urlscan.io logo urlscan.io
SecurityTrails logo

threatpost.com Open in urlscan Pro
35.173.160.135  Public Scan

Go To Rescan Add Verdict Report
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Submission: On October 24 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 7 countries across 33 domains to perform 130 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is threatpost.com.
TLS certificate: Issued by Thawte EV RSA CA 2018 on June 17th 2019. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 35.173.160.135 14618 (AMAZON-AES)
6 2600:9000:215... 16509 (AMAZON-02)
7 216.58.207.66 15169 (GOOGLE)
12 2600:9000:215... 16509 (AMAZON-02)
1 4 2a00:1450:400... 15169 (GOOGLE)
5 20 151.101.14.2 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 91.228.74.140 27281 (QUANTCAST)
1 151.101.12.157 54113 (FASTLY)
1 3 23.5.97.37 16625 (AKAMAI-AS)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2a05:f500:10:... 14413 (LINKEDIN)
1 151.101.13.140 54113 (FASTLY)
1 104.244.42.5 13414 (TWITTER)
1 2600:9000:215... 16509 (AMAZON-02)
4 151.101.14.49 54113 (FASTLY)
2 2 18.185.154.43 16509 (AMAZON-02)
1 69.173.144.165 26667 (RUBICONPR...)
1 1 40.113.136.100 8075 (MICROSOFT...)
2 2 185.29.135.234 30419 (MEDIAMATH...)
14 151.101.114.49 54113 (FASTLY)
3 37.252.172.249 29990 (ASN-APPNEXUS)
2 2 172.217.18.98 15169 (GOOGLE)
2 2 52.51.24.119 16509 (AMAZON-02)
1 1 54.70.1.117 16509 (AMAZON-02)
1 192.132.33.46 18568 (BIDTELLECT)
1 130.211.13.252 15169 (GOOGLE)
3 3 52.59.29.68 16509 (AMAZON-02)
2 2 178.63.11.9 24940 (HETZNER-AS)
9 151.101.114.2 54113 (FASTLY)
1 104.244.42.195 13414 (TWITTER)
3 206.189.226.166 14061 (DIGITALOC...)
2 185.64.189.111 62713 (AS-PUBMATIC)
130 32
17    35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com
threatpost.com
kasperskycontenthub.com
6    2600:9000:2156:1400:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
assets.threatpost.com
7    216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f2.1e100.net
securepubads.g.doubleclick.net
12    2600:9000:2156:2c00:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
media.threatpost.com
4    2a00:1450:4001:81b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
20    151.101.14.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
cdn.taboola.com
trc.taboola.com
images.taboola.com
1    2a00:1450:4001:820::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
6    2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
adservice.google.com
www.googletagservices.com
pagead2.googlesyndication.com
1    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.gstatic.com
4    2a00:1450:4001:817::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
tpc.googlesyndication.com
2    2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
2    91.228.74.140 (United Kingdom)

ASN27281 (QUANTCAST - Quantcast Corporation, US)
secure.quantserve.com
pixel.quantserve.com
1    151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
static.ads-twitter.com
3    23.5.97.37 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-5-97-37.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
1    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
5    2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
cdn.ampproject.org
1    2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
graph.facebook.com
1    2a05:f500:10:101::b93f:9101 (Ireland)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
1    151.101.13.140 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
www.reddit.com
1    104.244.42.5 (United States)

ASN13414 (TWITTER - Twitter Inc., US)
t.co
1    2600:9000:2156:1c00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
rules.quantcount.com
4    151.101.14.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
15.taboola.com
convammp.taboola.com
2    18.185.154.43 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-185-154-43.eu-central-1.compute.amazonaws.com
rtb.mfadsrvr.com
1    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
pixel.rubiconproject.com
1    40.113.136.100 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
px.powerlinks.com
2    185.29.135.234 (United Kingdom)

ASN30419 (MEDIAMATH-INC - MediaMath Inc, US)
sync.mathtag.com
14    151.101.114.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
match.taboola.com
imprammp.taboola.com
wf.taboola.com
opps.taboola.com
3    37.252.172.249 (Ascension Island)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
secure.adnxs.com
2    172.217.18.98 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: zrh04s05-in-f98.1e100.net
cm.g.doubleclick.net
2    52.51.24.119 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-51-24-119.eu-west-1.compute.amazonaws.com
match.adsrvr.org
1    54.70.1.117 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-70-1-117.us-west-2.compute.amazonaws.com
www.storygize.net
1    192.132.33.46 (United States)

ASN18568 (BIDTELLECT - Bidtellect Inc., US)
PTR: 46.bidtellect.com
bttrack.com
1    130.211.13.252 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 252.13.211.130.bc.googleusercontent.com
cds.taboola.com
3    52.59.29.68 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-59-29-68.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    178.63.11.9 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: hosting.adhigh.net
px.adhigh.net
9    151.101.114.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)
vidstat.taboola.com
vidstatb.taboola.com
1    104.244.42.195 (United States)

ASN13414 (TWITTER - Twitter Inc., US)
analytics.twitter.com
3    206.189.226.166 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
serverc.shoofle.tv
2    185.64.189.111 (United Kingdom)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)
vid.pubmatic.com
Apex Domain
Subdomains		 Transfer
48 taboola.com
cdn.taboola.com
trc.taboola.com
15.taboola.com
match.taboola.com
cds.taboola.com
images.taboola.com
vidstat.taboola.com
imprammp.taboola.com
convammp.taboola.com
vidstatb.taboola.com
wf.taboola.com
opps.taboola.com
699 KB
34 threatpost.com
threatpost.com
assets.threatpost.com
media.threatpost.com
685 KB
10 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
107 KB
6 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
98 KB
5 ampproject.org
cdn.ampproject.org
224 KB
5 google.com
www.google.com
adservice.google.com
911 B
3 shoofle.tv
serverc.shoofle.tv
2 KB
3 bidswitch.net
x.bidswitch.net
1 KB
3 adnxs.com
ib.adnxs.com
secure.adnxs.com
3 KB
3 scorecardresearch.com
sb.scorecardresearch.com
2 KB
2 pubmatic.com
vid.pubmatic.com
2 KB
2 adhigh.net
px.adhigh.net
951 B
2 adsrvr.org
match.adsrvr.org
890 B
2 mathtag.com
sync.mathtag.com
1 KB
2 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
2 googletagservices.com
www.googletagservices.com
57 KB
2 quantserve.com
secure.quantserve.com
pixel.quantserve.com
6 KB
2 google-analytics.com
www.google-analytics.com
18 KB
2 google.de
adservice.google.de
www.google.de
280 B
1 twitter.com
analytics.twitter.com
635 B
1 bttrack.com
bttrack.com
380 B
1 storygize.net
www.storygize.net
450 B
1 powerlinks.com
px.powerlinks.com
402 B
1 rubiconproject.com
pixel.rubiconproject.com
239 B
1 quantcount.com
rules.quantcount.com
356 B
1 t.co
t.co
448 B
1 reddit.com
www.reddit.com
1 KB
1 linkedin.com
www.linkedin.com
1 facebook.com
graph.facebook.com
523 B
1 ads-twitter.com
static.ads-twitter.com
2 KB
1 gstatic.com
www.gstatic.com
90 KB
1 googletagmanager.com
www.googletagmanager.com
24 KB
1 kasperskycontenthub.com
kasperskycontenthub.com
367 B
130 33
Domain Requested by
16 threatpost.com threatpost.com
securepubads.g.doubleclick.net
12 media.threatpost.com threatpost.com
9 trc.taboola.com 5 redirects cdn.taboola.com
threatpost.com
8 vidstat.taboola.com cdn.taboola.com
vidstat.taboola.com
www.googletagservices.com
8 match.taboola.com threatpost.com
vidstat.taboola.com
7 securepubads.g.doubleclick.net threatpost.com
securepubads.g.doubleclick.net
6 images.taboola.com threatpost.com
6 assets.threatpost.com threatpost.com
5 cdn.ampproject.org securepubads.g.doubleclick.net
5 cdn.taboola.com assets.threatpost.com
cdn.taboola.com
threatpost.com
4 tpc.googlesyndication.com securepubads.g.doubleclick.net
threatpost.com
4 www.google.com 1 redirects threatpost.com
www.gstatic.com
3 serverc.shoofle.tv vidstat.taboola.com
3 wf.taboola.com vidstat.taboola.com
3 convammp.taboola.com threatpost.com
3 x.bidswitch.net 3 redirects
3 sb.scorecardresearch.com 1 redirects cdn.taboola.com
threatpost.com
2 vid.pubmatic.com vidstat.taboola.com
2 opps.taboola.com vidstat.taboola.com
2 pagead2.googlesyndication.com
2 px.adhigh.net 2 redirects
2 match.adsrvr.org 2 redirects
2 cm.g.doubleclick.net 2 redirects
2 ib.adnxs.com threatpost.com
2 sync.mathtag.com 2 redirects
2 rtb.mfadsrvr.com 2 redirects
2 www.googletagservices.com securepubads.g.doubleclick.net
2 www.google-analytics.com 1 redirects www.googletagmanager.com
1 secure.adnxs.com vidstat.taboola.com
1 analytics.twitter.com static.ads-twitter.com
1 vidstatb.taboola.com threatpost.com
1 pixel.quantserve.com threatpost.com
1 imprammp.taboola.com threatpost.com
1 cds.taboola.com threatpost.com
1 bttrack.com threatpost.com
1 www.storygize.net 1 redirects
1 px.powerlinks.com 1 redirects
1 pixel.rubiconproject.com threatpost.com
1 15.taboola.com cdn.taboola.com
1 rules.quantcount.com secure.quantserve.com
1 t.co threatpost.com
1 www.reddit.com threatpost.com
1 www.linkedin.com threatpost.com
1 graph.facebook.com threatpost.com
1 www.google.de threatpost.com
1 stats.g.doubleclick.net 1 redirects
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 www.gstatic.com www.google.com
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 www.googletagmanager.com threatpost.com
1 kasperskycontenthub.com threatpost.com
130 53
Subject Issuer Validity Valid
threatpost.com
Thawte EV RSA CA 2018		 2019-06-17 -
2020-06-17		 a year crt.sh
assets.threatpost.com
Amazon		 2019-04-02 -
2020-05-02		 a year crt.sh
kasperskycontenthub.com
Thawte RSA CA 2018		 2019-06-14 -
2020-06-13		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
media.threatpost.com
Amazon		 2019-04-02 -
2020-05-02		 a year crt.sh
www.google.com
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-07-30 -
2020-07-25		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA		 2019-10-04 -
2020-10-07		 a year crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-08-14 -
2020-08-18		 a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA		 2018-11-28 -
2019-12-26		 a year crt.sh
www.google.de
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
misc-sni.google.com
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-09-22 -
2019-12-20		 3 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2018-05-30 -
2020-09-01		 2 years crt.sh
*.reddit.com
DigiCert SHA2 Secure Server CA		 2018-08-17 -
2020-09-02		 2 years crt.sh
t.co
DigiCert SHA2 High Assurance Server CA		 2019-04-09 -
2020-04-01		 a year crt.sh
g2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-05-03 -
2019-11-19		 7 months crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA		 2019-01-10 -
2021-01-14		 2 years crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA		 2019-01-23 -
2021-03-08		 2 years crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA		 2019-03-19 -
2021-04-13		 2 years crt.sh
*.taboola.com
DigiCert ECC Secure Server CA		 2019-09-03 -
2020-09-10		 a year crt.sh
*.twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-04-09 -
2020-04-01		 a year crt.sh
*.shoofle.tv
Sectigo RSA Domain Validation Secure Server CA		 2019-06-17 -
2021-07-06		 2 years crt.sh
*.pubmatic.com
Sectigo RSA Organization Validation Secure Server CA		 2019-02-22 -
2021-02-21		 2 years crt.sh

This page contains 11 frames:

Primary Page: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Frame ID: C2089B7BEFDBC6FE9EEA76F686060605
Requests: 101 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=5fbZx3NV5xhaMoMLrZV3TkN4&theme=standard&size=normal&cb=jzy550yxp46y
Frame ID: AE4A938F99272A1B2C00DCB5E762B5D2
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuRl1Ie9kbp3TBF_BVVsbSqwFm8yg4pAk2fW0_H5n4ozQqGcnWRY-i9FEpFTjW4-EGAYhkFBa7rpCLOwlWIOr_aqjKhuxxs7aebcg5FciZGrmcibY_2ssDQvDlEki6_gVuMQ1ZvaTVyD8H2TJmZhwHbda8VvPgU9U2OkE7hjetECGSbcvsLi2mk6ZnGz9llA-vweb1fMM-LmKfP9GTR8nISnM1iFGcqN3SEft0A0QT4e02eblhpwrxAwlDjXElh5MkkvgHon7Yn6oE&sai=AMfl-YT8BScrZg2SkQEB08ZkeR0KAA8-_378lCC-llA-xZqC2u8NDa4-2BuYGMbq7uMNxEGh_H8_x1-gE5jtY59o1dsLR_0vuVnJZvj6lBC0&sig=Cg0ArKJSzMTjhUNVXXEkEAE&urlfix=1&adurl=
Frame ID: 6B7AB087F706B61F64D6CCB23DD6FE1C
Requests: 5 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011910071804120/amp4ads-v0.js
Frame ID: 6892EFD1FDDFF72DF3BC2F53C80434BC
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011910071804120/amp4ads-v0.js
Frame ID: 2BBFC172C8F0D11B90CE5FD81165989A
Requests: 5 HTTP requests in this frame

Frame: https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=d7e69f62-2033-4f88-99c8-7b057a2fffef
Frame ID: 9B0808A1A2D5BA338FABE496505E25EC
Requests: 12 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=5fbZx3NV5xhaMoMLrZV3TkN4&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=ozqdnjm0oq90
Frame ID: BB4A427D72AE0B351E775318C0B54ADD
Requests: 1 HTTP requests in this frame

Frame: https://imprammp.taboola.com/st?cipid=66301605&ttype=0&cirid=303015A19D33132870766759132&cicmp=2040445&cijs=1&dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&tst=1&docw=0&cs=false
Frame ID: FA3E5D1E30A38F13ACFCA3BABA7496F0
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
Frame ID: B384932566FE153A13ABABAC8EFED889
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
Frame ID: 2A5021AAD7570BA0CCC350C1481D8244
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
Frame ID: 46AFDA3932626BCAC8DC6D99E5D428BB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • script /\.quantserve\.com\/quant\.js/i
Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

