www.bleepingcomputer.com Open in urlscan Pro
104.20.185.56 Public Scan

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 420552
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 16:08:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:08:21 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 257ms
65ms Font
font/woff2 142.251.40.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 433406
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 12:34:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 12:34:07 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 274ms
82ms Font
font/woff2 142.251.40.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 421017
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 16:00:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:00:36 GMT
last-modified: Thu, 01 Aug 2024 20:41:19 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18492
x-xss-protection: 0
server: sffe

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 247ms
55ms Font
font/woff2 142.251.40.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

31.152.160.34.bc.googleusercontent.com

Software

sffe /

Resource Hash

ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://fonts.googleapis.com/

Response headers

age: 432516
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 12:48:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 12:48:57 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18588
x-xss-protection: 0
server: sffe

GET
H2 200 32x32-printer.png
www.bleepstatic.com/images/site/ 256 B
748 B 56ms
55ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/32x32-printer.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=09.22.24.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.bleepstatic.com/css/redesign/main.css?v=09.22.24.2

Response headers

cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 342798
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uLsqhHUOze7gav5aRTPsp7ET78PRWgx%2Fk9MsjH8Lw9Gw99yljSnQsxl4fksAPqa7s1eccy6ot0eXqZsZmMFB3nL0hU9OzQ1wJFf5BgOA4ngSusW0AHRKJVLVRmjFA0JiBBBCfHM%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 02 Nov 2024 13:44:14 GMT
cf-polished: origFmt=png, origSize=618
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: image/webp
content-disposition: inline; filename="32x32-printer.webp"
vary: Accept
last-modified: Fri, 02 Oct 2015 21:57:19 GMT
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ebfad30ac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 256
server: cloudflare

GET
H2 200 f6ed52794113bed991ef57a9029d9e70.jpg
www.bleepstatic.com/author/photos/ 5 KB
6 KB 47ms
46ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/author/photos/f6ed52794113bed991ef57a9029d9e70.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 450e469eb374f3a1586e43f09f042fe1a4b60eddd240e486a7ecaefa8855fbe5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 426311
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lhUunB67lCwh3WxO2D23vZkHukMYaYWJMMUBaWXXF7jcC5pGhPqS9f6Dxihpo7R1aVsLPX8zWfh9OvHli0RXemuBy5CsYWA6VQ0q1UmVNZNIPFvKES96s7jsOrzlBz607YUBucg%3D"}],"group":"cf-nel","max_age":604800}
expires: Fri, 01 Nov 2024 14:32:22 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=52423
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: image/webp
content-disposition: inline; filename="f6ed52794113bed991ef57a9029d9e70.webp"
vary: Accept
last-modified: Wed, 08 Aug 2018 21:58:25 GMT
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ebfad31ac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5484
server: cloudflare

GET
H2 200 h4-bg.png
www.bleepstatic.com/images/site/ 38 B
413 B 56ms
55ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/h4-bg.png
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=09.22.24.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.bleepstatic.com/css/redesign/main.css?v=09.22.24.2

Response headers

cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 340714
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cn%2BU10RndcRG%2BrE1EgvmCZh4gXP9u1HK0jjvjBTBnZ308Lh34gQqtNhAAQTdRo1GzXmeFYOxvk6tz8vUlVFycKAGQAxmVgO3zDpty4QpuLPSTu%2BjEeSJI2f53K7nFYBa4etuTeg%3D"}],"group":"cf-nel","max_age":604800}
expires: Sat, 02 Nov 2024 14:18:59 GMT
cf-polished: origFmt=png, origSize=72
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: image/webp
content-disposition: inline; filename="h4-bg.webp"
vary: Accept
last-modified: Sat, 04 Mar 2017 20:46:52 GMT
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ebfad32ac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 38
server: cloudflare

GET
H2 200 configs
d.pub.network/v2/sites/bleepingcomputer-com/ 86 KB
8 KB 241ms
91ms Other
application/json 34.160.152.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.pub.network/v2/sites/bleepingcomputer-com/configs?env=PROD

