ddt string| bundleID string| date string| prefix object| googletag object| hbAnalytics object| apstag object| adpTags object| googlefc function| __d3lUW8vwsKlB__ object| _qevents object| dcmads boolean| apstagLOADED object| goog_ddm_ps object| ggeac object| google_js_reporting_queue function| quantserve function| __qc object| ezt object| _qoptions function| qtrack function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter boolean| google_measure_js_timing object| default_ContributorServingResponseClientJs object| __googlefc object| NmI2NmEyN2Y1NDFlYzE1ZWxvYWRlcl9qcw== string| NmI2NmEyN2Y1NDFlYzE1ZWNhY2hlZF9qcw== object| __fcInternalApiManager string| __fcInvoked string| __fcexpdef boolean| __fcInternalApiPostMessageReady object| __tcfapiEventListeners function| __tcfapi object| __tcfapiManager boolean| __tcfapiPostMessageReady function| clsn object| dicnf number| google_srt function| btrp function| pdib3 function| vv function| stcc function| ait function| ast object| google_image_requests object| GoogleTyFxhY object| dv_baseHandler__157167473258 function| __tagObject_callback_7118389937 function| __verify_callback_7118389937 object| __webpack_exports__ object| $dv string| $frmId object| dvWindow function| omrhp object| ampInaboxIframes object| ampInaboxPendingMessages object| Criteo object| default_ContributorIabTcfV2SignalJs function| __m0F0sJOg2G__ object| t2tTimestampData function| dvCallback_1635415779859937 object| lazySizes function| head object| __cfQR object| truste string| te_clr1_099f026f_a213_4426_971c_0c415817e015_ib object| te_clr1_099f026f_a213_4426_971c_0c415817e015_bi object| default_ContributorServingDetectionClientJs function| __45zy51t9ik3m__ boolean| google_empty_script_included boolean| d62e83ab-be42-460e-af16-8243296f4157 object| default_ContributorServingCookieRefreshClientJs function| __8v31i8woen1z__ object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| gaGlobal number| __google_lidar_ function| osdlfm number| __google_lidar_adblocks_count_ function| __google_lidar_radf_ object| adsbygoogle function| ga boolean| __cfRLUnblockHandlers object| GoogleGcLKhOms object| google_tag_data object| gaplugins object| gaData object| google_logging_queue object| google_ad_modifications object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc object| google_sv_map object| google_persistent_state_async string| google_user_agent_client_hint object| criteo_pubtag object| criteo_pubtag_prebid_114 object| Criteo_prebid_114 function| google_sa_impl boolean| _gfp_p_ number| google_global_correlator object| google_prev_clients object| script object| te_clr1_88ef90bd_cd51_4725_ba85_1f2ca3728035_bi object| TECA object| google_llp object| iever

126 Cookies

Domain/Path Name / Value
.quantserve.com/ Name: mc
Value: 617a76e3-95900-7d1af-2d513
.thehackernews.com/ Name: __qca
Value: P0-1592271633-1635415779591
.agkn.com/ Name: ab
Value: 0001%3ALKeXnSN%2BI6hGbf2eFTfB2MJAqKnrxWpw
.agkn.com/ Name: u
Value: C|0EAgpDTNjKQ0zYwAAAAAAAgAsAQfoVgIAAC0BB-gYAgABAAcAAAAAAXx9L___HgAAAAAAWpT6AAAAABFvHMgAAAAACJpXXQAAAAAc-skrAA
.demdex.net/ Name: demdex
Value: 18201265997502392331205948198813788260
.thehackernews.com/ Name: _pubcid
Value: 2ba8a76c-9772-4922-94b5-e61cacdd9e8e
.thehackernews.com/ Name: FCCDCF
Value: [null,null,["[[],[],[],[],null,null,true]",1635415779635],null]
.openx.net/ Name: i
Value: 2ba8a76c-9772-4922-94b5-e61cacdd9e8e|1635415779
.att.demdex.net/ Name: att
Value: 18201265997502392331205948198813788260
thehackernews.com/ Name: cto_bidid
Value: 2wGjYl9jclBEVFJ2JTJCeHlueDlJMEJVbWp0aVpPWWZCUEEzTW9xQ09xSUkzem9KVyUyQlBGZldtbWY3VHhDV2tjdjNjUFh2VHpSOUZ4QmpqS3BvSUh3UVVOeWtpQnclM0QlM0Q
thehackernews.com/ Name: cto_bundle