130
Requests

98 %
HTTPS

35 %
IPv6

33
Domains

53
Subdomains

32
IPs

7
Countries

2022 kB
Transfer

8189 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1358098868&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&ul=en-us&de=UTF-8&dt=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=2004446768&gjid=1387363689&cid=1836719399.1571941419&tid=UA-35676203-21&_gid=524497244.1571941419&_r=1&gtm=2wgaa0PM29HLF&z=1502339594 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_gid=524497244.1571941419&gjid=1387363689&_v=j79&z=1502339594 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_v=j79&z=1502339594 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_v=j79&z=1502339594&slf_rd=1&random=2261951385
Request Chain 72
  • https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1571941418858&ns_c=UTF-8&cv=3.1e&c8=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&c7=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1571941418858&ns_c=UTF-8&cv=3.1e&c8=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&c7=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&c9=
Request Chain 77
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola HTTP 302
  • https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=d7e69f62-2033-4f88-99c8-7b057a2fffef
Request Chain 79
  • https://px.powerlinks.com/user/identify?sourceId=d4a7a706-ab0f-11e8-a038-127202fb7690&rurl=https%3A%2F%2Ftrc.taboola.com%2Fsg%2Fpowerlinksdsp-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%24%7BUSER%7D HTTP 302
  • https://trc.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=J0cwMUbREhoXPNLiL4UXnZhfE5GmOjEf8ESwB1ZBcY4%3D
Request Chain 80
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://trc.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID] HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://trc.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]&mm_bnc&mm_bct&UUID=f3d85db1-e985-4700-af8b-7fd1f88d0d26 HTTP 302
  • https://trc.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=f3d85db1-e985-4700-af8b-7fd1f88d0d26 HTTP 302
  • https://match.taboola.com/sg/mediamath-ssp-network/1/rtb-h?taboola_hm=f3d85db1-e985-4700-af8b-7fd1f88d0d26&tbid=152337e4-65ca-4540-9cba-f74aeb62a729-tuct4ab71ab&query=taboola_hm%3Df3d85db1-e985-4700-af8b-7fd1f88d0d26
Request Chain 82
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm=&google_sc=&google_tc= HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESENPwPQbZZ7MawftYNy9utpg&google_cver=1 HTTP 302
  • https://match.taboola.com/sg/google-network/1/rtb-h?taboola_hm=CAESENPwPQbZZ7MawftYNy9utpg&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3DCAESENPwPQbZZ7MawftYNy9utpg%26google_cver%3D1
Request Chain 84
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=12ce1290-8112-45e2-9f31-6362cd3838d4 HTTP 302
  • https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=12ce1290-8112-45e2-9f31-6362cd3838d4&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D12ce1290-8112-45e2-9f31-6362cd3838d4
Request Chain 85
  • https://www.storygize.net/ccm/4b560cdd-91f9-422b-adb7-e9dff26bc3ad?u=247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa HTTP 302
  • https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=542517ea-efbb-4cbe-a58e-ac904b13af45 HTTP 302
  • https://match.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=542517ea-efbb-4cbe-a58e-ac904b13af45&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D542517ea-efbb-4cbe-a58e-ac904b13af45
Request Chain 88
  • https://x.bidswitch.net/sync?ssp=taboola HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola HTTP 302
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola HTTP 302
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola&bounced=1 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=9&user_id=L4tM7ec7lwq.AikABlFt_wKI0A&expires=30&ssp=taboola HTTP 302
  • https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=55c9705f-add4-4334-b85a-0949ff4d1b0a HTTP 302
  • https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=55c9705f-add4-4334-b85a-0949ff4d1b0a&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D55c9705f-add4-4334-b85a-0949ff4d1b0a

130 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
threatpost.com/click-fraud-malware-apple-app-store/149496/ 		79 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f257b5d964a6ebdb7a7d88539c3bb113c5b45d43cce59692df5350c4754808bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
threatpost.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

Server
nginx
Date
Thu, 24 Oct 2019 18:23:37 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
close
X-Frame-Options
SAMEORIGIN SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=149496>; rel=shortlink
x-cache-hit
HIT
Content-Encoding
gzip
main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 		217 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
d7ba44e03247efd9fab0368aa77fd4cc25bfd55d5b172327c48a371a12890673

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 15:52:40 GMT
Server
nginx
ETag
W/"5daf25c8-362da"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:38 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		66 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-kaspersky-widgets/css/trending-authors.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=f1d9c5ec
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
44ef9b8be9758f4944226128bcbd68f44fca4b8a4d272ad3288427bbd96accb8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 15:53:10 GMT
content-encoding
gzip
vary
Accept-Encoding
age
8228
x-cache
Hit from cloudfront
status
200
content-length
15126
last-modified
Tue, 22 Oct 2019 15:52:38 GMT
server
nginx
x-cache-hit
MISS
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
nyL_sF99ZC26gELpiyaPp17ztG_Oxv9JywJoPVqCZjchvwptC2HwpA==
expires
Wed, 23 Oct 2019 15:53:10 GMT
jquery.js
threatpost.com/wp-includes/js/jquery/ 		95 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Last-Modified
Mon, 14 Oct 2019 20:47:26 GMT
Server
nginx
ETag
W/"5da4dede-17a69"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:38 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		125 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/kaspersky-taboola-ads/assets/js/start.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=f1d9c5ec
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
d4888997522e2c66428a8b44d8dba9c89810bc50c6f3de6ffa54dd74da0c450b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 15:53:46 GMT
content-encoding
gzip
vary
Accept-Encoding
age
7983
x-cache
Hit from cloudfront
status
200
content-length
32329
last-modified
Tue, 22 Oct 2019 15:52:40 GMT
server
nginx
x-cache-hit
HIT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=utf-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
P5hNU2BtjFe7UwC_qM0qWmgSQ1Bfze8R9zRtT8iArcGa9F-vmiFDAw==
expires
Wed, 23 Oct 2019 15:53:39 GMT
/
kasperskycontenthub.com/ 		0
367 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1006456365&back=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 24 Oct 2019 18:23:38 GMT
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Connection
close
Content-Type
application/javascript
x-cache-hit
HIT
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-XSS-Protection
1; mode=block
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		47 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
ef16ce83de0d138cde0b703adecf7c3e5924da0e391378243cb5548ea5f7322b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"317 / 382 of 1000 / last-modified: 1571936660"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
14902
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
0.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15115541/0.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 17 Sep 2019 04:43:18 GMT
via
1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Mon, 20 Aug 2018 15:57:19 GMT
server
AmazonS3
age
969263
etag
"756a0525b47f4557fdfec408731afd91"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, FRA50-C1
accept-ranges
bytes
content-length
10662
x-amz-cf-id
J2Vt56xipRI29TDB-Y94C-z-8F9EFxn1szPAaLFKliQzTkv0nQlcag==
expires
Tue, 20 Aug 2019 15:57:18 GMT
apple-rainbow-logo.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/14080919/ 		57 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/14080919/apple-rainbow-logo.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e421edba3fc095e4a8d6fda08a403da99b2453732deaa10bfa2cf592aa44dac3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 12:22:35 GMT
via
1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Mon, 14 Oct 2019 12:09:21 GMT
server
AmazonS3
age
46132
etag
"f4a97442a78134996fabfb8d5bfe22c3"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA50-C1
accept-ranges
bytes
content-length
58552
x-amz-cf-id
UPs9w5DkI0al0P50LaUrrvzqdTWFbAJfWbZlEyqy1Vjc-g1k5OBIOw==
expires
Tue, 13 Oct 2020 12:09:19 GMT
subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 08 Sep 2019 02:37:10 GMT
via
1.1 f0dda47e8f83bee88cb60d3d2e3fa5e5.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Tue, 19 Feb 2019 20:14:58 GMT
server
AmazonS3
age
4031189
etag
"5ba45563f793f39ef6baf02645651654"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, FRA50-C1
accept-ranges
bytes
content-length
8281
x-amz-cf-id
uKs2i6mw-E-hI8vBtCBTHCDqGzmILwoQQBjpSkzVkM1PIqYPFN6uow==
expires
Wed, 19 Feb 2020 20:14:57 GMT
ios-apps-1024x306.png
media.threatpost.com/wp-content/uploads/sites/103/2019/10/24084918/ 		83 KB
84 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/24084918/ios-apps-1024x306.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
29e4982dc2c6576ec4d754b8440da0d3f024215f76d975497e14aedd163a55ef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 13:30:12 GMT
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Thu, 24 Oct 2019 12:49:20 GMT
server
AmazonS3
age
12667
etag
"cf625b5f51382e544b3f84542edd5218"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA50-C1
accept-ranges
bytes
content-length
85257
x-amz-cf-id
3SrQK-4ZpGLgoqqTASzZLcQbKczEXmy891NRCwfih2-EI-XR7L2I6A==
expires
Fri, 23 Oct 2020 12:49:18 GMT
tor_mobile_leakage-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/15162726/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/15162726/tor_mobile_leakage-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
33a19cbe9edc7a20d42a2149dd4e78c1e1bc5a54245b3b4e4bbacf8717131dee

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 15 Oct 2019 21:02:49 GMT
via
1.1 ee6ddabcc69c6aa1c28ad24a4a8f86b2.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Tue, 15 Oct 2019 20:27:29 GMT
server
AmazonS3
age
12667
etag
"cb428d47793a2ea9f1f62aae64ae336f"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA50-C1
accept-ranges
bytes
content-length
21466
x-amz-cf-id
O_V8V5Z73Toqb3zPtVe8fUHeeV53fzWeGLS62eOkQFziZurVD896vg==
expires
Wed, 14 Oct 2020 20:27:26 GMT
Mobile_Apps_Apple_iOS-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/28151813/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/28151813/Mobile_Apps_Apple_iOS-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6da8209d4a474e05bdcff6b40bfea097bc47d419e98ee193f796ebfa94910a53

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 04 Oct 2019 11:01:55 GMT
via
1.1 15d3b4db3728feaae1780610a1bac86e.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Tue, 28 Aug 2018 19:18:16 GMT
server
AmazonS3
age
12666
etag
"a824b2b51686c4f22f0f602d9a46289c"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1, FRA50-C1
accept-ranges
bytes
content-length
13020
x-amz-cf-id
nfRKxXENKxAOWx8l-_SiaP4mQ-S7Gx_yi12NVKzzBlBTQOE3R0fOcw==
expires
Wed, 28 Aug 2019 19:18:13 GMT
apple-rainbow-logo-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/14080919/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/14080919/apple-rainbow-logo-540x270.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eac173b38cb8a2dee61ed09d2cffc1ac3a8c28a3c222fe470623c25076eb1b4c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 14 Oct 2019 12:22:14 GMT
via
1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Mon, 14 Oct 2019 12:09:22 GMT
server
AmazonS3
age
17457
etag
"191413194eead0d841b6d0e29d9b3209"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C1, FRA50-C1
accept-ranges
bytes
content-length
28083
x-amz-cf-id
E_bir9RFfapEZ107TcWadQIhezbEz1UzRKaITL5RgzSkw-tWESWMJQ==
expires
Tue, 13 Oct 2020 12:09:19 GMT
api.js
www.google.com/recaptcha/ 		729 B
558 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
b604645aa60dc4db9af6c128efb3eaa6472460b5e4a80dd534c5be9ae21db37b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
465
x-xss-protection
1; mode=block
expires
Thu, 24 Oct 2019 18:23:38 GMT
ransomware_tag_cloud_key-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/01/14115123/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/01/14115123/ransomware_tag_cloud_key-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a25d6b15370e06383386c57fb5278ef22bc15d3151a8059303744f0388e8bbe3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 16 Oct 2019 20:15:17 GMT
via
1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Mon, 14 Jan 2019 16:51:25 GMT
server
AmazonS3
age
682877
etag
"25d6fb0ea662faf4a812406387e86c13"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA50-C1
accept-ranges
bytes
content-length
1272
x-amz-cf-id
kGilzGMic-AkPQDDoUGdMWa4HjTmGCb80s88kEYAVJt-9As5EaacVQ==
expires
Tue, 14 Jan 2020 16:51:23 GMT
threat-intelligence-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2019/09/25182707/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/09/25182707/threat-intelligence-64x64.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d877b654697728723f01959ffbf74d70842fe9cf331f721be5701b61c217638

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Sep 2019 12:02:17 GMT
via
1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Wed, 25 Sep 2019 22:27:10 GMT
server
AmazonS3
age
2442082
etag
"f55ce318620c1cf746202293c984dac2"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA50-C1
accept-ranges
bytes
content-length
4070
x-amz-cf-id
gwbxiHZUr-qA52TJIkkBfer0ESjFk32-kTXSwJe59HSS5t2__J_GkA==
expires
Thu, 24 Sep 2020 22:27:07 GMT
social_engineering-1-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/09/18142900/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/09/18142900/social_engineering-1-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
51b7a583b42d20f16fa2755abe0e8fd716b3ec9378ec42500b0d894927598326