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.152.31 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

c6cce0919cc1e0fa6f1ef26f567f16511294da81587e27f13eab55f1f4262f03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent

GET
H2 200 jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/ 4 KB
1 KB 134ms
113ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"9108074"
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sd8jAonIsR%2BSDf73VWiB8u1zMQgYDk5FO9LelqdKPmA2tLwh7SUfM67P0fw0%2FMPVX4sA5U8JpO0aJ5eCrQnDrhnW8QrhAI7W1rsSfSmevKnW1opiK2rcpa9zMa1Bda2LZ29zuTU%3D"}],"group":"cf-nel","max_age":604800}
expires: Mon, 03 Jun 2024 14:55:03 GMT
cf-polished: origSize=4895
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/css
last-modified: Wed, 14 Oct 2015 20:25:51 GMT
vary: Accept-Encoding
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ec1ef2cac33-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 200 fontawesome.min.css
www.bleepstatic.com/redesign/fontawesome6/css/ 79 KB
17 KB 58ms
37ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/css/fontawesome.min.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 863ab50a39fc203ca8f614cef14c6cc700ee64bfeacd41426dce9ef8cbd98509

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "2038534161"
age: 1328
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pXVHQaqVgUVJmc%2BbvzCRSaD8xrnJP6Gbhp9Hrfkyv5rXAEFYj%2FY9Ocsbp7b4IHnq77Mip5fzRoazD%2Fb9ZWxan0OVMNAqkzfEplefMU31I0Hsrt6McV5nJAW4wKE4nQCQD9kVWEg%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 03 Apr 2024 19:14:36 GMT
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 14 Nov 2022 22:35:03 GMT
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ec1ef2eac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17356
server: cloudflare

GET
H2 200 brands.min.css
www.bleepstatic.com/redesign/fontawesome6/css/ 18 KB
5 KB 52ms
33ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7e925f6192a3f7907621f9dde8afc47752d671d4a796f2cd5a53cfbc07c214b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "2013745295"
age: 1328
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3tNsbRtW%2B2Xs0kESx%2FNeVIIR1f0HL8ka2VJkwjFBIWYEW88wO9gMk1CkrvnUGkjkX4DckkVAgbueJgw3VqIM5Tfq5QLKVWJ4Q6mile9PhSSaReLa9paKavQCExGvS7O2%2F9PH1os%3D"}],"group":"cf-nel","max_age":604800}
expires: Mon, 03 Jun 2024 14:51:55 GMT
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 14 Nov 2022 22:34:45 GMT
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ec1ef2fac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4725
server: cloudflare

GET
H2 200 solid.min.css
www.bleepstatic.com/redesign/fontawesome6/css/ 572 B
691 B 53ms
33ms Stylesheet
text/css 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a5d218c8e40dc33b9a0c27b49c2a5d0c9696ea53ee6371882d348a31116ae9b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "508050520"
age: 1887
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N%2BfcHNvHfv3URAaVDt4hMlZ1hwQFbBh0YYHGg7PvlAEX8EEW3dA2OcwKMoqiMSMIzfbR%2FXY5pVVzIwtoOdAOvzpbw2ROeuy2vb5%2Bels2MMoKdF9Rf1aOFB84PksBfB%2BorBlly9o%3D"}],"group":"cf-nel","max_age":604800}
expires: Wed, 24 Apr 2024 06:24:07 GMT
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 14 Nov 2022 22:34:55 GMT
cache-control: max-age=3024000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ec1ef30ac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 325
server: cloudflare