Value: _xpYO19RUGE4M2FsSlV2VXB3aGFUemN4WGkwcmZWSUZ3TW1JWUNhQmROZXJaMncxWmJPa1VYMThDSmpReDBVYVlCRGxSeHY2T09STVlPVmNldU9KWXJPemFsS09GQlJ0S0RwcHFVSHlWY245JTJGZ2NOdSUyRnpYa2hlUklhdHJtTHV3aTJOUUs
.thehackernews.com/ Name: FCNEC
Value: [["AKsRol9rJnpwqPmKAkJCYDAiO95zlqsUxbTRWz8LQ53EfUW4-P1SrYPwPezs9EGx4InFB36KHXxTGmYeql-94Yn4ULbJjGMz4rZobUuCNZds-NSIrs6cFdiLji_qF9H7-xVS4ocx4I3R3XDuNpb9xyD09uVNdVmqKQ=="]]
thehackernews.com/ Name: _pbjs_userid_consent_data
Value: 6683316680106290
.rubiconproject.com/ Name: khaos
Value: KVASBWK7-15-G28O
.rubiconproject.com/ Name: rsid
Value: 1|HsGqLFsFr/vVSy6g0MQzNQWiuYBcZJvAvCF6IsCkVUw1wYaQOmrhQqqfZr+M5+TPRh6t2jLGFGeoFyjBXEn+RTT+pWw62G0J5h4qb83eS0hKpmK2B6gxNbX/Q8/cWQrERdSf+hE=
.rubiconproject.com/ Name: audit
Value: 1|hLZGFuTafB1msCgc8STFJPJCOFslifsOkhwZNLbbmIX5aJiaByFnX2bXDEEQjDBSqGVWQiYLGk4i+YQF72mVaS0YgOjbGoDI
.servenobid.com/ Name: cap_544
Value: 10
.servenobid.com/ Name: cap_545
Value: 10
.servenobid.com/ Name: cap_627
Value: 10
.servenobid.com/ Name: cap_608
Value: 10
.lijit.com/ Name: ljtrtb
Value: eJyrrgUAAXUA%2BQ%3D%3D
.doubleclick.net/ Name: IDE
Value: AHWqTUmglSckz0B5vf89KQsNbng8YiK3DJh_EDFgC7DG_LgHC90vnMU4QpMf5D6rJMw
.adnxs.com/ Name: uuid2
Value: 6101957915685357758
.casalemedia.com/ Name: CMPS
Value: 5217
.casalemedia.com/ Name: CMID
Value: YXp25awCrY8zEsUSftc4LwAA
.casalemedia.com/ Name: CMPRO
Value: 1107
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2E?guByS%!]tbPl1M>e)ZlrFUfJ+tGXxpSDE)k9Ev#67RhVYYTExIAbPyjmOyz3L3B$rd*bpRz*qF1`*b`?a*>7(E
.adfarm1.adition.com/ Name: UserID1
Value: 7024057294773483671
.ctnsnet.com/ Name: cid_251118c70c294994b016ba8d472a69ce
Value: 1
.travelaudience.com/ Name: _tracker
Value: %7B%22UUID%22%3A%2241D2CB1F-FEDD-482A-9D80-D5AC8523E63F%22%7D
.simpli.fi/ Name: suid
Value: 90105F77DE07453DB190875A6839F3E7
.360yield.com/ Name: tuuid
Value: 050f484d-9723-4829-a4bc-9b176d08feca
.360yield.com/ Name: tuuid_lu
Value: 1635415781
.adhigh.net/ Name: gi_u
Value: u5bO4TjXnsT2.AikABlF8xmByJg
.thehackernews.com/ Name: _ga
Value: GA1.2.466266947.1635415781
.thehackernews.com/ Name: _gid
Value: GA1.2.1184689371.1635415783
.thehackernews.com/ Name: _gat
Value: 1
.criteo.com/ Name: uid
Value: 9f78ed9b-201a-4bfa-97cd-adb90d198eb2
.thehackernews.com/ Name: __gads
Value: ID=164db623a43b7ff9-22a7fc5a03cb00b4:T=1635415781:RT=1635415783:S=ALNI_MZr-37QralzeJypgHaBVev1CB1EFw
.thehackernews.com/ Name: cto_bundle
Value: b8yYkF9RUGE4M2FsSlV2VXB3aGFUemN4WGk5ZFBqSVlqZkx4NTkyOEViOUlqODVoMmlsNmhUZGlEbFpHNFFZMU1veHlLakFFTmdYTVZHaTZHVlJrSWt3YWQlMkJoRm96dFU2SnpZSVNnZHFmZng3JTJCZTlWNEtmdVplemJ3a0o0WnNwVko4V1lza3NHZ2NRYUd1SWwlMkIyJTJCWEF2ZUxMZyUzRCUzRA
.openx.net/ Name: pd
Value: v2|1635415783|gekin0vNiygu
.adsrvr.org/ Name: TDID
Value: c61aa380-6009-44cb-990a-49fd11b2da96
thehackernews.com/ Name: pbjs-unifiedid
Value: %7B%22TDID%22%3A%22c61aa380-6009-44cb-990a-49fd11b2da96%22%2C%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222021-10-28T10%3A09%3A43%22%7D
.mathtag.com/ Name: uuid
Value: df86617a-76e7-4500-afd3-42bd134a913f
.adform.net/ Name: C
Value: 1
.ads.pubmatic.com/ Name: KCCH
Value: YES
.adform.net/ Name: uid
Value: 7513717851230090471
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 04058E6D-CF71-44B3-9A35-BA9855CD0606
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 1
.pubmatic.com/ Name: pi
Value: 158261:2
.pubmatic.com/ Name: DPSync3
Value: 1635465600%3A174%7C1636588800%3A197_219_201
.pubmatic.com/ Name: SyncRTB3
Value: 1636588800%3A54_220_13_161_56_3_8_21_7%7C1637971200%3A203%7C1636675200%3A35%7C1635984000%3A223
.servenobid.com/ Name: pid_312
Value: 6101957915685357758
.smartadserver.com/ Name: pid
Value: 780945751829422425
.adx.opera.com/ Name: UID