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 18 Sep 2019 18:31:13 GMT
via
1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Wed, 18 Sep 2019 18:29:03 GMT
server
AmazonS3
age
3109946
etag
"a68c4b60ee4a35aab5ae3ce6df6a5d55"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, FRA50-C1
accept-ranges
bytes
content-length
2120
x-amz-cf-id
nVk5HWVk94FZ01GQZ4CgtQ6uwFf3uWmJaoC3SmJPIYFmZxHcKg2GoQ==
expires
Thu, 17 Sep 2020 18:29:00 GMT
insider-threat-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/09/10155113/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/09/10155113/insider-threat-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
535f401ad4d0562612b8bcadc5edb6c194cb6a275f3915511f9d023cfc69fe2a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 10 Sep 2019 20:14:28 GMT
via
1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Tue, 10 Sep 2019 19:51:16 GMT
server
AmazonS3
age
3794951
etag
"ec77dc87aa47f7ebe4f8e56810e98baa"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA53-C1, FRA50-C1
accept-ranges
bytes
content-length
1256
x-amz-cf-id
e7ZTzxx3IyVcGTPVdtpJ-0eJClm7U6AHIzS3lERYBUNZPXycV5-CMQ==
expires
Wed, 09 Sep 2020 19:51:13 GMT
gamification2-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/08/30125154/ 		1016 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2019/08/30125154/gamification2-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:2c00:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
93ebb1d614fa1e33c91a00ee803c268fcf812be0282ac38660f29a192109dc86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 06 Sep 2019 20:00:48 GMT
via
1.1 63db28734e1b9429c04087abd41a1692.cloudfront.net (CloudFront), 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
last-modified
Fri, 30 Aug 2019 16:52:12 GMT
server
AmazonS3
age
4141371
etag
"6d043114652213eb6ff41200f8d61f22"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=31536000
x-amz-cf-pop
FRA56, FRA50-C1
accept-ranges
bytes
content-length
1016
x-amz-cf-id
Vwt5yzcO-zdN4fgfAdHZxB1n4vFt7bXfJs9fJqkqNkfcxHUUqEawbQ==
expires
Sat, 29 Aug 2020 16:52:09 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=f1d9c5ec
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 15:59:15 GMT
content-encoding
gzip
vary
Accept-Encoding
age
8663
x-cache
Hit from cloudfront
status
200
content-length
935
last-modified
Tue, 22 Oct 2019 15:52:37 GMT
server
nginx
cache-control
max-age=86400
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=utf-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
x-cache-hit
MISS
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
fkUHo2IX0CNAny38cDzK7c2yN-NvsY_k2siV2yD-ddy08-zojNLDUg==
expires
Wed, 23 Oct 2019 15:53:10 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/gravityforms.min.js&ver=f1d9c5ec
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
a783d2ad42c380bc896219c080fa845d1e9f2e77483558103aeb296b95b85701
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 15:53:34 GMT
content-encoding
gzip
vary
Accept-Encoding
age
8663
x-cache
Hit from cloudfront
status
200
content-length
8382
last-modified
Tue, 22 Oct 2019 15:52:37 GMT
server
nginx
x-cache-hit
MISS
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=utf-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
OAf9yzeFGOkTsk05wavWoWzTnPN_hJ2wRPUq6oTZD_9KemidDtctrw==
expires
Fri, 25 Oct 2019 15:53:34 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-taboola-ads/assets/js/end.js,wp-includes/js/wp-embed.min.js,wp-content/plugins/gravityforms/js/conditional_logic.min.js,wp-content/plugins/gravityforms/js/placeholders.jquery.min.js,wp-content/plugins/akismet/_inc/form.js&ver=f1d9c5ec
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e697ae92648ccad15ada450ecbd959853b72bb5b977112896334a50ddfc1c0b4
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 15:54:51 GMT
content-encoding
gzip
vary
Accept-Encoding
age
5706
x-cache
Hit from cloudfront
status
200
content-length
4760
last-modified
Tue, 22 Oct 2019 15:52:38 GMT
server
nginx
x-cache-hit
HIT
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=utf-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
dZ2-BjIdVrBjVF95rqyLaru15ABxHKLBFR_hrZhymOlkLN3tvwalww==
expires
Wed, 23 Oct 2019 15:54:41 GMT
loader.js
cdn.taboola.com/libtrc/threatpost--network/ 		94 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/threatpost--network/loader.js
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/kaspersky-taboola-ads/assets/js/start.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=f1d9c5ec
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ceda3af3faa86679d8a627237eb1163f1e196b80cfcf3fe76325bcf2c018e7aa

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
u6m822XxLC2lQJnG9pGHEKa0PKBF5eRH
content-encoding
gzip
etag
"7e1ebf8bc4a548c514ed444d3b85c3fa"
age
0
x-cache
HIT
status
200
content-length
19367
x-amz-id-2
f1AWOuEMqe6Dvu57tF4K9w63ZiPUIaGvCdeOlSD6VbpgqDrJNWqZVt6q3ni/kkej3DxyzfIA83w=
x-served-by
cache-fra19122-FRA
last-modified
Tue, 22 Oct 2019 12:02:54 GMT
server
AmazonS3
x-timer
S1571941418.416658,VS0,VE101
date
Thu, 24 Oct 2019 18:23:38 GMT
vary
Accept-Encoding
x-amz-request-id
79AE5846A248D233
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
33
x-cache-hits
1
gtm.js
www.googletagmanager.com/ 		72 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
18d6c3cd87c2e73ec0772807d0c89af5393fbf030a618ad24467dcdc1fdc784a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
br
last-modified
Thu, 24 Oct 2019 18:00:00 GMT
server
Google Tag Manager
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24476
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 		11 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Sec-Fetch-Mode
same-origin
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
W/"5daf25c7-2b9f"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:38 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 		11 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099

Request headers

Sec-Fetch-Mode
same-origin
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
W/"5daf25c7-2b9f"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:38 GMT
integrator.js
adservice.google.de/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2019101701.js
securepubads.g.doubleclick.net/gpt/ 		157 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
ee9b85b63056ee85dac06408a3c33c0765f827efb47bfedf10fe266ee4566e1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Oct 2019 13:06:14 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
58640
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
"5daf25c7-4a32"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
18994
Expires
Thu, 31 Oct 2019 18:23:38 GMT
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
"5daf25c7-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20920
Expires
Fri, 23 Oct 2020 18:23:38 GMT
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:38 GMT
Server
nginx
ETag
"5daf25c6-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20900
Expires
Fri, 23 Oct 2020 18:23:38 GMT
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
"5daf25c7-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20680
Expires
Fri, 23 Oct 2020 18:23:38 GMT
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
"5daf25c7-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
20884
Expires
Fri, 23 Oct 2020 18:23:38 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/5fbZx3NV5xhaMoMLrZV3TkN4/ 		253 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/5fbZx3NV5xhaMoMLrZV3TkN4/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
bc5efe0814deaf9314fcd65d6c9d924ea008d2637945fae0acc3860c45deb1e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 21 Oct 2019 17:12:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 21 Oct 2019 04:03:56 GMT
server
sffe
age
263484
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
92268
x-xss-protection
0
expires
Tue, 20 Oct 2020 17:12:14 GMT
mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		828 B
722 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 15:52:38 GMT
Server
nginx
ETag
W/"5daf25c6-33c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:38 GMT
twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		868 B
847 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:39 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 15:52:38 GMT
Server
nginx
ETag
W/"5daf25c6-364"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:39 GMT
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:38 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
"5daf25c7-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000, public
Connection
close
Accept-Ranges
bytes
Content-Length
15820
Expires
Fri, 23 Oct 2020 18:23:38 GMT
mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		812 B
722 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:39 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Oct 2019 15:52:38 GMT
Server
nginx
ETag
W/"5daf25c6-32c"
Transfer-Encoding
chunked
Content-Type
image/svg+xml
Cache-Control
max-age=604800, public
Connection
close
Expires
Thu, 31 Oct 2019 18:23:39 GMT
logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1571759559
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:39 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:39 GMT
Server
nginx
ETag
"5daf25c7-260a"
Content-Type
image/png
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
9738
Expires
Thu, 31 Oct 2019 18:23:39 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		36 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=772389342565358&correlator=3182740994885846&output=ldjh&impl=fifs&adsid=NT&eid=21065003%2C21063636%2C21064169%2C21064550&vrg=2019101701&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-36&ecs=20191024&iu_parts=21707124336%2C2x2-Skin%2C970x250-ATF%2C300x250-ATF%2C300x600-ATF&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=2x2%2C970x250%7C728x90%2C300x250%2C300x600%7C300x250&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fclick-fraud-malware-apple-app-store%252F149496%252F%26urlquery%3Dgoogfc%26contentid%3D149496%26category%3Dmobile-security%26contenttags%3Dapp-store-1%252Capple-app%252Capps-0%252Cclick-fraud%252Cinfected-apps%252Cios-0%252Cmobile-security-2%252Ctrojan&cookie_enabled=1&bc=31&abxe=1&lmt=1571941418&dt=1571941418530&dlt=1571941418038&idt=460&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C308%2C1093%2C1093&adys=4576%2C0%2C407%2C1758&adks=2490549053%2C2675834513%2C974937504%2C960001541&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&dssz=24&icsg=49832&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x2%7C970x250%7C300x250%7C300x600&msz=1585x2%7C970x250%7C300x250%7C300x600&ga_vid=1836719399.1571941419&ga_sid=1571941419&ga_hid=1358098868&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
6f726674d71e4864c15ae4badea9e74375da2c4f3b64f382940cf6e62e2186f1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7940
x-xss-protection
0
google-lineitem-id
-2,4796908078,5203678523,5203316614
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,138290986863,138291905809,138291614123
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2019101701.js
securepubads.g.doubleclick.net/gpt/ 		64 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
a03faced3009fb10b52543aa37d64bf267dffd4ec013767368830361cc75454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 17 Oct 2019 13:06:14 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
24885
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-36/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
2944
date
Thu, 24 Oct 2019 17:34:34 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Thu, 24 Oct 2019 19:34:34 GMT
quant.js
secure.quantserve.com/ 		12 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.140 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS
Software
QS /
Resource Hash
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24-Oct-2019 18:23:38 GMT
Server
QS
ETag
M0-e2b9884a
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=604800
Connection
keep-alive
Content-Length
5456
Expires
Thu, 31 Oct 2019 18:23:38 GMT
uwt.js
static.ads-twitter.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
/
Resource Hash
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
age
36613
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200
content-length
1954
x-served-by
cache-fra19143-FRA
last-modified
Tue, 23 Jan 2018 20:09:00 GMT
x-timer
S1571941419.585796,VS0,VE0
etag
"b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary
Accept-Encoding,Host
content-type
application/javascript; charset=utf-8
via
1.1 varnish
cache-control
no-cache
accept-ranges
bytes
impl.20191022-13-RELEASE.js
cdn.taboola.com/libtrc/ 		390 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.20191022-13-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/threatpost--network/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fff4fe60bda732b610f29654ec2efbe62a489e71b526db88df24bb91c519c640

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
YhqAnN6cEmq91P1u0N9cpPVPx.pAlMi_
content-encoding
gzip
etag
"4f856707ca4034a3514c0b002847f3cf"
age
25194
x-cache
HIT
status
200
x-amz-replication-status
PENDING
content-length
112690
x-amz-id-2
S4TYy2Ha7bAQXo6cSbvQPml0UGXXRa6nBzfmCdY1ofcyGOt1WskJOG+S+at03cPII8JGcqoqw/0=
x-served-by
cache-fra19122-FRA
last-modified
Thu, 24 Oct 2019 11:23:40 GMT
server
AmazonS3
x-timer
S1571941419.592613,VS0,VE0
date
Thu, 24 Oct 2019 18:23:38 GMT
vary
Accept-Encoding
x-amz-request-id
DBE095F3C80DB4AB
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
51
x-cache-hits
134781
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/threatpost--network/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 24 Oct 2019 18:23:38 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Fri, 25 Oct 2019 18:23:38 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=1358098868&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&ul=en-us&de=UTF-8&dt=Apple...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_gid=524497244.1571941419&gjid=1387363689&_v=j79&z=1502339594
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_v=j79&z=1502339594
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_v=j79&z=1502339594&slf_rd=1&random=2261951385
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_v=j79&z=1502339594&slf_rd=1&random=2261951385
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Oct 2019 18:23:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 24 Oct 2019 18:23:38 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=1836719399.1571941419&jid=2004446768&_v=j79&z=1502339594&slf_rd=1&random=2261951385
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Sec-Fetch-Mode
cors
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-kaspersky-widgets/css/trending-authors.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=f1d9c5ec
Origin
https://threatpost.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 02 Jun 2019 00:48:21 GMT
via
1.1 5317564e96c9dceb46123f6c5f149a03.cloudfront.net (CloudFront)
age
12504917
x-cache
Hit from cloudfront
status
200
content-length
77160
pragma
public
last-modified
Fri, 31 May 2019 08:42:19 GMT
server
nginx
etag
"5cf0e8eb-12d68"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000, public
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-amz-cf-id
7tRlfORUzGGEMYSkWsar-8tS9OCY0A9mW2lOzGc6ZOiUTKQqye849Q==
expires
Mon, 01 Jun 2020 00:48:21 GMT
photo-newsletter.jpg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		83 KB
83 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/photo-newsletter.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
940e0c3385928422aae38e1a74f1d84b462d8ce1a056c686fde505a0bf3162bb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
public
Date
Thu, 24 Oct 2019 18:23:39 GMT
Last-Modified
Tue, 22 Oct 2019 15:52:40 GMT
Server
nginx
ETag
"5daf25c8-14c88"
Content-Type
image/jpeg
Cache-Control
max-age=604800, public
Connection
close
Accept-Ranges
bytes
Content-Length
85128
Expires
Thu, 31 Oct 2019 18:23:39 GMT
anchor
www.google.com/recaptcha/api2/ Frame AE4A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=5fbZx3NV5xhaMoMLrZV3TkN4&theme=standard&size=normal&cb=jzy550yxp46y
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5fbZx3NV5xhaMoMLrZV3TkN4/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-RSYi506YcyB+pezk4EFj1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=5fbZx3NV5xhaMoMLrZV3TkN4&theme=standard&size=normal&cb=jzy550yxp46y
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 24 Oct 2019 18:23:38 GMT
content-security-policy
script-src 'report-sample' 'nonce-RSYi506YcyB+pezk4EFj1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
9113
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
view
securepubads.g.doubleclick.net/pcs/ Frame 6B7A 		0
273 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuRl1Ie9kbp3TBF_BVVsbSqwFm8yg4pAk2fW0_H5n4ozQqGcnWRY-i9FEpFTjW4-EGAYhkFBa7rpCLOwlWIOr_aqjKhuxxs7aebcg5FciZGrmcibY_2ssDQvDlEki6_gVuMQ1ZvaTVyD8H2TJmZhwHbda8VvPgU9U2OkE7hjetECGSbcvsLi2mk6ZnGz9llA-vweb1fMM-LmKfP9GTR8nISnM1iFGcqN3SEft0A0QT4e02eblhpwrxAwlDjXElh5MkkvgHon7Yn6oE&sai=AMfl-YT8BScrZg2SkQEB08ZkeR0KAA8-_378lCC-llA-xZqC2u8NDa4-2BuYGMbq7uMNxEGh_H8_x1-gE5jtY59o1dsLR_0vuVnJZvj6lBC0&sig=Cg0ArKJSzMTjhUNVXXEkEAE&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 24 Oct 2019 18:23:38 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 6B7A 		77 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
9954117730a3bd5adc895ed472e2d2828a8e1961cd9cd6b817e792b5fe929564
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571829475333115"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29336
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
imgad
tpc.googlesyndication.com/pagead/ Frame 6B7A 		52 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/imgad?id=CICAgKCb5amF2gEQARgBMgjwCbBk1fBnzA
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
5cfa0122469a2e49d8dd4ae1481977846e8ce3bfb23864ccb5fef66dbdabe685
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 19 Oct 2019 10:02:49 GMT
x-content-type-options
nosniff
server
cafe
age
462049
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
status
200
cache-control
public, max-age=604800
content-disposition
attachment; filename="image.png"
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
53512
x-xss-protection
0
expires
Sat, 26 Oct 2019 10:02:49 GMT
osd.js
www.googletagservices.com/activeview/js/current/ 		77 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6ea513209d279ad98847b40b2efafa36378a2b57dc720e66103d0e102cf53230
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1571829475333115"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29164
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
amp4ads-host-v0.js
cdn.ampproject.org/rtv/011910071804120/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011910071804120/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8055b71507df36a9a9d807b0799d9c26533101139e1078ea222897c02ad854c5
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"c4c4a08298eb0376"
age
513895
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
7118
x-xss-protection
0
server
sffe
date
Fri, 18 Oct 2019 19:38:43 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 17 Oct 2020 19:38:43 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/011910071804120/ Frame 6892 		251 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011910071804120/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
93dd062566471fa91604aee574ff8f6e78e80bd20b01f5e080adb0ac61680f94
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"6fedf66162310d96"
age
513880
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
69642
x-xss-protection
0
server
sffe
date
Fri, 18 Oct 2019 19:38:58 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 17 Oct 2020 19:38:58 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/011910071804120/v0/ Frame 6892 		150 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011910071804120/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
aa95eb8757140f09d3424399b939ed3f10a20c45c6c52476c614c9bc375eb667
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"8beba9134cdf5c44"
age
221499
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
40847
x-xss-protection
0
server
sffe
date
Tue, 22 Oct 2019 04:51:59 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Wed, 21 Oct 2020 04:51:59 GMT
truncated
/ Frame 6892 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
207cad30f45a95be52c86a9c62162615ca55e51bbd5fbdc3782a3fba08a9bc05