GET
H2 200 292x176_kaspersky-headpic.jpg
www.bleepstatic.com/content/hl-images/2024/10/04/thumb/ 7 KB
8 KB 41ms
36ms Image
image/webp 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/content/hl-images/2024/10/04/thumb/292x176_kaspersky-headpic.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3726bc9cdc25850c1610bfda2ea287029a38bf6ad671505f05cdcb465c29635c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj: imgq:85,h2pri
cf-cache-status: HIT
age: 191578
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBBiK6BufMyfJM5aTU32M6zipDk1MWZXF34yurm9h5VpP3GQuyrJrqBlUKXFzttrHkQcbDW%2BTMy91DNDWN7TuhbsMfC%2Fj1R5y5%2B%2BdD%2FDX9yWhxqE%2FBzgWJWit5VfUZbvR2UnaNs%3D"}],"group":"cf-nel","max_age":604800}
expires: Mon, 04 Nov 2024 07:44:34 GMT
cf-polished: qual=85, origFmt=jpeg, origSize=41272
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: image/webp
content-disposition: inline; filename="292x176_kaspersky-headpic.webp"
vary: Accept
last-modified: Fri, 04 Oct 2024 15:12:25 GMT
cache-control: max-age=2592000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8cee0ec1ef35ac33-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7174
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 206ms
59ms Image
image/x-icon 142.251.32.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.102 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
age: 75900
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Mon, 07 Oct 2024 15:52:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 06 Oct 2024 15:52:33 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 achoice.svg
widgets.outbrain.com/images/widgetIcons/ 990 B
1 KB 206ms
55ms Image
image/svg+xml 104.76.105.170
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.76.105.170 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-76-105-170.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9ba56f5ffa579747efde1d2a429b325a9fb7220d30f4268e4a44ecbe4a9bf034

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=2592000
timing-allow-origin: *, *
etag: "5ab8e16b5f46213840bcd403e349419c:1708851030.144644"
access-control-request-headers: X-OB-STG,X-OB-PRD
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
expires: Wed, 06 Nov 2024 12:57:33 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 990
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: image/svg+xml
last-modified: Sun, 25 Feb 2024 08:33:18 GMT
server: AkamaiNetStorage

GET
H3 200 elLoader.js Show response
cds.connatix.com/p/534407/ Frame C4AF 4 KB
2 KB 144ms
122ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/elLoader.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e92bebb18c8a25431f4e007b6bc5826be2a958054a6875dbfc67ab9f43c5d78c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "13bccf5bf9d9a3e2e145e5567cd97157"
x-amz-version-id: wKtbZ5X5bfCQDVRKsW1Rt3ailpQM3pNw
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:33 GMT
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec22fe039f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1295
server: cloudflare

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/ 409 KB
136 KB 174ms
174ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

caef5d548559a26d1125292ccea6ded57ef001a7ee7ec2c442acc397f8320bc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 4382507124238384579
x-content-type-options: nosniff
expires: Mon, 07 Oct 2024 12:57:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 139479
x-xss-protection: 0
server: cafe

GET
H2 200 fa-solid-900.woff2
www.bleepstatic.com/redesign/fontawesome6/webfonts/ 147 KB
148 KB 130ms
36ms Font
application/octet-stream 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/webfonts/fa-solid-900.woff2
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d27bc752105c079f8a516e9142406a9fc12cbb409f9bf8681f2ddfe0360b52a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepstatic.com/redesign/fontawesome6/css/solid.min.css

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5090
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qiQQXue1qKpMlo%2FONMCNootDtDhxs3SeB3pTZsRjMaZ%2BGO8wembtT6KAd4M20TY5UYbQPN6Rwdv1%2B1AqB1L6UmbfT268r3Po%2FGXe9x4cXm5Gwsdk%2BViNvTSx%2FkXFvylTvDBBLzA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cee0ec34e3fa24d-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 150472
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: application/octet-stream
last-modified: Mon, 14 Nov 2022 22:33:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 fa-brands-400.woff2
www.bleepstatic.com/redesign/fontawesome6/webfonts/ 105 KB
105 KB 152ms
59ms Font
application/octet-stream 172.67.75.139
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/redesign/fontawesome6/webfonts/fa-brands-400.woff2
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.139 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fe890d088ecf0cc9bc1b9069201e52972dbad6237865524090e15982d0de718