Value: 3a5423448670419f9993bf003e0d0eb6
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjU0Mja0NDMxMjAyNTI3szQ0NRPiM9St9HINCrAoS3bMiiiV4jU0MzY1MTQ1tzA2NjUCAOSvBNo0AAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjU0Mja0NDMxMjAyNTI3szQ0NRPiM9St9HINCrAoS3bMiigFALdfkqwlAAAA
.servenobid.com/ Name: pid_333
Value: YXp25awCrY8zEsUSftc4LwAABFMAAAIB
.servenobid.com/ Name: pid_335
Value: 3a5423448670419f9993bf003e0d0eb6
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-7513717851230090471&KRTB&23263-7513717851230090471
.pubmatic.com/ Name: PUBMDCID
Value: 3
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-c61aa380-6009-44cb-990a-49fd11b2da96&KRTB&22918-c61aa380-6009-44cb-990a-49fd11b2da96&KRTB&23031-c61aa380-6009-44cb-990a-49fd11b2da96
.pubmatic.com/ Name: KRTBCOOKIE_1101
Value: 23040-7024057294773483671
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:df86617a-76e7-4500-afd3-42bd134a913f&KRTB&16736-uid:df86617a-76e7-4500-afd3-42bd134a913f&KRTB&23019-uid:df86617a-76e7-4500-afd3-42bd134a913f&KRTB&23114-uid:df86617a-76e7-4500-afd3-42bd134a913f
.pubmatic.com/ Name: PugT
Value: 1635415783
.analytics.yahoo.com/ Name: IDSYNC
Value: 18z8~217m
.prebid.a-mo.net/ Name: _sv3_0
Value: 1
.prebid.a-mo.net/ Name: _sv3_2
Value: 1
.prebid.a-mo.net/ Name: _sv3_3
Value: 1
.prebid.a-mo.net/ Name: _sv3_4
Value: 1
.a-mo.net/ Name: amuid2
Value: 124b8dda-45ee-4354-9ba8-33e920a174f9
.servenobid.com/ Name: pid_317
Value: 780945751829422425
.gumgum.com/ Name: vst
Value: e_80a2292c-c481-4836-aead-31c84085c438
.servenobid.com/ Name: pid_324
Value: 5123196420252769156
.pubmatic.com/ Name: SPugT
Value: 1635415782
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 19420-wmKAY8Nl0jHZaoI7xGOaNZBi1mTZYdM3xWB3M66Z&KRTB&22979-wmKAY8Nl0jHZaoI7xGOaNZBi1mTZYdM3xWB3M66Z
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESEJD6-cEA0zh7nP9u6XTkaPY&KRTB&16514-CAESEJD6-cEA0zh7nP9u6XTkaPY&KRTB&23025-CAESEJD6-cEA0zh7nP9u6XTkaPY
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-6101957915685357758
.de17a.com/ Name: guid2
Value: 1.4074810829502671380
.servenobid.com/ Name: pid_327
Value: 124b8dda-45ee-4354-9ba8-33e920a174f9
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003%22%7D
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAFslxmtoZmxqYmhqbmFsYmJ4ShyJb2xqBACgnRjiIAAAAA
.servenobid.com/ Name: pid_309
Value: e_80a2292c-c481-4836-aead-31c84085c438
.sitescout.com/ Name: ssi
Value: cd67fb8b-2107-40d6-9b9b-7e53ba171b4e#1635415783447
.bidswitch.net/ Name: c
Value: 1635415783
.bidswitch.net/ Name: tuuid_lu
Value: 1635415783
.pubmatic.com/ Name: KRTBCOOKIE_336
Value: 5844-4074810829502671380
.bidswitch.net/ Name: tuuid
Value: b6081b06-acf6-48af-b02e-5f0275f032d3
.servenobid.com/ Name: pid_321
Value: RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003
.creativecdn.com/ Name: u
Value: abyVPsSZ9Dstatw9ER1x
.creativecdn.com/ Name: ts
Value: 1635415783
.sitescout.com/ Name: _ssuma
Value: eyI0IjoxNjM1NDE1NzgzNDk0LCIzOSI6MTYzNTQxNTc4MzQ5NCwiMTAiOjE2MzU0MTU3ODM0OTR9
.quantserve.com/ Name: d
Value: EJ0BFAHLJIEO-TCJiTA
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YXp25wAAPk46CQBR
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-b02f58ab-1545-4718-bc4f-a03ec5a893a5-003%22%2C%22nxtrdr%22%3Afalse%7D
.tapad.com/ Name: TapAd_TS
Value: 1635415783578
.tapad.com/ Name: TapAd_DID
Value: 1d996f74-73dc-4d29-9b9e-1e518cf0e570
.onaudience.com/ Name: cookie
Value: 98f03df5a4861c84
.onaudience.com/ Name: done_redirects236
Value: 1
.postrelease.com/ Name: opt_out
Value: 1
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.eqads.com/ Name: EQUser
Value: UID=22e926d2-1eb6-4188-b45f-2dadf2835f8e
beacon.lynx.cognitivlabs.com/ Name: UID
Value: 6eb9fbbf-9547-4c55-b9c0-30604e7ad833