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-v0.js
cdn.ampproject.org/rtv/011910071804120/ Frame 2BBF 		251 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011910071804120/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
93dd062566471fa91604aee574ff8f6e78e80bd20b01f5e080adb0ac61680f94
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"6fedf66162310d96"
age
513880
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
69642
x-xss-protection
0
server
sffe
date
Fri, 18 Oct 2019 19:38:58 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Sat, 17 Oct 2020 19:38:58 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/011910071804120/v0/ Frame 2BBF 		150 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/011910071804120/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019101701.js?21065003
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
aa95eb8757140f09d3424399b939ed3f10a20c45c6c52476c614c9bc375eb667
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
br
etag
"8beba9134cdf5c44"
age
221499
status
200
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
40847
x-xss-protection
0
server
sffe
date
Tue, 22 Oct 2019 04:51:59 GMT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-content-type-options
nosniff
expires
Wed, 21 Oct 2020 04:51:59 GMT
truncated
/ Frame 2BBF 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7ed51e3834e97bd11fcfd4bd95afd7de0b01082dd61c41d4a3c5c4208bc8dde

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
17005452282922285100
tpc.googlesyndication.com/simgad/ Frame 6892 		22 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/17005452282922285100
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8af9277beea03fa6657fbefb20592a05e592b3ca05d824ea2f4e92e42eb0910e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 04:22:24 GMT
x-content-type-options
nosniff
age
50474
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
23027
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 15:07:16 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 23 Oct 2020 04:22:24 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 6892 		0
255 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsswDOVyqMVWxKOvhRT6FVNkvgKYv6JpLHXGvgTYzRHz2QF1qjpgLizZBx3mUpYym3qVJJDSVs-aMy91T5McvRD21wxSqkjSx1ApcQs0bfIeCXWPTyNAlThALFI6yShInoW9TN5MEgoWCs-l9mpNFeNXzamfc9zW_8G-jlPvixQib74zR13V26i3PzqcXgDh6qAgRCqkcMPkiYmNMqXNgF5NE8QsxkTYlGakoPnq9oTdxl0nOlk893agwkRU0f_VDvEYI7fyC0g&sai=AMfl-YTcCUelGMS7ql_gZfNhOozGkkpCQd70ccZGnUmZ0NMQLHm815Ng_pUnbz-2nOjsfWEef37e0XhwqTCOwgwI_03sF0IJhnoIPW7xN54T&sig=Cg0ArKJSzKM91j7G-W3VEAE&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 24 Oct 2019 18:23:38 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
17005452282922285100
tpc.googlesyndication.com/simgad/ Frame 2BBF 		22 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/17005452282922285100
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8af9277beea03fa6657fbefb20592a05e592b3ca05d824ea2f4e92e42eb0910e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 04:22:24 GMT
x-content-type-options
nosniff
age
50474
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
23027
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 15:07:16 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 23 Oct 2020 04:22:24 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2BBF 		0
257 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuxPDtUg-itkBQ3GHbIDfzF4i2-u9TmmMggd98T26WrSA_XgIq8GOERJmJFb4RaoKjJyN3xABnPstjOe34ichedM9JTBc5Oxy57PFUrqPoqu1C6t33BcqBB8OEbk5nD6XW952-nQO7CD6ntbmCXVEaIbBdhP3OQqgjHwz370YbBI3RJT8Hah9WALDDADkU5ezeSVGxC_bf6osm5hPuSwEESgk46oqFpr2LzCZbMBzW5UaEhsjcrh4sN8cL3Mjtyl8x-LTbgyI&sai=AMfl-YTYy7Fj7mznQEKSrPEpBDXHH9SX_7bD2y_3hKRRFCC96hQFYsqj0Da2JDb_h-8IzMZCMfxnyk4mO_zkZUqkd_vELFMxaAvPxQT5bmuJ&sig=Cg0ArKJSzJ39dLz2oqL7EAE&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 24 Oct 2019 18:23:38 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 24 Oct 2019 18:23:38 GMT
/
graph.facebook.com/ 		81 B
523 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
d4fce035ac2ea5e9b166432dfd277d39acc9a11ee164df2479f0928fd7545a61
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

strict-transport-security
max-age=15552000; preload
etag
"f2f684e209775a56e5c2d46b626fb893460a64a0"
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
x-fb-rev
1001337263
alt-svc
h3-23=":443"; ma=3600
content-length
81
pragma
no-cache
x-fb-debug
iwz5glqiI8ADgulBV9PmfEotlyl9jauYYhmxZOJZ6TNxTaGJ2fDKDs9NppYMPOfmnPCRa0ttYsfQWoaQ0N3hqA==
x-fb-trace-id
H9KTLUp7q9v
date
Thu, 24 Oct 2019 18:23:38 GMT
content-type
application/json
access-control-allow-origin
*
x-fb-request-id
Acn1Grkf7lkPzwq3isftw90
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.10
expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&format=jsonp&callback=jQuery112409097582365751098_1571941418403&_=1571941418404
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:f500:10:101::b93f:9101 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers
info.json
www.reddit.com/api/ 		102 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.140 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
snooserv /
Resource Hash
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 24 Oct 2019 18:23:41 GMT
via
1.1 varnish
x-content-type-options
nosniff
x-cache
MISS
status
200
content-length
102
x-xss-protection
1; mode=block
x-served-by
cache-fra19133-FRA
x-moose
majestic
expires
-1
server
snooserv
x-timer
S1571941419.806559,VS0,VE3076
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, max-age=0, must-revalidate
x-ua-compatible
IE=edge
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/threatpost-threatpost/trc/3/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/threatpost-threatpost/trc/3/json?tim=20%3A23%3A38.840&lti=deflated&data=%7B%22id%22%3A598%2C%22ii%22%3A%22%2Fclick-fraud-malware-apple-app-store%2F149496%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1571941418811%2C%22cv%22%3A%2220191022-13-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A4496%2C%22nsid%22%3A%22threatpost--network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dthreatpost--network%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A3044.171875%2C%22mw%22%3A700%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191022-13-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
83080b9eb5de669f48ad6d6dbad3731c431713ccb27f9152d683924093f2a8ee

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
server
nginx
x-timer
S1571941419.846850,VS0,VE136
status
200
x-served-by
cache-fra19122-FRA
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
adsct
t.co/i/ 		43 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
111
pragma
no-cache
last-modified
Thu, 24 Oct 2019 18:23:38 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
2311b09c010d2dd199d281f590403777
x-transaction
0004a209007f4c35
expires
Tue, 31 Mar 1981 05:00:00 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1571941418858&ns_c=UTF-8&cv=3.1e&c8=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&c7...
  • https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1571941418858&ns_c=UTF-8&cv=3.1e&c8=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&c...
0
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1571941418858&ns_c=UTF-8&cv=3.1e&c8=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&c7=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&c9=
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-97-37.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:38 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1571941418858&ns_c=UTF-8&cv=3.1e&c8=Apple%20Removes%2017%20Malicious%20iOS%20Apps%20From%20App%20Store%20%7C%20Threatpost&c7=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&c9=
Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:38 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/ 		3 B
356 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:19 GMT
via
1.1 32e4d419823b7f8df8417a8b18c9602d.cloudfront.net (CloudFront)
last-modified
Fri, 03 Mar 2017 23:52:35 GMT
server
AmazonS3
age
21
etag
"8a80554c91d9fca8acb82f023de02f11"
x-cache
Error from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=300
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
3
x-amz-cf-id
A1P9Wum1wfBCFaFO6n1DrUkoLqTE2tYN3Nk4gTN7Vd-fa8Y426FIdw==
truncated
/ Frame 6B7A 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eeccbdbb3eabba05bd3b426e8c4cd285edb39ab3189a6fa4114d7d4902aa868a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
tb
15.taboola.com/ 		20 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://15.taboola.com/tb?oid=15&pubnm=threatpost-threatpost&unitType=59&tbloc=&pageType=text&pstn=Slider%20-%20Video&uuip=&cisrf=&cirf=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F&encoded=1&uid=247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa&variant=-100|1&callback=TRC.videoTagCallbacks.videoCallback1&cb=1571941419163&tagid=&cntry=DE&platform=1&sesid=d9795c65458cbfc6a59270786eebdea6&itemid=/click-fraud-malware-apple-app-store/149496&viewid=1571941418811&geolat=&geoing=&deviceifa=&appid=&sd=v2_d9795c65458cbfc6a59270786eebdea6_247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa_1571941418_1571941418_CNawjgYQ459IGLuOivjfLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA&ri=c8b2abd396344b9deac2d76c8adad641&appname=&cdb=&gdprApplies=&rid=&sii=5269529916756095833
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191022-13-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
8d6443a072062bc36c83d746129ed9da8ba231f35429a43f0e83d88f7de329f3

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.196973,VS0,VE15
machineid
1450
x-cache
MISS
content-type
text/html;charset=ISO-8859-1
status
200
expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
x-cache-hits
0
accept-ranges
bytes
x-served-by
cache-fra19125-FRA
userx.20191022-13-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.20191022-13-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/threatpost--network/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fa419a6433307dc90dec6b7907ce9affac386bbb904f234317a15c1b4227abdd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
PhG7Gje2LkM9wUVk7AGbUTnZHKBRXwlR
content-encoding
gzip
etag
"41f2fe3c8b53f6cb18410b7315441795"
age
25189
x-cache
HIT
status
200
x-amz-replication-status
PENDING
content-length
7712
x-amz-id-2
YEWblNHjPV1XbsvJrhLrK6u8Q2irgL49UaceQyWOyJXMdpWCDIQgMcNb+lDI+BdDmRwyyyHMWUo=
x-served-by
cache-fra19122-FRA
last-modified
Thu, 24 Oct 2019 11:23:49 GMT
server
AmazonS3
x-timer
S1571941419.169088,VS0,VE0
date
Thu, 24 Oct 2019 18:23:39 GMT
vary
Accept-Encoding
x-amz-request-id
033FDAFC58B7A877
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
51
x-cache-hits
91547
rtb-h
trc.taboola.com/sg/mediaforcebidder-network/1/ Frame 9B08
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
  • https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=d7e69f62-2033-4f88-99c8-7b057a2fffef
0
168 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=d7e69f62-2033-4f88-99c8-7b057a2fffef
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.222539,VS0,VE12
x-cache
MISS
status
204
x-cache-hits
0
accept-ranges
bytes
x-served-by
cache-fra19122-FRA

Redirect headers

Location
//trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=d7e69f62-2033-4f88-99c8-7b057a2fffef
Date
Thu, 24 Oct 2019 18:23:39 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
sync.php
pixel.rubiconproject.com/exchange/ Frame 9B08 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=16698
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
4b510f0cc5fcbc9800016ef543086418
Content-Type
image/gif
/
trc.taboola.com/sg/powerlinksdsp-network/1/rtb-h/ Frame 9B08
Redirect Chain
  • https://px.powerlinks.com/user/identify?sourceId=d4a7a706-ab0f-11e8-a038-127202fb7690&rurl=https%3A%2F%2Ftrc.taboola.com%2Fsg%2Fpowerlinksdsp-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%24%7BUSER%7D
  • https://trc.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=J0cwMUbREhoXPNLiL4UXnZhfE5GmOjEf8ESwB1ZBcY4%3D
45 B
228 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=J0cwMUbREhoXPNLiL4UXnZhfE5GmOjEf8ESwB1ZBcY4%3D
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.223860,VS0,VE12
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
x-served-by
cache-fra19122-FRA