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepstatic.com/redesign/fontawesome6/css/brands.min.css

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: HIT
age: 5090
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bzee7onK4bjZ88EoJcZAupZ8GlNIanOR7YSrB5kAFrvg9T8zkoRQuA%2FQUSfvCr9UT6tRqHKNI%2FwgdfQpPJrzVe4aJiaJ1QnogsTadWSwrToN5tjS0TbPkUytayV0epiXhO8cCiM%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cee0ec34e40a24d-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 107460
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: application/octet-stream
last-modified: Mon, 14 Nov 2022 22:32:23 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 104 KB
32 KB 191ms
126ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56c8c710a8f1b920ada5b7380786dc9d1cdd39a9cc169a8dcf13c1da68c4dff1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 557 / 20003 / 31087719 / config-hash: 7937456754187707229
x-content-type-options: nosniff
expires: Mon, 07 Oct 2024 12:57:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 32760
x-xss-protection: 0
server: cafe

GET
H3 200 prebid-analytics-8.49.83.js Show response
a.pub.network/core/ 599 KB
199 KB 122ms
74ms Script
text/html 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a.pub.network/core/prebid-analytics-8.49.83.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21a0123c7d24c9800ebed7a00fffd3ec7cef85f822425e8d50562984a2b4669

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 3
access-control-expose-headers: *
x-goog-hash: crc32c=INHiOQ==, md5=2+vtU2KBem0oDoO71+u6nQ==
cf-cache-status: HIT
etag: W/"dbebed5362817a6d280e83bbd7ebba9d"
age: 567
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Tue, 07 Oct 2025 12:48:06 GMT
x-goog-stored-content-length: 613609
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/html
last-modified: Tue, 24 Sep 2024 19:14:44 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY3jr-mBHJMb8yIq3jtW5TyYrXSFQBiPGOSLJU6RfMZ6NHiMSMzf5EqPI1DlfbyiqI6EpXWOEPafoA
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31535433
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8cee0ec2eeebac76-YYZ
access-control-allow-origin: *
x-goog-generation: 1727205284649035
content-language: en
server: cloudflare

GET
H3 200 pubfig.engine.js Show response
a.pub.network/bleepingcomputer-com/ 404 KB
116 KB 110ms
62ms Script
application/javascript 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a.pub.network/bleepingcomputer-com/pubfig.engine.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94ff1f1306a5fddddae74acd89697be49c91b3532a0e7467aae0d39d68a2a3ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=ogZWRg==, md5=gmSM469YYLoRPlX/D/LC2g==
cf-cache-status: HIT
etag: W/"82648ce3af5860ba113e55ff0ff2c2da"
age: 542
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Mon, 07 Oct 2024 13:57:33 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 413273
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: application/javascript
last-modified: Thu, 03 Oct 2024 22:19:02 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY2KY9IFNixqUjPrWBOrS15_ZHA_6VpXnb01fg1ICPXx8Tni7EPOAOgCq37S2rN8r0rKoS4
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8cee0ec2eeecac76-YYZ
access-control-allow-origin: *
x-goog-generation: 1727993942279472
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 209ms
39ms Fetch
text/plain 2607:f8b0:4006:822::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-GD465VRQLD&gtm=45je4a20v878037826za200&_p=1728305853168&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101747727&cid=1978249033.1728305854&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1728305853&sct=1&seg=0&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&dt=Hackers%20stole%20data%20from%20US%20defense%20org%20using%20Impacket%2C%20CovalentStealer&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2072
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GD465VRQLD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:822::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 connatix.player.js Show response
cds.connatix.com/p/534407/ Frame C4AF 461 KB
107 KB 32ms
32ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/elLoader.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 100dcc70ceed3d36c0229735475232af148ce4400b76b32db82bfba6f89ea99a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "fa941806d07ef27c49c777e038e4b195"
x-amz-version-id: knTBp8E6HS4z0Idn4dM.EGZYrr308IgW
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:33 GMT
date: Mon, 07 Oct 2024 12:57:33 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec3591d39f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 109508
server: cloudflare