beacon.lynx.cognitivlabs.com/ Name: ss
Value: 1BLuhm0YJTHFpDp2jDnbbm4csz6RtrhK5AYGqekDqqo5s9vYIbwDzJXMc1cSRXkYNpTzvGEAaJjWZUApBGOHSQ%3D%3D
.doubleclick.net/ Name: DSID
Value: NO_DATA
.technoratimedia.com/ Name: tads_uid
Value: GDPR
.lijit.com/ Name: ljt_reader
Value: 956aaaa5ae48e61375ff1097
.eyeota.net/ Name: mako_uid
Value: 17cc6607943-6ebb0000010f54c8
.eyeota.net/ Name: SERVERID
Value: 21704~DM
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: ca462480f591517d
.casalemedia.com/ Name: CMRUM3
Value: c4617a76e705a0&2d617a76e52760CAESENP484pgo6du_pGOE6Gv068&49617a76e705a0&e6617a76e72760&f1617a76e705a0&08617a76e727606eb9fbbf-9547-4c55-b9c0-30604e7ad833&28617a76e7276022e926d2-1eb6-4188-b45f-2dadf2835f8e&27617a76e70b40&6f617a76e705a0
.outbrain.com/ Name: obuid
Value: 721a749b-3fac-48a5-9599-c8a6d1cc6175
.sportradarserving.com/ Name: zuuid
Value: 958165c3-7dfc-4cfe-9d4c-54c577851884
.sportradarserving.com/ Name: c
Value: 1635415783
.sportradarserving.com/ Name: zuuid_lu
Value: 1635415783
.sportradarserving.com/ Name: zuuid_k
Value: 1
.sportradarserving.com/ Name: zuuid_k_lu
Value: 1635415783
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-34513d64-ebd6-423a-4672-cea26625d739.fAAZXHkOEZl2lyZlnJNWHDnCoY2tQmoHN0pMI%2BGJRW0
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A0-34513d64-ebd6-423a-4672-cea26625d739%24ip%24216.131.114.55.BLFedia%2BEbz6TWJu3p57JpPJUm5N7Elc1%2FHESdaWM1I
.ipredictive.com/ Name: cu
Value: 2c07d654-37d7-11ec-9d14-fb2c7a265914|1635415783785
.zemanta.com/ Name: zuid
Value: Dw2wLerKc6751uY7dBU9
.mathtag.com/ Name: mt_mop
Value: 9:1635415783
.turn.com/ Name: uid
Value: 4353370598078843813
.casalemedia.com/ Name: CMST
Value: YXp25WF6dugA
.adsrvr.org/ Name: TDCPM
Value: CAEYASABKAIyCwimhua3uYGNOhAFOAFaBmV5ZW90YWAC
.yahoo.com/ Name: A3
Value: d=AQABBOd2emECEDY293bqt1yWWmvQflhz100FEgEBAQHIe2GEYQAAAAAA_eMAAA&S=AQAAAgVNteZHbbxyFPnoElTwZV4

23 Console Messages

Source Level URL
Text
javascript warning URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292494536%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292494536%26sid%3D5936378%26dvregion%3D2%26unit%3D300x250(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_632351720573&jsTagObjCallback=__tagObject_callback_632351720573&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=632351720573&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=95&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=1&brh=2&fwc=0&flt=9&fec=393&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&dvp_exetime=13.30&callbackName=__verify_callback_632351720573, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_632351720573&jsTagObjCallback=__tagObject_callback_632351720573&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=632351720573&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=95&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=1&brh=2&fwc=0&flt=9&fec=393&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&dvp_exetime=13.30&callbackName=__verify_callback_632351720573, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v81.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v81.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/impl_v81.js(Line 35)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/impl_v81.js(Line 35)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N424004.3381407THEHACKERNEWS/B24935727.292494536;dc_ver=81.235;sz=300x250;u_sd=1;nel=1;u=__AP1_np_dv_n63l5ggxwjPA__;dc_adk=473486474;ord=qlehf6;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fthehackernews.com%2F2021%2F10%2Fhackers-using-squirrelwaffle-loader-to.html%3F%26web_view%3Dtrue$0;xdt=0;crlt=4xyxq5sJLZ;sttr=35;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292495514%26sid%3D5936378%26dvregion%3D2%26unit%3D728x90(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src.js?ctx%3D607671%26cmp%3D24935727%26plc%3D292495514%26sid%3D5936378%26dvregion%3D2%26unit%3D728x90(Line 3)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.doubleverify.com/dvbs_src_internal99.