Redirect headers

Location
https://trc.taboola.com/sg/powerlinksdsp-network/1/rtb-h/?taboola_hm=J0cwMUbREhoXPNLiL4UXnZhfE5GmOjEf8ESwB1ZBcY4%3D
Date
Thu, 24 Oct 2019 18:23:39 GMT
Server
nginx
Connection
close
Etag
"J0cwMUbREhoXPNLiL4UXnZhfE5GmOjEf8ESwB1ZBcY4="
Content-Length
0
rtb-h
match.taboola.com/sg/mediamath-ssp-network/1/ Frame 9B08
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://trc.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]
  • https://sync.mathtag.com/sync/img?mt_exid=92&redir=https://trc.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=[MM_UUID]&mm_bnc&mm_bct&UUID=f3d85db1-e985-4700-af8b-7fd1f88d0d26
  • https://trc.taboola.com/sg/mediamath-ssp-network/1/rtb-h/?taboola_hm=f3d85db1-e985-4700-af8b-7fd1f88d0d26
  • https://match.taboola.com/sg/mediamath-ssp-network/1/rtb-h?taboola_hm=f3d85db1-e985-4700-af8b-7fd1f88d0d26&tbid=152337e4-65ca-4540-9cba-f74aeb62a729-tuct4ab71ab&query=taboola_hm%3Df3d85db1-e985-470...
0
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/mediamath-ssp-network/1/rtb-h?taboola_hm=f3d85db1-e985-4700-af8b-7fd1f88d0d26&tbid=152337e4-65ca-4540-9cba-f74aeb62a729-tuct4ab71ab&query=taboola_hm%3Df3d85db1-e985-4700-af8b-7fd1f88d0d26
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.254035,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4035-HHN

Redirect headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.240044,VS0,VE9
x-served-by
cache-fra19122-FRA
status
302
x-cache
MISS
location
https://match.taboola.com/sg/mediamath-ssp-network/1/rtb-h?taboola_hm=f3d85db1-e985-4700-af8b-7fd1f88d0d26&tbid=152337e4-65ca-4540-9cba-f74aeb62a729-tuct4ab71ab&query=taboola_hm%3Df3d85db1-e985-4700-af8b-7fd1f88d0d26
accept-ranges
bytes
content-length
0
x-cache-hits
0
getuidnb
ib.adnxs.com/ Frame 9B08 		43 B
690 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/getuidnb?https://trc.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=$UID
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.249 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:41 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 534.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.89:80
AN-X-Request-Uuid
e6051bbe-e92b-45a7-bffe-3fad166a8366
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rtb-h
match.taboola.com/sg/google-network/1/ Frame 9B08
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm=&google_sc=&google_tc=
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESENPwPQbZZ7MawftYNy9utpg&google_cver=1
  • https://match.taboola.com/sg/google-network/1/rtb-h?taboola_hm=CAESENPwPQbZZ7MawftYNy9utpg&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3DCAESENPwPQbZZ7MawftYNy9utpg%26goo...
0
76 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/google-network/1/rtb-h?taboola_hm=CAESENPwPQbZZ7MawftYNy9utpg&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3DCAESENPwPQbZZ7MawftYNy9utpg%26google_cver%3D1
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.253316,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4035-HHN

Redirect headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.236076,VS0,VE9
x-served-by
cache-fra19122-FRA
status
302
x-cache
MISS
location
https://match.taboola.com/sg/google-network/1/rtb-h?taboola_hm=CAESENPwPQbZZ7MawftYNy9utpg&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3DCAESENPwPQbZZ7MawftYNy9utpg%26google_cver%3D1
accept-ranges
bytes
content-length
0
x-cache-hits
0
getuidnb
ib.adnxs.com/ Frame 9B08 		43 B
691 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/getuidnb?https://trc.taboola.com/sg/nca-appnexus-network/1/rtb-h/?taboola_hm=$UID
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.249 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:41 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 534.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.235:80
AN-X-Request-Uuid
b5e97cdc-67b6-496d-98cd-bab5df48c5f3
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rtb-h
match.taboola.com/sg/thetradedesk-network/1/ Frame 9B08
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=12ce1290-8112-45e2-9f31-6362cd3838d4
  • https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=12ce1290-8112-45e2-9f31-6362cd3838d4&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D12ce1290-8112-45e2...
0
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=12ce1290-8112-45e2-9f31-6362cd3838d4&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D12ce1290-8112-45e2-9f31-6362cd3838d4
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.268383,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4035-HHN

Redirect headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.254983,VS0,VE9
x-served-by
cache-fra19122-FRA
status
302
x-cache
MISS
location
https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=12ce1290-8112-45e2-9f31-6362cd3838d4&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D12ce1290-8112-45e2-9f31-6362cd3838d4
accept-ranges
bytes
content-length
0
x-cache-hits
0
rtb-h
match.taboola.com/sg/storygize-network/1/ Frame 9B08
Redirect Chain
  • https://www.storygize.net/ccm/4b560cdd-91f9-422b-adb7-e9dff26bc3ad?u=247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa
  • https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=542517ea-efbb-4cbe-a58e-ac904b13af45
  • https://match.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=542517ea-efbb-4cbe-a58e-ac904b13af45&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D542517ea-efbb-4cbe-a5...
0
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=542517ea-efbb-4cbe-a58e-ac904b13af45&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D542517ea-efbb-4cbe-a58e-ac904b13af45
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.420498,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4035-HHN

Redirect headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.396837,VS0,VE9
x-served-by
cache-fra19122-FRA
status
302
x-cache
MISS
location
https://match.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=542517ea-efbb-4cbe-a58e-ac904b13af45&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D542517ea-efbb-4cbe-a58e-ac904b13af45
accept-ranges
bytes
content-length
0
x-cache-hits
0
cookiesync
bttrack.com/pixel/ Frame 9B08 		35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=14b8c562-d12b-418b-b680-ad517d5839ec
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
192.132.33.46 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),
Reverse DNS
46.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-ServerName
Track004-dc3
Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:38 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
/
cds.taboola.com/ Frame 9B08 		0
292 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cds.taboola.com/?uid=247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa&_r=8281368
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
130.211.13.252 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
252.13.211.130.bc.googleusercontent.com
Software
nginx/1.16.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 24 Oct 2019 18:23:39 GMT
Via
1.1 varnish
Server
nginx/1.16.1
X-Timer
S1571941419.466794,VS0,VE10
X-Served-By
cache-bwi5030-BWI
X-Cache
MISS
x-envoy-upstream-service-time
1
Connection
close
Accept-Ranges
bytes
Content-Length
0
X-Cache-Hits
0
rtb-h
match.taboola.com/sg/bidswitch-network/1/ Frame 9B08
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola
  • https://px.adhigh.net/p/cm/bsw?bidswitch_ssp_id=taboola&bounced=1
  • https://x.bidswitch.net/sync?dsp_id=9&user_id=L4tM7ec7lwq.AikABlFt_wKI0A&expires=30&ssp=taboola
  • https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=55c9705f-add4-4334-b85a-0949ff4d1b0a
  • https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=55c9705f-add4-4334-b85a-0949ff4d1b0a&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D55c9705f-add4-4334-b8...
0
69 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=55c9705f-add4-4334-b85a-0949ff4d1b0a&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D55c9705f-add4-4334-b85a-0949ff4d1b0a
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.390905,VS0,VE8
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn4035-HHN

Redirect headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.302317,VS0,VE9
x-served-by
cache-fra19122-FRA
status
302
x-cache
MISS
location
https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=55c9705f-add4-4334-b85a-0949ff4d1b0a&tbid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab&query=taboola_hm%3D55c9705f-add4-4334-b85a-0949ff4d1b0a
accept-ranges
bytes
content-length
0
x-cache-hits
0
bframe
www.google.com/recaptcha/api2/ Frame BB4A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=5fbZx3NV5xhaMoMLrZV3TkN4&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=ozqdnjm0oq90
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/5fbZx3NV5xhaMoMLrZV3TkN4/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-EFVasVI64mvKBBk2WdPXQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=5fbZx3NV5xhaMoMLrZV3TkN4&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=ozqdnjm0oq90
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Thu, 24 Oct 2019 18:23:39 GMT
content-security-policy
script-src 'report-sample' 'nonce-EFVasVI64mvKBBk2WdPXQA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1116
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
available
trc.taboola.com/threatpost-threatpost/log/3/ 		0
124 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/threatpost-threatpost/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191022-13-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx
x-timer
S1571941419.210139,VS0,VE9
x-served-by
cache-fra19122-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://threatpost.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
86da755d720f7d5bb118d53222e0a3e2.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/86da755d720f7d5bb118d53222e0a3e2.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
ac63fc884a3efa6f723411bccd5698adf0261b95bf20209e9ed91f01313d2c98

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish, 1.1 varnish
age
2183906
edge-cache-tag
306709557426642059975705854287940315032,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sun, 06 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/86da755d720f7d5bb118d53222e0a3e2.jpg
content-length
21637
x-served-by
cache-fra19151-FRA, cache-fra19122-FRA
last-modified
Thu, 05 Sep 2019 07:04:54 GMT
server
cloudinary
x-timer
S1571941419.261834,VS0,VE0
etag
"4384733d5796b3df154fed0b37e276dd"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 358
613ff115e6b2e6c2997c65b4bcc4623a.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/613ff115e6b2e6c2997c65b4bcc4623a.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
924f9036fb869592346fb06ad94fcaf642d2aeb89adf880ff0793ff53af1954c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish, 1.1 varnish
age
2239414
edge-cache-tag
316508176216407778497372083154954387453,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Fri, 18 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/613ff115e6b2e6c2997c65b4bcc4623a.jpeg
content-length
19258
x-served-by
cache-fra19156-FRA, cache-fra19122-FRA
last-modified
Tue, 17 Sep 2019 16:17:47 GMT
server
cloudinary
x-timer
S1571941419.268072,VS0,VE0
etag
"246bfc8a100cd4cc871a4fbc276225e0"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 11
34f0e7b1fe67e45e1c92cbc1ae79d8bc.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/34f0e7b1fe67e45e1c92cbc1ae79d8bc.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
ea8efe086f3497ea294ac7e2823612d95b179354a18a4a9ba20e152ff91b5d4a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish, 1.1 varnish
age
1513545
edge-cache-tag
352292209635462851067231902481677527590,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Wed, 16 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/34f0e7b1fe67e45e1c92cbc1ae79d8bc.jpg
content-length
17205
x-served-by
cache-fra19140-FRA, cache-fra19122-FRA
last-modified
Sun, 15 Sep 2019 20:47:51 GMT
server
cloudinary
x-timer
S1571941419.268844,VS0,VE0
etag
"8956507982149b1e2202cfc57443b053"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2
9c59c928099bf8ed80bbda0934b3036d.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9c59c928099bf8ed80bbda0934b3036d.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
a325b567a51ff594ad3e9a25cad9d81972801934622c20c0abae0c47b4cb8c62

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish, 1.1 varnish
age
51415
edge-cache-tag
479976357791226356304736130931664362477,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Sat, 26 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9c59c928099bf8ed80bbda0934b3036d.jpg
content-length
16102
x-served-by
cache-fra19160-FRA, cache-fra19122-FRA
last-modified
Wed, 25 Sep 2019 08:15:36 GMT
server
cloudinary
x-timer
S1571941419.269722,VS0,VE0
etag
"92d18f32daeeb5f8c73a37006d444e00"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 6
4def6df2115bc0cea867470c716b3e03.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4def6df2115bc0cea867470c716b3e03.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
33b3e630182f83b20f1396b178ba597d2137ee088327f09f90e65ac496d98461

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish, 1.1 varnish
age
620974
edge-cache-tag
605508262898155247126897647160468307805,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4def6df2115bc0cea867470c716b3e03.jpeg
content-length
34423
x-request-id
713543aec3389bd711e99914550be65f
x-served-by
cache-fra19162-FRA, cache-fra19122-FRA
last-modified
Wed, 16 Oct 2019 15:05:41 GMT
server
cloudinary
x-timer
S1571941419.275623,VS0,VE0
etag
"b85c1d64b7fabf95830f768338d92913"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 355
39b06bf0f4ea6c4d74132559541b141c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		25 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/39b06bf0f4ea6c4d74132559541b141c.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
de1c3d061188be2af1c610612f342394b3604a4e4825648562b948137acfc57e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish, 1.1 varnish
age
1952485
edge-cache-tag
394271290409443060900547420849081351149,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200
expiration
expiry-date="Thu, 03 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/39b06bf0f4ea6c4d74132559541b141c.jpg
content-length
25673
x-served-by
cache-fra19179-FRA, cache-fra19122-FRA
last-modified
Mon, 02 Sep 2019 06:58:19 GMT
server
cloudinary
x-timer
S1571941419.275739,VS0,VE1
etag
"8d20c18d5c6957d0e85ec96ad581ec0a"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 		254 B
756 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191022-13-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
23491
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
Vjnfq2okxpLEG/cBVxSfv3DOOCGN7KTpixt29L7DwUhoZL6eRlgDSODZqhfatrYL58q01gaLKf4=
x-served-by
cache-fra19122-FRA
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1571941419.278788,VS0,VE0
date
Thu, 24 Oct 2019 18:23:39 GMT
x-amz-request-id
F6D91014AAA6CDC4
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
84
x-cache-hits
35436
creative_js.js
vidstat.taboola.com/vpaid/units/14_12_0/creatives/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191022-13-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
10eba73b3641332bde05fa8d6223e7017ac5207673602247c35f358ea89e3092

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 c90147ea5199ff7ce77981c8da4247c4.cloudfront.net (CloudFront), 1.1 varnish
age
1513658
x-amz-meta-mtime
1499351521
x-cache
Hit from cloudfront, HIT
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-length
1827
x-served-by
cache-hhn4032-HHN
last-modified
Wed, 06 Sep 2017 08:46:00 GMT
server
AmazonS3
x-timer
S1571941419.281522,VS0,VE0
etag
"0df6cb700db4e2c8b3b7dcb734e91cb0"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
7gUcLzi9Khb5x-2SymG6R2mlKzrS3XKJ2sLgDHJDdcYZJ_oPKcTwKw==
x-cache-hits
3895621
st
imprammp.taboola.com/ Frame FA3E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://imprammp.taboola.com/st?cipid=66301605&ttype=0&cirid=303015A19D33132870766759132&cicmp=2040445&cijs=1&dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&tst=1&docw=0&cs=false
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash

Request headers

:method
GET
:authority
imprammp.taboola.com
:scheme
https
:path
/st?cipid=66301605&ttype=0&cirid=303015A19D33132870766759132&cicmp=2040445&cijs=1&dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&tst=1&docw=0&cs=false
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
accept-encoding
gzip, deflate, br
cookie
t_gid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Response headers

status
200
server
nginx/1.13.12
accept-ranges
bytes
date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
x-served-by
cache-hhn4035-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1571941419.390001,VS0,VE9
content-length
0
cmTagSLIDER_INSTREAM.js
vidstat.taboola.com/vpaid/units/23_14_17/infra/ 		726 KB
174 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/vpaid/units/23_14_17/infra/cmTagSLIDER_INSTREAM.js
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d195af29bd58f79541d8647f823c9209458121c9a8bd00905affdb395d38f608