GET
H/1.1 200
OK spc_fi.php Show response
cdn.firstimpression.io/delivery/ 39 KB
8 KB 283ms
133ms XHR
application/json 3.168.102.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&charset=UTF-8&ch=5&ref=www.bleepingcomputer.com&viewerId=null&referer=&_firid=9014840
Requested by: Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-97.jfk52.r.cloudfront.net
Software: Apache/2.4.38 (Debian) /
Resource Hash: 4d1b41f6359f729468e81f5f03bcc1562c700175d5640711ec7073546bf756e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer

Response headers

Content-Encoding: gzip
Expires: 0
X-Cache: Miss from cloudfront
P3P: CP="CUR ADM OUR NOR STA NID"
X-Amz-Cf-Id: TuQ05IaGRSfFrii3oI6KF4CYVdKkl61nxbM4G-heJcw25xVjsl7B1w==
Date: Mon, 07 Oct 2024 12:57:34 GMT
Content-Type: application/json; charset=UTF-8
Vary: Accept-Encoding
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: keep-alive
Access-Control-Allow-Credentials: true
Via: 1.1 7f9811832df4c0ab77fe1a54ea6ba566.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Content-Length: 7830
X-Amz-Cf-Pop: JFK52-P6
Server: Apache/2.4.38 (Debian)

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/ 482 KB
149 KB 58ms
47ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f799ff70a067cdb0d1110d608f80bae49955473be53048209b3e20321834d3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 16592206555246158576
age: 708
x-content-type-options: nosniff
expires: Tue, 07 Oct 2025 12:45:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:45:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 153017
x-xss-protection: 0
server: cafe

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 1 KB
405 B 179ms
112ms XHR
application/json 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

239.152.111.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

5c271fa286b937f7ca2c2a6aac0d99f37bd60614a3f55040789758abeb452394

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 07 Oct 2024 12:57:34 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 380
date: Mon, 07 Oct 2024 12:57:34 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 player.user.manager.service.js Show response
cds.connatix.com/p/534407/ Frame C4AF 57 KB
16 KB 51ms
35ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/player.user.manager.service.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb1ddff65a06e4feed4fcb2a1e7324c7d6c17db4528e947d3e9ce4c289a7837b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "3374d3a606d55e18a838b79cddf29456"
x-amz-version-id: DRfmbt6xvVVka3FYhbpjwd9kNBHs.J2T
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec52a7f39f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15473
server: cloudflare

GET
H3 200 player.renderer.js Show response
cds.connatix.com/p/534407/ Frame C4AF 196 KB
45 KB 51ms
35ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/player.renderer.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07a7d322d33b81078fb09c69d6e4eecfb01094a0c77c7251280bacb50e95e283

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "013305bd07477a65c35d5119f51d16ee"
x-amz-version-id: C7hc8WjucHmaAcb1VXUCoIdhmliUh25h
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec52a8139f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 46129
server: cloudflare

GET
H3 200 cSyncRemoteEntry.js Show response
cds.connatix.com/p/534407/ Frame C4AF 3 KB
2 KB 60ms
44ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/cSyncRemoteEntry.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5796204f01073e6d004dd05062ed63f6b6a296f16c5fe58cfa45ba797a789cda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "d21b10637251b672e9413cdd1e09a729"
x-amz-version-id: TSCf0jemdjiWLBPix374e5bBvaXUOgNH
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec52a8339f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1397
server: cloudflare

GET
H3 200 player.style.eba3e4dec5b26fab3aa1.css
cds.connatix.com/a/ 67 KB
10 KB 81ms
65ms Stylesheet
text/css 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/player.style.eba3e4dec5b26fab3aa1.css
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f5bd3c191c542f7768d9b2e28a52ee98b7044fe16f90ec1e6def50c16e0c5f9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "cbbb19c20cc059850af4e440801d4d0a"
x-amz-version-id: 0A91UQV8ONQoToJY_lKhgMZTrnCFGxLG
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/css
last-modified: Wed, 02 Oct 2024 09:01:01 GMT
vary: Accept-Encoding
access-control-allow-headers: range
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec52a8739f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9373
server: cloudflare