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_7118389937&jsTagObjCallback=__tagObject_callback_7118389937&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=7118389937&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=95&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=7&brh=2&fwc=0&fcl=100&flt=9&fec=511&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&dvp_exetime=13.30&callbackName=__verify_callback_7118389937, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 306)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_7118389937&jsTagObjCallback=__tagObject_callback_7118389937&num=6&ctx=&cmp=&plc=&sid=&advid=&adsrv=&unit=&isdvvid=&uid=7118389937&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&brid=3&brver=95&bridua=3&dup=null&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=0&htmlmsging=1&m1=13&noc=4&fcifrms=7&brh=2&fwc=0&fcl=100&flt=9&fec=511&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=147&eparams=DC4FC%3Dl9EEADTbpTauTauE96924%3C6C%3F6HD%5D4%40%3ETaua_a%60Tau%60_Tau924%3C6CD%5CFD%3A%3F8%5CDBF%3ACC6%3DH277%3D6%5C%3D%40256C%5CE%40%5D9E%3E%3DTbuTaeH630G%3A6HTbsECF6&dvp_exetime=13.30&callbackName=__verify_callback_7118389937, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cdn.doubleverify.com/dvbs_src_internal99.js(Line 829)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/dcmads.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v81.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/dcmads.js(Line 15)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v81.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=BQ9ITZcjSCmkvJsXbQj-yg&google_push=AYg5qPKqnxIypK1fnTUh1pb-RqtJep_LQXkpiLYm0AQifmsvgsrV0lBUr0Ui3gvIO4gpcckkEwRpfZ1vcYXwvt19RpNMfmyQk_OxLg
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://c1.adform.net/serving/cookie/match?party=29&gdpr=1
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_push=AYg5qPIxbOoCKV3l_0hBvhEGlZREGPg4wgj7xmp3fVS8thfTu1HSfAexSIxXekE_xaEvC2UYy0j-eXsys1IVbExkGs-wa9n0eEWj&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_cver=1
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXp25awCrY8zEsUSftc4LwAABFMAAAIB&google_cver=1&google_gid=CAESEGFqiUOzHecWew2sUyngyxY&google_push=AYg5qPIQ0breRQW9g2SXmTToZ-cuBgW1DbR3ryLSWyPbLf7lS376Dg8j4_vxURFSpKgf35mtvUWEhhcZvh_Y8eHz-zy4IIEe584g
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.sportradarserving.com
acdn.adnxs.com
ad.360yield.com
ad.doubleclick.net
adpushup-d.openx.net
ads.pubmatic.com
ads.servenobid.com
ads.travelaudience.com
ads.yahoo.com
adservice.google.com
ap.lijit.com
att.demdex.net
b1sync.zemanta.com
beacon.lynx.cognitivlabs.com
bh.contextweb.com
bidder.criteo.com
bttrack.com
c.amazon-adsystem.com
c1.adform.net
cdn.adpushup.com
cdn.connectad.io
cdn.districtm.io
cdn.doubleverify.com
cdn.jsdelivr.net
cdn3.doubleverify.com
cdnjs.cloudflare.com
ce.lijit.com
choices.trustarc.com
choices.truste.com
cm.g.doubleclick.net
cms.quantserve.com
code.jquery.com
creativecdn.com
cs.admanmedia.com
cs.emxdgt.com
d.agkn.com
d.turn.com
d5p.de17a.com
dis.criteo.com
dmx.districtm.io
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
e102c8a86b302e6e5182fd0b93251d67.safeframe.googlesyndication.com
e3.adpushup.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
g2.gumgum.com
gcm.ctnsnet.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gu.dyntrk.com
gum.criteo.com