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 9eb0e845437929074828e0cf53f179af.cloudfront.net (CloudFront), 1.1 varnish
age
194281
x-amz-meta-mtime
1571746203
x-cache
Miss from cloudfront, HIT
x-amz-meta-ctime
1571746259
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-length
177810
x-served-by
cache-hhn4032-HHN
last-modified
Tue, 22 Oct 2019 12:11:01 GMT
server
AmazonS3
x-timer
S1571941419.290523,VS0,VE0
etag
"2052a6a9a97ed8fd31432fc54bba10f7"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
RxhXQea1lF8kDsQ8OpVYMng61qX-x40iy8C_kjkA-H7z0FH_172lvQ==
x-cache-hits
12066
cmOsUnit.css
vidstat.taboola.com/vpaid/units/23_14_17/assets/css/ 		34 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/vpaid/units/23_14_17/assets/css/cmOsUnit.css
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3dba93f65c632536a0fcba4dff71f82f7d6ae88b3a2814d82a1b1876558d79c1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 27f665df26bde4a7226480b4a2890ff9.cloudfront.net (CloudFront), 1.1 varnish
age
194284
x-amz-meta-mtime
1571746200
x-cache
Miss from cloudfront, HIT
x-amz-meta-ctime
1571746215
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-length
6240
x-served-by
cache-hhn4032-HHN
last-modified
Tue, 22 Oct 2019 12:10:17 GMT
server
AmazonS3
x-timer
S1571941419.290585,VS0,VE0
etag
"1112e8ccb1e3ed0d2e59d31564a5dfae"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-type
text/css
x-amz-cf-id
RJ9CuXjj64IvfIPM6_9kfWnIRsFXSNxN9qSUfisB9AoD86Nz_qY0kg==
x-cache-hits
126788
content14_10_18m.js
vidstat.taboola.com/ 		37 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/content14_10_18m.js
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/23_14_17/infra/cmTagSLIDER_INSTREAM.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ab8bbbaf028510d8b119cce741f0c2cc94816dcc113d83cac81a6aade6a76fa9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront), 1.1 varnish
age
1512328
x-cache
Hit from cloudfront, HIT
status
200
content-encoding
gzip
content-length
7638
x-served-by
cache-hhn4032-HHN
last-modified
Sun, 14 Oct 2018 13:31:31 GMT
server
AmazonS3
x-timer
S1571941419.379252,VS0,VE0
etag
"d8d81221ec6e604811ce469d899c9c8b"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
omj5vaGwuVO0u1DUElZ04p0xjblvLHfKzDESlIUndnM3CZOy52LCcg==
x-cache-hits
3608087
OvaMediaPlayer.js
vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/ 		678 KB
180 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/23_14_17/infra/cmTagSLIDER_INSTREAM.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c192e736291c95f8940690aa3ebb3b5d71c44b61c41c7fac96962c904ac2abdd

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront), 1.1 varnish
age
999686
x-amz-meta-mtime
1570941529
x-cache
Miss from cloudfront, HIT
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-length
184156
x-served-by
cache-hhn4032-HHN
last-modified
Sun, 13 Oct 2019 04:38:50 GMT
server
AmazonS3
x-timer
S1571941419.386450,VS0,VE0
etag
"6399613242e0223a965a4387ac435350"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
atQZyQIp4ram3NdqCKl26BgypHoDmBadgNV-bXTv8UClSoVxWEjVyA==
x-cache-hits
2519407
sync
match.taboola.com/ Frame B384 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://match.taboola.com/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/23_14_17/infra/cmTagSLIDER_INSTREAM.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
accept-encoding
gzip, deflate, br
cookie
t_gid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Response headers

status
200
server
nginx/1.13.12
content-type
text/html;charset=ISO-8859-1
machineid
401
accept-ranges
bytes
date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
x-served-by
cache-hhn4035-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1571941419.395177,VS0,VE36
st
convammp.taboola.com/ 		0
53 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://convammp.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66301605&crid=5302265&dast=V7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!&cmcv=&pix=31589837&cb=1571941419375&uv=231417&tms=1571941419375&abt=expl_vB!u231417c_vA&ft=0&unm=SLIDER_INSTREAM&debug=pn:!sqg:!torgn:1571941417559.337!ts:1571941419375&
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.393442,VS0,VE20
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-fra19125-FRA
st
convammp.taboola.com/ 		0
53 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://convammp.taboola.com/st?cijs=convusmp&ttype=72&cisd=convusmp&cipid=66301605&crid=5302265&dast=V7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!&cmcv=&pix=&cb=1571941419383&uv=231417&tms=1571941419383&abt=expl_vB!u231417c_vA&ft=0&unm=SLIDER_INSTREAM
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.393468,VS0,VE18
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-fra19125-FRA
c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
cdn.taboola.com/static/c5/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/static/c5/c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
3GoWmPpnzFDs5CP3.ebHbCmhALWQMuvH
content-encoding
gzip
etag
"11d8569a7da0739259e3ac0b0d666e94"
age
110
via
1.1 varnish
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
1502
x-amz-id-2
sk3UPDaUsGrPrp/d2gIec7zpCmK16fFCQ4P+hVDskIgCr7sbrNf57G3RiHOMhDfsVXk8NZtt8cI=
x-served-by
cache-fra19122-FRA
last-modified
Sun, 10 Jun 2018 13:23:55 GMT
server
AmazonS3
x-timer
S1571941419.393719,VS0,VE0
date
Thu, 24 Oct 2019 18:23:39 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
x-amz-request-id
51F5B39D97127686
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/svg+xml
access-control-allow-headers
*
abp
84
x-cache-hits
123
441bff01-eecd-42c3-9dd6-7314ba68ace8
https://threatpost.com/ 		1 KB
0 		Media
General
Check archive.org
Download Go to
Full URL
blob:https://threatpost.com/441bff01-eecd-42c3-9dd6-7314ba68ace8
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Sec-Fetch-Mode
no-cors
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Content-Range
bytes 0-1492/1493
Content-Length
1493
Content-Type
video/mp4
86c151e7-c595-489a-b702-a16c81286e6a
https://threatpost.com/ 		1 KB
0 		Media
General
Check archive.org
Download Go to
Full URL
blob:https://threatpost.com/86c151e7-c595-489a-b702-a16c81286e6a
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Sec-Fetch-Mode
no-cors
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

Content-Range
bytes 0-1492/1493
Content-Length
1493
Content-Type
video/mp4
pixel;r=596228981;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F;fpan=1;fpa=P0-331409412-1571941419420;ns=0;ce=1;qjs=1;qv=4c19192-20180628...
pixel.quantserve.com/ 		35 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=596228981;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F;fpan=1;fpa=P0-331409412-1571941419420;ns=0;ce=1;qjs=1;qv=4c19192-20180628134937;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=1;et=1571941419420;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2019%2F10%2F14080919%2Fapple%2Ctype.article%2Ctitle.Click%20Fraud%20Malware%20Riddles%20Apple%20App%20Store%2Cdescription.Researchers%20have%20uncovered%20malware%20in%2017%20iOS%20apps%20that%20are%20currently%20available%20o%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fclick-fraud-malware-apple-app-store%2F149496%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
91.228.74.140 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS
Software
QS /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:39 GMT
Server
QS
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
35
Expires
Fri, 04 Aug 1978 12:00:00 GMT
player.css
vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/assets/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/assets/player.css
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
25d238eac82235b53958982f2d7c8db542d0c4b05ed49ccc8cfd9d1d56f38760

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront), 1.1 varnish
age
999685
x-amz-meta-mtime
1570941532
x-cache
Miss from cloudfront, HIT
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-length
2454
x-served-by
cache-hhn4032-HHN
last-modified
Sun, 13 Oct 2019 04:38:53 GMT
server
AmazonS3
x-timer
S1571941419.490907,VS0,VE0
etag
"06641339ce27ddb2d0da0bf718d4974a"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-type
text/css
x-amz-cf-id
EJF-5gY-FU3F9K-YHGo1yY9qG2nOTSSXsgGKGB67aebHQcIjGd_e8A==
x-cache-hits
2234196
st
convammp.taboola.com/ 		0
52 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://convammp.taboola.com/st?cijs=convusmp&ttype=81&cisd=convusmp&cipid=66301605&crid=5302265&dast=V7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!&cmcv=&uv=231417&unm=SLIDER_INSTREAM&cb=1571941419483&abt=expl_vB!u231417c_vA&baseReportD=taboola.com&dataCenter=am&
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941419.498937,VS0,VE9
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-fra19125-FRA
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		715 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
Travel-trends-to-watch-in-2018.mp4
vidstatb.taboola.com/vid/ 		3 MB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://vidstatb.taboola.com/vid/Travel-trends-to-watch-in-2018.mp4
Requested by
Host: threatpost.com
URL: https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range
bytes=0-

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront), 1.1 varnish
age
2385583
x-cache
Miss from cloudfront, HIT
status
206
Content-Length
5009203
x-served-by
cache-hhn4032-HHN
Content-Range
bytes 0-5009202/5009203
last-modified
Thu, 29 Mar 2018 08:22:44 GMT
server
AmazonS3
x-timer
S1571941420.525482,VS0,VE0
etag
"a84e81eee26091d89cb1389708b124b8"
content-type
video/mp4
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
x-amz-cf-id
vHjEY82Q1suoy9u5kMGdK9LMvA-nODBTdVF1NbaGQPbwF9qmLYSqiA==
x-cache-hits
234687
desk_muted2.svg
vidstat.taboola.com/assets/video_controls/ 		688 B
776 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vidstat.taboola.com/assets/video_controls/desk_muted2.svg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b07af50f99890a6edd3601bb8cf2d7ebdb404904067925d794d1cd450e939f57

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/assets/player.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 4b35c814a2788c09b015e4cc052e552f.cloudfront.net (CloudFront), 1.1 varnish
age
827785
x-cache
Hit from cloudfront, HIT
status
200
access-control-max-age
3000
content-encoding
gzip
content-length
376
x-served-by
cache-hhn4032-HHN
last-modified
Sun, 19 Nov 2017 12:19:28 GMT
server
AmazonS3
x-timer
S1571941420.527821,VS0,VE0
etag
"c374f9a1c65db8dd9f4b435bd1adb4ed"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA56
accept-ranges
bytes
x-amz-cf-id
qJJ-hcjE4vJH1LBNJ-A7Vtf-52RwRMAUsG8lGA4sKPB-jvwwCkUjww==
x-cache-hits
138229
pause2.svg
vidstat.taboola.com/assets/video_controls/ 		391 B
593 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vidstat.taboola.com/assets/video_controls/pause2.svg
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
437513ec64a0d4c9b838a51cf1e57bfb0d75586f35ddd91d0de1d01335fd0969

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/assets/player.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 6080b2713e502211e152f21f5c59c5a7.cloudfront.net (CloudFront), 1.1 varnish
age
1446746
x-amz-meta-mtime
1498396298
x-cache
Miss from cloudfront, HIT
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-length
246
x-served-by
cache-hhn4032-HHN
last-modified
Sun, 02 Jul 2017 14:26:33 GMT
server
AmazonS3
x-timer
S1571941420.528222,VS0,VE0
etag
"0ae31cb3e45e52b441abf8cc6208a36e"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
image/svg+xml
x-amz-cf-id
QTHTgYGSSOYy5uLH3FfzkOjBY6YsD9l4jGRCLZHYer1PsPD_Vu0G6A==
x-cache-hits
182696
VideoBidRequestHandlerServlet
wf.taboola.com/ 		9 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=400&height=225&pubid=198827&tagid=1020237&crid=5302265&noaop=2&sortOrderType=0&cb=1571941419571&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=1&pv=1050&pt=913814579&tz=120&viewable=true&ddast=V7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!&proto=2,3,5,6&dtagid=1683035&dpubid=331625&abtst=expl_vB!u231417c_vA&mPre=0.033&encoded=1&pstn=1&cirf=https%3A%2F%2Fthreatpost.com&callback=&en=1&wfv=1&cdb=&gdprApplies=false&amp=0&qsz=6&ft=0&pb=0
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
b58df3bd371f37862d991801b11ec7b4bbe69ccc770fc7fa4dca88d1d1d2f115

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
via
1.1 varnish
machineid
1428
x-cache
MISS
status
200
x-cache-hits
0
x-served-by
cache-hhn4035-HHN
pragma
no-cache
server
nginx/1.13.12
x-timer
S1571941420.574968,VS0,VE160
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
accept-ranges
bytes
expires
Sat, 26 Jul 1997 05:00:00 GMT
adsct
analytics.twitter.com/i/ 		31 B
635 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fclick-fraud-malware-apple-app-store%2F149496%2F
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 24 Oct 2019 18:23:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
57
x-xss-protection
0
x-response-time
108
pragma
no-cache
last-modified
Thu, 24 Oct 2019 18:23:39 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
f4ea35ee9b69a71fab36cf65ebe02d26
x-transaction
00ba2a95000b9414
expires
Tue, 31 Mar 1981 05:00:00 GMT
5db1539aecc9ee001702e9cc
serverc.shoofle.tv/connections/5638c79739291a03009685cd/ 		66 B
697 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://serverc.shoofle.tv/connections/5638c79739291a03009685cd/5db1539aecc9ee001702e9cc?url=https%3A%2F%2Fthreatpost.com&playerWidth=400&playerHeight=225&param2=Taboola
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.189.226.166 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
nginx /
Resource Hash
365464596a5c65ba5f030f24682d1209a3a3752c2ddeef4ca875cd18e082e066