GET
H3 200 player.hls.3b8ed5f47382cd6f5e5e.js Show response
cds.connatix.com/a/ 290 KB
75 KB 59ms
43ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/player.hls.3b8ed5f47382cd6f5e5e.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5254e8ab0b9f1992a38f52ff56a0dfb029b305fb4b65d5f77fea8aae9968575a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "8357eb8086030130efce7e879fe17ec7"
x-amz-version-id: 7ZkmE.VpVxJmuQA7VCzJNSHCcIemPr8d
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:05 GMT
vary: Accept-Encoding
access-control-allow-headers: range
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec52a8939f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 76710
server: cloudflare

GET
H3 200 player.ads.js Show response
cds.connatix.com/p/534407/ Frame C4AF 407 KB
91 KB 77ms
66ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/player.ads.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 072f3591b81ab88fde295c598482c555d1fbc24e8cfa5a614fa884a0cfe43e83

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "eaa46e9cbcfbd408b67bd36331916c80"
x-amz-version-id: ZjMMEaL_j1Ofy8QgunBwemjUERGUjyiL
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec52a8a39f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 93043
server: cloudflare

GET
H3 200 / Show response
optimise.net/ 5 KB
5 KB 74ms
53ms Fetch
application/json 34.111.152.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://optimise.net/?k=0&d=bleepingcomputer.com&t=desktop&c=CA&r=1

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.152.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

c97034d4a5f5f0c97f7675bbde03e3944396aa2579238175d2cd2e7a41ca34e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
x-lm: 0

Response headers

access-control-max-age: 3600
access-control-expose-headers: fs-client-rtt,fs-country
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
expires: 0
fs-client-rtt: 17
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
fs-country: CA

OPTIONS
H2 200 /
optimise.net/ Frame 0
0 167ms
41ms Preflight 34.111.152.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://optimise.net/?k=0&d=bleepingcomputer.com&t=desktop&c=CA&r=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.152.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

239.152.111.34.bc.googleusercontent.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: x-api-key,x-lm
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: fs-client-rtt,fs-country
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
expires: 0
fs-client-rtt: 16
fs-country: CA
pragma: no-cache
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H/1.1 200
OK / Show response
tag.escalated.io/ 62 KB
26 KB 169ms
44ms Script
application/javascript 3.131.10.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.escalated.io/?i=KxxajmhPPCsT&d=www.bleepingcomputer.com&type=display&cust=5971&sid=direct&c=&cust2=direct
Requested by: Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.131.10.225 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-131-10-225.us-east-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a03fdbfe8dbcbbd024b57f3764d78b07bc70960c6396b499820d887eff0a7fb4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
ETag: W/"66c752ad-f905"
Connection: keep-alive
Date: Mon, 07 Oct 2024 12:57:34 GMT
Content-Type: application/javascript
Last-Modified: Thu, 22 Aug 2024 15:01:01 GMT
Server: nginx

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/ Frame E050 0
0 75ms
26ms Document
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20241001/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 114
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 07 Oct 2024 12:55:40 GMT
etag: 13108003645644964576
expires: Mon, 21 Oct 2024 12:55:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 110ms
108ms Image
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=HEADER&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame AA1E 0
0 168ms
131ms Document
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&abgtt=1&lmt=1690998835&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C41%3A32%2C42%3A32&plas=188x675_l%7C188x675_r&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&pra=7&wgl=1&aihb=0&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aifxl=29_18~30_19&aiixl=29_5~30_6&aslmct=0.7&asamct=0.7&aipaq=1&aiombap=1&aipecl=1&aief=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1728305853790&bpp=5&bdt=1101&idt=536&shv=r20241001&mjsv=m202410010101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=7863045446217&frm=20&pv=2&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706%2C44798934%2C95331688%2C95343455%2C95344188%2C95335246&oid=2&pvsid=1659096474971687&tmod=1188346480&uas=0&nvt=1&fsapi=1&fc=896&brdim=70%2C70%2C70%2C70%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&fsb=1&dtd=578