hbopenbid.pubmatic.com
i.connectad.io
ib.adnxs.com
id.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
jadserve.postrelease.com
loadm.exelator.com
match.adsrvr.org
match.deepintent.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel-sync.sitescout.com
pixel.33across.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
prebid.a-mo.net
ps.eyeota.net
public.servenobid.com
px.adhigh.net
rtb.gumgum.com
rtb0.doubleverify.com
rules.quantcount.com
s.amazon-adsystem.com
s0.2mdn.net
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
stags.bluekai.com
static.criteo.net
stats.g.doubleclick.net
sync-eu.connectad.io
sync-tm.everesttech.net
sync.1rx.io
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
t.adx.opera.com
tg.socdm.com
thehackernews.com
token.rubiconproject.com
tpc.googlesyndication.com
tps.doubleverify.com
tps11046.doubleverify.com
tps20516.doubleverify.com
tps20521.doubleverify.com
um.simpli.fi
um2.eqads.com
ups.analytics.yahoo.com
us-u.openx.net
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
cm.g.doubleclick.net
cs.admanmedia.com
104.111.215.191
104.16.19.94
104.16.190.66
104.16.89.20
104.18.28.173
104.26.1.97
104.76.201.201
108.177.15.157
13.107.213.44
132.226.41.106
135.125.160.160
142.250.181.238
142.250.184.194
142.250.184.195
142.250.185.162
142.250.185.170
142.250.185.193
142.250.185.198
142.250.185.66
142.250.185.98
142.250.186.102
142.250.186.129
142.250.186.164
142.250.186.98
143.204.95.188
143.204.98.109
143.204.98.28
143.204.98.34
147.75.38.124
15.197.193.217
151.101.129.108
151.101.66.49
159.253.128.188
169.197.150.8
172.217.16.131
172.67.8.174
178.162.133.149
178.250.0.163
178.250.0.165
178.250.2.130
178.250.2.146
18.156.0.31
18.195.155.181
18.196.159.27
18.197.21.136
18.198.69.109
18.213.10.151
185.184.8.65
185.29.134.248
185.33.221.15
185.33.221.52
185.64.189.110
185.64.189.112
185.64.190.78
185.64.190.80
185.86.139.104
192.132.33.46
193.0.160.129
198.148.27.140
198.47.127.20
2.18.233.180
2.18.234.21
202.241.208.100
208.100.17.173
213.155.156.183
213.19.147.45
213.254.244.14
216.58.212.162
216.58.212.174
23.37.42.132
23.97.225.52
3.122.214.165
3.123.82.137
3.217.216.1
34.205.3.24
34.249.252.185
35.156.89.137
35.186.193.173
35.190.0.66
35.227.248.159
35.244.159.8
35.244.174.68
37.157.6.247
46.228.164.13
51.222.80.231
51.38.120.206
52.21.104.248
52.46.130.91
52.49.244.74
52.57.255.59
54.175.36.162
54.194.104.251
54.228.75.94
63.251.109.138
63.251.14.3
64.74.236.159
66.155.71.25
69.16.175.10
69.173.144.143
70.42.32.31
8.39.36.141
8.39.36.142
82.145.213.8
85.114.159.93
87.248.118.22
91.207.59.214
91.228.74.134
029a3e2487440bc7805e7c4fec65fe7dc48cc851dce7df5e59c9927ef71bd056
035b8ba2606296313085d7caa2a298bf4a9d71328c5250bc6db27ac193bc6026
0561ca6090bdbd5c06176653ce086a4a3fa950c091504d96af2fe5983a88f2ef
05820eb7216b9b600e69feb77e12e3f5ce28208ae34c7710154e2393dd9b8d6e
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60
09390420931de1a5876504eb4ebc8af93bd0464e7837af05c971b8afd33f6dbf
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10480fe2f1ebf5d7e8a856b4fc4653ede148b91500c030d06224be02f659b8e3
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
142d1e7fa6fb4095e158a4a127ed33b8cfb99e7801b5721e649400ab9a8aed7a
1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c
1459a4c2d036e9bf1a897002f1e18a3b502c9661bacd06e616bd08d422058dd9
158edd2a7562d2b16eadda8fb990eb8d20e53837dd1abdfd2c890fcc0980ede0
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
1a11226facc83902ade3cf7b9a57bb6864287a59ca459793cf7a3c0ff9943269
1a8d5cd982c8f774f8d3e9024812353f1fdd9d5033e20c84bb57aedcd473b236
1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4
1ed89e2958b0d6659369958097b47e859fdf27a50c7a00bed10fe8913edf9a0a