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Thu, 24 Oct 2019 18:23:39 GMT
Server
nginx
P3P
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials
true
Connection
close
Content-Type
text/xml; charset=utf-8
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length
66
ptv
secure.adnxs.com/ 		85 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ptv?id=16816843&size=400x225&promo_alignment=center&cb=R0.1571941419751&ext_inv_code=cm_331625-1683035_Unknown&referrer=https%3A%2F%2Fthreatpost.com&pubclick=http%3A%2F%2Fclickam.zorosrv.com%2Fst%3Fcipid%3D66363425%26ttype%3D1%26crid%3D5302265%26dast%3DV7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!%26cmcv%3D${CMCV}%26tgtf%3D&GDPR_APPLIES=1
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.249 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
b2effcb18f514a7896e737bdda537f2ef3b5bb989eb247f4ab2aa3facf1148ea
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Thu, 24 Oct 2019 18:23:41 GMT
X-Proxy-Origin
144.76.109.30; 144.76.109.30; 534.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.91:80
AN-X-Request-Uuid
cbe178ce-d4bc-42cd-88ee-0bc4d9b4a093
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/xml; charset=utf-8
Content-Length
85
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 6B7A 		42 B
142 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst5CZY7F7817gLT5vGGR034iU22Po_DyIn1MaXDsucawLX4cFX8JlMBYyrT_6USSEBHjGPVY-m6tARjZtnVCA1Qd3-BQZtL952LI2mIgBQ&sig=Cg0ArKJSzDDW9xsOOejTEAE&adk=2675834513&tt=434&bs=1585%2C1200&mtos=1092,1092,1092,1092,1092&tos=1092,0,0,0,0&p=0,429,90,1157&mcvt=1092&rs=3&ht=0&tfs=159&tls=1251&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=11&niot_cbk=73&md=2&lm=2&rst=1571941418747&rpt=182&isd=0&msd=0&oseid=3&xdi=0&ps=1585%2C5138&ss=1600%2C1200&pt=817&bin=1&deb=1-1-1-5-11-17-14-10-0-0-0&tvt=1239&r=v&id=osdim&vs=4&uc=11&upc=1&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191023
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Oct 2019 18:23:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 6892 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsufXSEUQt4h0WLwR2lwQtdbdilnpNGtzjvtbFTtFZwvTnEd3ErnUmGoM_3DOOuHT0FMWgEpLGv-QphCXN9Hc27Gn41zMFah78SetGwspZw&sig=Cg0ArKJSzNdm3R4ikKpPEAE&id=ampim&o=1093,247&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=197&tls=1198&g=100&h=100&pt=259&tt=1198&rpt=259&rst=1571941418750&r=v&adk=974937504&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Oct 2019 18:23:40 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
match.taboola.com/ Frame 2A50 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://match.taboola.com/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/23_14_17/infra/cmTagSLIDER_INSTREAM.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
accept-encoding
gzip, deflate, br
cookie
t_gid=b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Response headers

status
200
server
nginx/1.13.12
content-type
text/html;charset=ISO-8859-1
machineid
401
accept-ranges
bytes
date
Thu, 24 Oct 2019 18:23:42 GMT
via
1.1 varnish
x-served-by
cache-hhn4035-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1571941422.392368,VS0,VE9
OpportunityServlet
opps.taboola.com/ 		1 B
74 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://opps.taboola.com/OpportunityServlet
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

date
Thu, 24 Oct 2019 18:23:44 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941425.573026,VS0,VE17
x-served-by
cache-hhn4079-HHN
status
200
x-cache
MISS
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
1
x-cache-hits
0
VideoBidRequestHandlerServlet
wf.taboola.com/ 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=400&height=225&pubid=198827&tagid=1020237&crid=5302265&noaop=2&sortOrderType=0&cb=1571941424990&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=-1&seq=2&pv=1050&pt=913814579&tz=120&viewable=true&ddast=V7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!&proto=2,3,5,6&dtagid=1683035&dpubid=331625&abtst=expl_vB!u231417c_vA&mPre=0.033&encoded=1&pstn=1&cirf=https%3A%2F%2Fthreatpost.com&callback=&en=1&wfv=1&cdb=&gdprApplies=false&amp=0&qsz=6&ft=0&pb=0
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
baf6e1eee9886ce24cb40440a0bab608bf7fed29b98438ce36a86b213a84a351

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

date
Thu, 24 Oct 2019 18:23:45 GMT
via
1.1 varnish
machineid
1407
x-cache
MISS
status
200
x-cache-hits
0
content-length
7128
x-served-by
cache-hhn4035-HHN
pragma
no-cache
server
nginx/1.13.12
x-timer
S1571941425.994343,VS0,VE143
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
accept-ranges
bytes
expires
Sat, 26 Jul 1997 05:00:00 GMT
5db1539aecc9ee001702e9cc
serverc.shoofle.tv/connections/5638c79739291a03009685cd/ 		66 B
694 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://serverc.shoofle.tv/connections/5638c79739291a03009685cd/5db1539aecc9ee001702e9cc?url=https%3A%2F%2Fthreatpost.com&playerWidth=400&playerHeight=225&param2=Taboola
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.189.226.166 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
nginx /
Resource Hash
365464596a5c65ba5f030f24682d1209a3a3752c2ddeef4ca875cd18e082e066

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Thu, 24 Oct 2019 18:23:45 GMT
Server
nginx
P3P
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials
true
Connection
close
Content-Type
text/xml; charset=utf-8
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length
66
AdServerServlet
vid.pubmatic.com/AdServer/ 		27 B
853 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.pubmatic.com/AdServer/AdServerServlet?adtype=13&pubId=156307&siteId=583006&adId=2174376&vadFmt=3&vapi=2&vminl=1&vmaxl=60&vh=225&vw=400&placement=3&vtype=0&vpos=1&vskip=0&vcom=0&vfmt=1+3+4+5+6+7&kadpageurl=https%3A%2F%2Fthreatpost.com&sec=1&gdpr=1
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.111 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
a71702232a771b558b12f8c0012a15f5652b500fd2e33464d283406cee36754d

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Thu, 24 Oct 2019 18:23:45 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Connection
keep-alive
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
X-Vdbg
1:0/165:-1
Content-Type
application/xml; charset=utf-8
sync
match.taboola.com/ Frame 46AF 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://match.taboola.com/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/23_14_17/infra/cmTagSLIDER_INSTREAM.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sync?dast=V7xlYCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHHDPYDBarBWM54mwWm8lwtlzMhqPdarVajqbgMGWnyWU5qAWypsnld4MQmk6Hz3WvFx0tL4fp8Pec7hq_268xOz1et8zycJ3caofZ97C83ArD4exyKwyHt-b0t7z8itFytJzt5QAAAADwAAB1ng_xAwgAEAEAAAAgAQAAAEARUPFvIXABAAAAgAFwkDyuAQDFwXCuu_VlNzpcn5fdHwAADwEgAAADCiQABQ9pJQAZrlsnAAAAAAAAAAAs_____zED866lMgAfIn03Bj0ADz4AD0IAAABZQ7y9yz4adtcIRAWqRYwAAAAAIJnaPI4mdUJlUQUAQJBuBXAFABDQ9i-A-JulOyjxFgYAACAwtkAPi99vdtg1frfLAAAAAAAAAADM_s_-0YSIxtzSglgKeNV-AQEA1n4BAQDY1A0A4C0ALugIWjEYrC4gZgcAAABw9____68HQs7dcrWxrUar4cZi89gWruVkN9gNZyuXxeRy2Lanh5ngTTAu9tPnMGWnyWU5qAWypsnlt9-ELUaryWSzHM6Wi8lgOBqORvsTuNEAJ2g4HCx2g8VusRhOFpPRYDlYoEAMJjghw9FmshrtVrvJcjgZjWabyQYpWrWajTaD4Wo2me12q-FguByNkKI1i9lkspiNlrvNYDkZDYaT4RBhZLRbLJcLz1q3cszWotVuuRZOLIu1bLPaLWaTyczisLlFr4_ptLD4FguHFwUDXvYiuEgnoqPl5TAd_p7TW3S0vBymw99zuoglmpNFOpFd9iXnbrna2Faj1XBjsXlsC9dyshvshrOVy2JyOWz7ymi3WC4XnrVu5ZitRavdci2cWBZr2Wa1W8wmk5nFYXOLXh_TaWHxLRYOf2O1WyxHi9FiuG-sdovlaDFaDPcdOsN39TkbpdVyySOz_kzb1WbmNChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMU4sC4vJs5xtRqOJc-RyeCwj32xjXJgcJttoMRFLlKaLdKLXmJ0er1tmebhObrXD7HtYXm6F4XB2uRWGw1tz-ltefsVoOVrOJuo_NsRoNNfN5orBcq4ZrBIAAAAAAAAAwBLmzJsAAAAAnAazWcwmq-UCSDyM7yaFhCgWKc5lFTd-XEFHy8thOvw9p7foaHk5TIe_53RlAIkHcQ!&excid=22&docw=0&cijs=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Response headers

status
200
server
nginx/1.13.12
content-type
text/html;charset=ISO-8859-1
machineid
402
accept-ranges
bytes
date
Thu, 24 Oct 2019 18:23:45 GMT
via
1.1 varnish
x-served-by
cache-hhn4035-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1571941425.395575,VS0,VE9
OpportunityServlet
opps.taboola.com/ 		1 B
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://opps.taboola.com/OpportunityServlet
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

date
Thu, 24 Oct 2019 18:23:49 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1571941430.572703,VS0,VE17
x-served-by
cache-hhn4079-HHN
status
200
x-cache
MISS
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
1
x-cache-hits
0
VideoBidRequestHandlerServlet
wf.taboola.com/ 		7 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=400&height=225&pubid=198827&tagid=1020237&crid=5302265&noaop=2&sortOrderType=0&cb=1571941429990&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=-1&seq=3&pv=1050&pt=913814579&tz=120&viewable=true&ddast=V7IZcCFgPCC8wY17E8swTCC8wY17E8swUAAAAGBjsHGzPYDBarBWM54mwWm8lwN9jNZrvVcrGZDIFjBpvBYrVgLEeczWIzGc6Wi9lwtFutVsvRFBym7DS5LAe1QNY0ufxuEELT6fC57vWio-XlMB3-ntNd43f7NWanx-uWWR6uk1vtMPselpdbYTicXW6F4fDWnP6Wl18xWo6Ws70cAAAAAB4AoM7zIX4AAQAiAAAAACQAAAAAKAIq_i0ELgAAAAAwAA6SxzUAoDgYznW3vuxGh-vzsvsDAOAhAAQAYECBBKDgIa0EIMN16wQAAAAAAAAAgOX___8_ZmDetVQG4EOkrwfgwQfggahAtYgRAAAAACRTm8fRpE6oLKoAAAjSrQCuAAAC2v4FEH_DAAAABMYW6GHx-80Ou8bvdhkAAAAAAAAAgNn_2T-aENGYW1oQSwGv2i8gAMDaLyAAAJu6AQC8BcAFHUErBoPVBcTsAAAAAO7-____9UDIuVuuNrbVaDXcWGwe28K1nOwGu-Fs5bKYXA7b9vQwE7wJxsV--hym7DS5LAe1QNY0ufz2m7DFaDWZbJbD2XIxGQxHw9FofwI3GuAEDYeDxW6w2C0Ww8liMhosBwsUiMEEJ2Q42kxWo91qN1kOJ6PRbDPZIEWrVrPRZjBczSaz3W41HAyXoxFStGYxm0wWs9FytxksJ6PBcDIcIoyMdovlcuFZ61aO2Vq02i3XwollsZZtVrvFbDKZWRw2t-j1MZ0WFt9i4fCiYMDLXgQX6UR0tLwcpsPfc3qLjpaXw3T4e04XsURzskgnssu-5NwtVxvbarQabiw2j23hWk52g91wtnJZTC6HbV8Z7RbL5cKz1q0cs7VotVuuhRPLYi3brHaL2WQyszhsbtHrYzotLL7FwuFvrHaL5WgxWgz3jdVusRwtRovhvkNn-K4-Z6O0Wi55ZNafabvazJwGhctg8f4kpsW0Ozt4fr-jU6W6aIwN2TehMBs8BoMilghOF-lE9DKeLmKJ5GmRTjTGiWVhMXmWs81oNHGOXA6PZeSbbYwLk8NkGy0mYonSdJFO9Bqz0-N1yywP18mtdph9D8vLrTAczi63wnB4a05_y8uvGC1Hy9lE_ceGGI3mutlcMVjONYNVAgAAAAAAAABYwpx5EwAAAIDTYDaL2WS1XACJh_HdpJAQxSLFuazixo8r6Gh5OUyHv-f0Fh0tL4fp8Pecrgwg8SAO!&proto=2,3,5,6&dtagid=1683035&dpubid=331625&abtst=expl_vB!u231417c_vA&mPre=0.033&encoded=1&pstn=1&cirf=https%3A%2F%2Fthreatpost.com&callback=&en=1&wfv=1&cdb=&gdprApplies=false&amp=0&qsz=6&ft=0&pb=0
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
ddbf7c8c9d7dbd07f0d8638d791086e79e803911910f0761d3c20ef18d9357b2

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain

Response headers

date
Thu, 24 Oct 2019 18:23:50 GMT
via
1.1 varnish
machineid
1419
x-cache
MISS
status
200
x-cache-hits
0
content-length
7136
x-served-by
cache-hhn4035-HHN
pragma
no-cache
server
nginx/1.13.12
x-timer
S1571941430.995075,VS0,VE250
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
accept-ranges
bytes
expires
Sat, 26 Jul 1997 05:00:00 GMT
5db1539aecc9ee001702e9cc
serverc.shoofle.tv/connections/5638c79739291a03009685cd/ 		66 B
698 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://serverc.shoofle.tv/connections/5638c79739291a03009685cd/5db1539aecc9ee001702e9cc?url=https%3A%2F%2Fthreatpost.com&playerWidth=400&playerHeight=225&param2=Taboola
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.189.226.166 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
nginx /
Resource Hash
365464596a5c65ba5f030f24682d1209a3a3752c2ddeef4ca875cd18e082e066

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Thu, 24 Oct 2019 18:23:50 GMT
Server
nginx
P3P
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
max-age=0, no-cache, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials
true
Connection
close
Content-Type
text/xml; charset=utf-8
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length
66
AdServerServlet
vid.pubmatic.com/AdServer/ 		27 B
853 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.pubmatic.com/AdServer/AdServerServlet?adtype=13&pubId=156307&siteId=583006&adId=2174376&vadFmt=3&vapi=2&vminl=1&vmaxl=60&vh=225&vw=400&placement=3&vtype=0&vpos=1&vskip=0&vcom=0&vfmt=1+3+4+5+6+7&kadpageurl=https%3A%2F%2Fthreatpost.com&sec=1&gdpr=1
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v10.5.0/OvaMediaPlayer.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.111 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
a71702232a771b558b12f8c0012a15f5652b500fd2e33464d283406cee36754d