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202410010101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 66
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 07 Oct 2024 12:57:34 GMT
expires: Mon, 07 Oct 2024 12:57:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 mny Show response
capi.connatix.com/core/ Frame C4AF 26 KB
11 KB 87ms
86ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/mny?v=534407&tier=2&cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a69c5c19c75c50f3faa60374fa2c972a9a0d35eee8191d7cb7bdf9dfed9d9a8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8cee0ec61de6ac78-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 10767
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

GET
H3 200 522.js Show response
cds.connatix.com/p/534407/ Frame C4AF 97 KB
25 KB 38ms
35ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/522.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/cSyncRemoteEntry.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 167bfddffc7fd18b0e1971f7b615caad381e96e79d27d6dd86346cc9453cac6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "b2ed618f03d9b5a69a7e33cdf42afcc3"
x-amz-version-id: LIs.oDIOUInvyZjkvYKRsuJKOrNv6EJH
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec67b9339f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25165
server: cloudflare

GET
H3 200 788.js Show response
cds.connatix.com/p/534407/ Frame C4AF 26 KB
8 KB 38ms
34ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/788.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/cSyncRemoteEntry.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e23988b0847a38d1c5b3942c8a67daf196b0647eb88af870404cf3a41e3a2db4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "1570611285240dcc1495ef108a0916ea"
x-amz-version-id: 9pBFCpJBdoewtLSspe04re5L38xBYGWu
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec67b9439f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7438
server: cloudflare

GET
H3 200 402.js Show response
cds.connatix.com/p/534407/ Frame C4AF 3 KB
2 KB 38ms
35ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/402.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/cSyncRemoteEntry.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f37a7fa6a2fc486636dc3283a303ce4b9fefe0448c7df92d6409e89d3180d23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "eb31a05aa2795e62cb8b57d82ed4b98a"
x-amz-version-id: rWwj0DO4Fb6bk8ebvaRjl8DYZ2U6Hosm
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:03 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec67b9539f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1297
server: cloudflare

POST
H3 200 / Show response
capi.connatix.com/metrics/ Frame C4AF 0
375 B 96ms
65ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/metrics/?v=534407&tier=2
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8cee0ec729a936c0-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 20
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 128ms
29ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 07 Oct 2024 12:57:33 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 272833
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 96ms
30ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 07 Oct 2024 12:57:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 281289
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.js Show response
cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/ 104 KB
22 KB 111ms
65ms Script
text/javascript 172.64.144.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.144.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a6590a28ad28c914327ff72f1b7360b65876a990928a871aee974222ef526c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "7e06c2ff01bb8551609122b75fc114d1"
age: 199
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Mon, 07 Oct 2024 12:39:43 GMT
vary: Accept-Encoding
x-amz-id-2: Oe4Omb52UCKibzd3gn3PaK372HBy9s/abhYPePYPYwMgnxyEuK+XwZ+bqM+AqAznjhXqH09/Icw=
cache-control: public, max-age=900, stale-while-revalidate=3600
x-amz-request-id: PC6GMD7T1NGCM092
cf-ray: 8cee0ec78d67aafe-YYZ
accept-ranges: bytes
content-length: 22225
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2

200

tag Show response
btloader.com/
Redirect Chain

https://freestar-io.videoplayerhub.com/gallery.js
https://btloader.com/tag?h=freestar-io&upapi=true