1f15dc13ebdca8972b7eeb648108b804feb40f890ae25cc14cf5a3b1379726a3
218dd79df6aa444af4532bd4d7f816a354a7cade42c7dab331146b9ecb21becb
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
22b931d340315ac4e339e36dca19ab10f5929b1cd8e585402eb9b7a59d53d0ad
2581d556ceadd8cdd3eb15509ff94501871552563a71381393fc7b59611cbc1e
26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16
2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a
2d5a1a5977d4cfb69ad8c5f7d11b967964fba44e4807552b50257e2589d7bbf1
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3c2c5e8ce71da5f920b37260c35faad806880a17d60b6b93e35e1200763a6733
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3d8ab8467b889847c12c542bee765afc54acbaff1cc91ce3197ab4f2be8f08ff
3e2662d2cc5114073ccdc2611e908b3b51990027b5cbb651c69954274e2123db
3ed58d405cc30d0472d4deed639ea4696b1c7e5614cc8f91b474142d36b1e697
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
41f36457d5ec5bd7d115c29bea53e0d1ff77de7418837ef39e897f3b7d497e8a
42977b3f1bf3b11d34a40c50c095d65b3ba8631ef4ebb37b950ccd9c401d2181
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4523f860e8db1019c017be78408984c64f811a89724e8fc8d87bdf72c526758a
467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30
467ede4bc51469a8db27267f107f6a5e630a9685acf37e97380125cffb196fcd
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4aa0285a9abba06bd23a1e72b13bd2f08061729d5c3c49912903b9e9ad983104
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51c157af74156e2c7a11f2e11ce0b4386b74ac2e5795e4d85a07c86dec7ad02f
554ec7ad6599457424007718c646bcd7ec33170c452dceb0e4c12f108b9f17ed
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5dd139490465c0d5b42eb905451078a5ee84b5c220d6af5b143af49247a8ecf5
5ec8fa6e02da7947731c15494a568893d2da42b13bbbf9b4c695139b04c81420
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
62e80665b87cd3ba3216099a8d7d8d49631637850117df6526220a25ad64ca02
63c573fc8a47c667d112030a6d5456a4b32331a1267517f4ba03e2af7af9a184
64bf067678f8a8675f48a8f3dd20e4b3e352a44a69da1c658efad8fe00aa0710
64f6144c806861d21d81a5f8baa789fde29083d36845329bf192d83c30b2b0dc
64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159
673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112
6795c5c8b9b0aeb87d6663ccd7a71fb9d2f2817fe9b5c2e67bce0d5a5e1309a1
67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab
688a1e2444a1171a4cfbc8674c62d53bc663bf35a7825eb3563851e79694411c
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6dc108ca91c3c3d94f0288874585fc05b570883a8838087d28185e7c22e06cae
6ee4516e86690bed70ec3855404135a3680379dfefe752f8e019f57bf4b66790
708e39746f2d1acc9ceca7ce0366d4aa367a6fc58b0e3728f6a8f899e9b6c932
72d43d4ff0adb982ce42d41ef08e5f88c1854e4c8ea6455771ace93761a067c4
73b4981ae8baf268db12da6ce1b0af45f733ba5056e46d089609a56f772fd018
742932c0bf5cb01d0a7336c0841c46734b514a4a8cb3840a21f297d1194fd1df
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
78fb5f9fe609023ae2d3ac22cc05905b3315c2a0477f43d2e12ebb8ccbbd8395
78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416
7c7164a751058bf19b539ffd64d2225afc1a9baaf05bfc208ad7fdc97831c674
7d9d6600ad7b0a19123c1ebcc3481701e312b7a67a8fda8aebe8465c6805a005
809bff8bfc9ad4e13b0c0b17ccff5e7b68dedf852d6e85e4f9d6d23ddc3cbf10
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86aa3f44ba04ba7838a7829dc81e0d24bd708b4379915a3bb00dc6d19f95b939
86be5d6a3d661fd3d5d72f254a347dec5c66cad569117f51dad297acba02f558
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
918ea9df695a93d6c6e8017662a5d7615ea6c4f45fc937a04ea33bfbf87c8dd8
9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee
975b62423e82390a1b54f47625f46f5b4451a8ea69945b2e85008a194bb55edd
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b19294685dfc3568f9e0ba438b00db567a2589495f7f128059a33877aa41ff7