Request headers

Sec-Fetch-Mode
cors
Referer
https://threatpost.com/click-fraud-malware-apple-app-store/149496/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Thu, 24 Oct 2019 18:23:50 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Connection
keep-alive
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
X-Vdbg
1:0/165:-1
Content-Type
application/xml; charset=utf-8

Verdicts & Comments Add Verdict or Comment

301 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate undefined| $ function| jQuery object| gdprDynamicStrings object| kss object| gdprStrings object| _taboola object| dataLayer object| googletag object| gf_global object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| google_tag_manager number| google_srt undefined| google_measure_js_timing boolean| google_noFetch number| __google_ad_urls_id number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal string| GoogleAnalyticsObject function| ga object| _qevents function| twq object| recaptcha object| TRC object| _tblConsole undefined| msg object| _comscore function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformToggleIcons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format function| renderRecaptcha function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| _gformPriceFields undefined| _anyProductSelected function| GFCalc object| gform undefined| __gf_keyup_timeout object| gfMultiFileUploader object| google_tag_data object| gaplugins object| gaData function| gf_apply_rules function| gf_check_field_rule function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default undefined| __gf_timeout_handle object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| wp object| Placeholders object| jQuery112409097582365751098 object| gf_form_conditional_logic string| gf_number_format function| do_callback object| closure_lm_845974 object| __google_ad_urls object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired object| twttr function| jQuery112409097582365751098_1571941418403 function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam object| params number| trc_debug_level string| trc_article_id object| TRCImpl number| taboola_view_id function| udm_ object| ns_p object| COMSCORE function| quantserve function| __qc object| ezt object| _qoptions function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP object| cmTag undefined| define function| startCMTagMain string| category number| _zid function| shuffle object| arrToUse object| travel object| news object| mobilecontent1 object| mobilecontent1_new object| travelmuted object| movietrailersHD object| movietrailersHDmuted object| widescreen object| movietrailerslight object| landscapeHD object| landscapeHDmuted object| blank object| blankblack object| blankblack7 object| blankblack5 object| blankblack_mob object| blankwhiteHDmpg object| blankblack10 object| blankwhite object| blankwhiteHD object| black_loader object| lightweight object| lightweight_single object| lightweight300600 object| bonnier object| home object| lipstick object| shoes object| art object| infiltrator object| glass object| lemurs object| NBAshoes object| Sunglasses object| Hummus object| Short_food object| Short_swim object| Euro_news object| Automoto_TV object| Uzoo object| SmartDuvet object| Tiger object| Chocolate object| Logan object| Jacket object| Bike object| Kanye object| Cancun object| Smartwatch object| Helicopter object| dogshampoo object| icetea object| charger object| blueysmoothie object| ShortContent object| carbsandwich object| pisatower object| Food1 object| Food2 object| Food3 object| Food4 object| Food5 object| Food6 object| Food7 object| Fashion object| Lifestyle1 object| Lifestyle2 object| Technology1 object| Technology2 object| Technology3 object| Entertainment object| Scrambledeggs object| Spinach object| Bub1 object| Pokemon object| style_hacks object| Motorcycle object| IceCracking object| Manatees object| Daiving object| Fishing_Lure object| Shark object| HundredsManatees object| TigerShark object| MandelaPrize object| Bertram35 object| bushfire object| Snow object| Delta object| Wheels object| Yellowfin object| Grip object| Kawasaki object| Yoga object| Cat object| Chickens object| RZR object| bitcoin object| bmw object| wombat object| koala object| Marsupial object| puppy object| bitcoinMuted object| bmwMuted object| Wallabies object| Bunny object| Pumpkins object| Dogs_Stress object| Dogs_Stress_image object| lightweight300600_short object| playlist string| vpaidId function| webpackHotUpdate function| OvaMediaPlayer string| lastWfUrl object| events

6 Cookies

Domain/Path Name / Value
.threatpost.com/ Name: __qca
Value: P0-331409412-1571941419420
.ads.pubmatic.com/ Name: KCCH
Value: YES
.pubmatic.com/ Name: pi
Value: 156307:2
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.taboola.com/ Name: t_gid
Value: b86cef67-386b-458e-8649-c7c4893bca90-tuct4ab71ab
threatpost.com/ Name: trc_cookie_storage
Value: threatpost-threatpost%253Asession-data%3Dv2_d9795c65458cbfc6a59270786eebdea6_247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa_1571941418_1571941418_CNawjgYQ459IGLuOivjfLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522threatpost-threatpost%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIQhDP4zoMCwiJARDP4zoMCwhMEM_jOgwLCI4BEM_jOgwLCCAQz-M6DAsIJBDP4zoMCwhkEM_jOgwLCCcQz-M6DAsILRDP4zoMCwg7EM_jOgwLCD0Q75Q6DAsIPxDP4zoMDBMU%7Ctaboola%2520global%253Auser-id%3D247199a3-7e16-4579-8b21-63571622fbaf-tuct4ab71aa

2 Console Messages

Source Level URL
Text
console-api info URL: https://cdn.ampproject.org/rtv/011910071804120/amp4ads-v0.js(Line 529)
Message:
Powered by AMP ⚡ HTML – Version 1910071804120 https://threatpost.com/click-fraud-malware-apple-app-store/149496/
console-api info URL: https://cdn.ampproject.org/rtv/011910071804120/amp4ads-v0.js(Line 529)
Message:
Powered by AMP ⚡ HTML – Version 1910071804120 https://threatpost.com/click-fraud-malware-apple-app-store/149496/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

15.taboola.com
adservice.google.com
adservice.google.de
analytics.twitter.com
assets.threatpost.com
bttrack.com
cdn.ampproject.org
cdn.taboola.com
cds.taboola.com
cm.g.doubleclick.net
convammp.taboola.com
graph.facebook.com
ib.adnxs.com
images.taboola.com
imprammp.taboola.com
kasperskycontenthub.com
match.adsrvr.org
match.taboola.com
media.threatpost.com
opps.taboola.com
pagead2.googlesyndication.com
pixel.quantserve.com
pixel.rubiconproject.com
px.adhigh.net
px.powerlinks.com
rtb.mfadsrvr.com
rules.quantcount.com
sb.scorecardresearch.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverc.shoofle.tv
static.ads-twitter.com
stats.g.doubleclick.net
sync.mathtag.com
t.co
threatpost.com
tpc.googlesyndication.com
trc.taboola.com
vid.pubmatic.com
vidstat.taboola.com
vidstatb.taboola.com
wf.taboola.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
www.storygize.net
x.bidswitch.net
104.244.42.195
104.244.42.5
130.211.13.252
151.101.114.2
151.101.114.49
151.101.12.157
151.101.13.140
151.101.14.2
151.101.14.49
172.217.18.98
178.63.11.9
18.185.154.43
185.29.135.234
185.64.189.111
192.132.33.46
206.189.226.166
216.58.207.66
23.5.97.37
2600:9000:2156:1400:2:9275:3d40:93a1
2600:9000:2156:1c00:6:44e3:f8c0:93a1
2600:9000:2156:2c00:0:5c46:4f40:93a1
2a00:1450:4001:800::2001
2a00:1450:4001:800::2003
2a00:1450:4001:817::2001
2a00:1450:4001:81b::2003
2a00:1450:4001:81b::2004
2a00:1450:4001:820::2008
2a00:1450:4001:821::2002
2a00:1450:4001:824::200e
2a00:1450:400c:c00::9b
2a03:2880:f01c:800e:face:b00c:0:2
2a05:f500:10:101::b93f:9101
35.173.160.135
37.252.172.249
40.113.136.100
52.51.24.119
52.59.29.68
54.70.1.117
69.173.144.165
91.228.74.140
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
10eba73b3641332bde05fa8d6223e7017ac5207673602247c35f358ea89e3092
18d6c3cd87c2e73ec0772807d0c89af5393fbf030a618ad24467dcdc1fdc784a
1d877b654697728723f01959ffbf74d70842fe9cf331f721be5701b61c217638
1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
207cad30f45a95be52c86a9c62162615ca55e51bbd5fbdc3782a3fba08a9bc05
25d238eac82235b53958982f2d7c8db542d0c4b05ed49ccc8cfd9d1d56f38760
29e4982dc2c6576ec4d754b8440da0d3f024215f76d975497e14aedd163a55ef
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
33a19cbe9edc7a20d42a2149dd4e78c1e1bc5a54245b3b4e4bbacf8717131dee
33b3e630182f83b20f1396b178ba597d2137ee088327f09f90e65ac496d98461
365464596a5c65ba5f030f24682d1209a3a3752c2ddeef4ca875cd18e082e066
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3dba93f65c632536a0fcba4dff71f82f7d6ae88b3a2814d82a1b1876558d79c1
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
437513ec64a0d4c9b838a51cf1e57bfb0d75586f35ddd91d0de1d01335fd0969
44ef9b8be9758f4944226128bcbd68f44fca4b8a4d272ad3288427bbd96accb8
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
51b7a583b42d20f16fa2755abe0e8fd716b3ec9378ec42500b0d894927598326
535f401ad4d0562612b8bcadc5edb6c194cb6a275f3915511f9d023cfc69fe2a
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1b3e1dbec0a6b898bf6b8f17caa692c112ba2d215a1300b1c014c75f9f5ad8
5cfa0122469a2e49d8dd4ae1481977846e8ce3bfb23864ccb5fef66dbdabe685
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6da8209d4a474e05bdcff6b40bfea097bc47d419e98ee193f796ebfa94910a53
6ea513209d279ad98847b40b2efafa36378a2b57dc720e66103d0e102cf53230
6f726674d71e4864c15ae4badea9e74375da2c4f3b64f382940cf6e62e2186f1
76ba07e059d9e2113f9c940f1a31efc95bd9d5badd68bbc3637177e892a08099
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
8055b71507df36a9a9d807b0799d9c26533101139e1078ea222897c02ad854c5
83080b9eb5de669f48ad6d6dbad3731c431713ccb27f9152d683924093f2a8ee
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
8af9277beea03fa6657fbefb20592a05e592b3ca05d824ea2f4e92e42eb0910e
8d6443a072062bc36c83d746129ed9da8ba231f35429a43f0e83d88f7de329f3
924f9036fb869592346fb06ad94fcaf642d2aeb89adf880ff0793ff53af1954c
93dd062566471fa91604aee574ff8f6e78e80bd20b01f5e080adb0ac61680f94
93ebb1d614fa1e33c91a00ee803c268fcf812be0282ac38660f29a192109dc86
940e0c3385928422aae38e1a74f1d84b462d8ce1a056c686fde505a0bf3162bb
9954117730a3bd5adc895ed472e2d2828a8e1961cd9cd6b817e792b5fe929564
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
a03faced3009fb10b52543aa37d64bf267dffd4ec013767368830361cc75454f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a25d6b15370e06383386c57fb5278ef22bc15d3151a8059303744f0388e8bbe3
a325b567a51ff594ad3e9a25cad9d81972801934622c20c0abae0c47b4cb8c62
a71702232a771b558b12f8c0012a15f5652b500fd2e33464d283406cee36754d
a783d2ad42c380bc896219c080fa845d1e9f2e77483558103aeb296b95b85701
a7ed51e3834e97bd11fcfd4bd95afd7de0b01082dd61c41d4a3c5c4208bc8dde
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
a9f6c03ce6f4d1654f29f2136651e883198d509cb2e26af1c24b1f87b6ccae13
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aa95eb8757140f09d3424399b939ed3f10a20c45c6c52476c614c9bc375eb667
ab8bbbaf028510d8b119cce741f0c2cc94816dcc113d83cac81a6aade6a76fa9
ac63fc884a3efa6f723411bccd5698adf0261b95bf20209e9ed91f01313d2c98
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b07af50f99890a6edd3601bb8cf2d7ebdb404904067925d794d1cd450e939f57
b2effcb18f514a7896e737bdda537f2ef3b5bb989eb247f4ab2aa3facf1148ea
b58df3bd371f37862d991801b11ec7b4bbe69ccc770fc7fa4dca88d1d1d2f115
b604645aa60dc4db9af6c128efb3eaa6472460b5e4a80dd534c5be9ae21db37b
baf6e1eee9886ce24cb40440a0bab608bf7fed29b98438ce36a86b213a84a351
bc5efe0814deaf9314fcd65d6c9d924ea008d2637945fae0acc3860c45deb1e3
c192e736291c95f8940690aa3ebb3b5d71c44b61c41c7fac96962c904ac2abdd
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ceda3af3faa86679d8a627237eb1163f1e196b80cfcf3fe76325bcf2c018e7aa
d195af29bd58f79541d8647f823c9209458121c9a8bd00905affdb395d38f608
d4888997522e2c66428a8b44d8dba9c89810bc50c6f3de6ffa54dd74da0c450b
d4fce035ac2ea5e9b166432dfd277d39acc9a11ee164df2479f0928fd7545a61
d7ba44e03247efd9fab0368aa77fd4cc25bfd55d5b172327c48a371a12890673
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
ddbf7c8c9d7dbd07f0d8638d791086e79e803911910f0761d3c20ef18d9357b2
de1c3d061188be2af1c610612f342394b3604a4e4825648562b948137acfc57e
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e421edba3fc095e4a8d6fda08a403da99b2453732deaa10bfa2cf592aa44dac3
e697ae92648ccad15ada450ecbd959853b72bb5b977112896334a50ddfc1c0b4
ea8efe086f3497ea294ac7e2823612d95b179354a18a4a9ba20e152ff91b5d4a
eac173b38cb8a2dee61ed09d2cffc1ac3a8c28a3c222fe470623c25076eb1b4c
ee9b85b63056ee85dac06408a3c33c0765f827efb47bfedf10fe266ee4566e1f
eeccbdbb3eabba05bd3b426e8c4cd285edb39ab3189a6fa4114d7d4902aa868a
ef16ce83de0d138cde0b703adecf7c3e5924da0e391378243cb5548ea5f7322b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f257b5d964a6ebdb7a7d88539c3bb113c5b45d43cce59692df5350c4754808bb
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
fa419a6433307dc90dec6b7907ce9affac386bbb904f234317a15c1b4227abdd
fff4fe60bda732b610f29654ec2efbe62a489e71b526db88df24bb91c519c640