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a30311accf3d51d4b54905d55ec11cd023d20c41d75e23e906fb53d55e67004a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a52ca07f327c5d2ebbadb0d1e58c1b513f4151f372d20cf24b3fd3fd13a5c4d6
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a615ad6d4202a6400183db13a2ce3d08853a1686bd8c7cf6996a85df9a75f91b
a71328300f380217ae0abf7f805052a10a0c196cb241eb97adf9b905e4a48c8a
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
acd85cde473594808e5ee45d46e836b8060fb5f651db09785c72d9f7be63f901
acee506b313212f502744cd3cf0860b72bc7d6dc3a9c44bf9f2e028c53e8de39
ad6fed00cea44422fcd9613c8daf01b800fe0b5bcc56b8944a4bcb4ca532f7f5
adcfcc33dc718b3b521236b5fe56aeafa725ffdb1e58229be4cdd9e773a09c61
b104883bf15dee8faff0e9e8d9cc7365c3a428e8515a22d177d9bb990ade196f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6285dce6b9fb557bd0c15683c62f9be0f2e0b760086854b59c952791ba9e8ae
ba8e38c6c85b0384447b0174b6e16c72c56acbd084c40db40abedf89036f080c
bab66612be34a35f9bc5f36858ba5002b2ddeefe301acc3f2e33fe235d5656b8
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bb5afa94dd58b02ca4d882890b5c7cf0e4fd77a41106e09c4f7bddc6e41b8d45
bf2104612e9075a70d16cd2125a8494fe01e9b4d560c42c81873a8393850509e
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2842ab20cc17cb61e32799c8cff642f37a20a933b12f678628b4666c0311f78
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
c59f31ea8d949ea12098c0be6ce921e4f55b92deba853de946c0e8db2358157b
c6a9d65e5bd6eb2447ea57e398e1d30f3c6e2d022ecf195933d161ffed964690
c74bacc93c301754ac89484ca30b1ed35fc6bc92375e1bc4c72bed2f24bbf427
ca92d77c2d1c7c39f86a0feab4223131bea068006d0c58a75c9e951132e07731
ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf624cca88c1828e4dc1a61151d2ce6e826191ba2223f4cf4cdacc1d8a52981b
d03755898b05a3d69377bf7da16ccb307e789a0f569b4dbbcb7b29bdecf967c5
d143e1ccd80ef6315a4940f247148de62e47e48f44d422490498441bc1d36e50
d32a8355aad932714ccb5ed1fda47adc1516c022059886391bba35224598f674
d39f8ffc0e3917e02c8b37ae4ab17e6ce426b7dbc5c9d1add33bdb84e64eda28
d4b108456a80a95d52c740c71471e978360f02d72f1fd74d6c37cc9486c1b556
d512c6b6d2444590659871eb3c3068ba7d7120f0ceca7decda56dff88fed22cd
d534ae509b079f2ac710e2f869ba11338a51c7ba502291d712a824695068056c
dcd346804a786db16b40af2672924a5b8787623f71d648a017da7e236e1b19b4
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32
dfb5f646e583b7f7566b512d01ad4fe7a8bb81b83d8225cb31efe8375c1aa7ab
dfce93c5632ef0a345e287efa4d250609ba3f00e8af81f7c029f6c5a9ec2e48a
e036a8240c1bd93c196996f0e75ab3244c0c04c3ef27967a77fdfaf3a47645fd
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e992ede9861bc4711474f8aa1469226a448566fe3c282265f035d74d1ec3b27a
eaaa6059ef4c9ca12e78fcc03ae77ad4cbf05dc73c1fedf64b28a632868bd829
eae76cb616003cb3e918dfd9f58d63cc8e832aa9d11a9eda64b1476af57e746a
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
eefd49ea99f443961949941d4ea636be5ec755f09ac983d1a2cf4b775c4fc27e
ef02e71406ebc56ea9ff0fb60672d22ea0576a6217a2c7f25418e4b5403021b5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef1eefe12720b4c3d2987a398334bd11225805b03c48e21e57fb3852b3a5710b
ef334f7eae7dcc23de3513406fd84f43477435fb8c1be9e76f82a989ab1b594e
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
f58fdfb817718728b8632b7506725b8b07226f68d2c03c84eb0e5012cd07c052
f856d8043b78c674d0fff3663a149fd2716b7c0eecc24a2f88c8d469bd58d176
f8736cb93aa3da288664eb8b6fafa3ec1a3395f53215ce8784ac0dd9ef826e78
f88754ecdaeedbf69845f3cb4015909beff31f92b173185c075ff8ab40ae3d02
f9f344b4407561250d26dbe5d6044f1c605e17c01c8641e1bb540f4d8b767444
fbef7c4e520944d043b57ff620e9d57e5df9dd08cef0d4d007d8bc252e545e63
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62