57 KB
19 KB

70ms
26ms

Script
application/javascript

2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?h=freestar-io&upapi=true
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 587abe6d09fa38957e44e7da541bf85616dc64235598020877bdcc33a181abc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "b5bd15ae37d15f63336789526665749d"
age: 481
via: 1.1 google
cf-ray: 8cee0ec89bc04bc5-YUL
accept-ranges: bytes
content-length: 19426
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 12:49:03 GMT
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=3600
location: https://btloader.com/tag?h=freestar-io&upapi=true
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UqZcJE0XKlvIyYecYbgUhOeQdKUeVgY4pePPONdoIFCrCmqJ%2BKbOy0m4lZgDDh4H40Vj6EL8zXTsfztFqyO8OwgSQoGPwdLbU2gXNthhw5%2FqgiuEOhsSEJZx%2FV%2FAcpFqPkPeTc%2B1AVNHEepNhyOw9wOMMVRiXNlIaOKmSw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cee0ec7e85ea300-YUL
expires: Mon, 07 Oct 2024 13:57:34 GMT
content-length: 167
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 324 KB
80 KB 123ms
28ms Script
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fdb7c12792ebd6e785128456249178e9b508c9677a300df8fbc6e7520147baa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"907cbdd883935369790d45cc9bd9e8b7"
age: 2374
via: 1.1 7eefe38d76087dfad8e2f0b7702246ee.cloudfront.net (CloudFront), 1.1 c824f42276c55792245504036b5383fa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 6A4x2FqrufYD4Rns0fTQujFH7NFMCPO8ptdK1F5LaGhJxt9hJ2OrMw==
date: Mon, 07 Oct 2024 12:18:01 GMT
content-type: application/javascript
last-modified: Wed, 28 Aug 2024 22:46:36 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 56 KB
12 KB 119ms
24ms Script
application/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&ref=&_it=freestar&partner_id=474&ha=_hadron
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 492db2ca577f4d221e3e28239c19e7db05f1701b298bf278fc4d1fcb92563586

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=432000
content-encoding: br
cf-bgj: minify
etag: W/"1e77f38a1df1490d4175e3c4878bd150"
age: 4552
cf-cache-status: HIT
x-amz-request-id: 4GNMNHQXA94JVW78
cf-ray: 8cee0ec7ffaca278-YUL
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/javascript
last-modified: Tue, 04 Jun 2024 15:30:02 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: FNS8Lc8R9Qji432eQyZbGDDgvyWHvIXmOzDykwh9qe1J2fX8u6aO0aANuFN3vxu6aVi9rB6lRRQ=

GET
H2 200 4d97a662ad Show response
pb-rtd.ccgateway.net/v1.0/realtime/ 408 B
755 B 389ms
195ms Fetch
application/json 54.200.182.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-rtd.ccgateway.net/v1.0/realtime/4d97a662ad?profile_id=0d55b514-5b40-4e6a-bb4b-2c665e303845&url=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%252F&context=true&audience=true&deal_ids=true&custom_taxonomy=true
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.200.182.101 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-200-182-101.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 253bdcd4b8687767bc030fe999a5da4a67cad640b25d9230a524d034e3afe510

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=3600
etag: "408-fc997b2e"
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 408
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json; charset=utf-8
vary: Origin

GET
H2 200 edgekit.min.js Show response
cdn.edkt.io/PV483g/ 21 KB
7 KB 105ms
18ms Script
text/javascript 34.120.111.33
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.edkt.io/PV483g/edgekit.min.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.111.33 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 33.111.120.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: d3b16d5344c0bcf02a062a1944b979ebf34cb07058ccd5bd31defcce4abdb60b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=618NpA==, md5=GHT/49r8C6ArRmoPwLQmhw==
etag: "1874ffe3dafc0ba02b466a0fc0b42687"
age: 83046
x-goog-stored-content-encoding: gzip
expires: Mon, 07 Oct 2024 13:53:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 6717
date: Sun, 06 Oct 2024 13:53:28 GMT
last-modified: Thu, 03 Oct 2024 15:56:50 GMT
content-type: text/javascript
x-guploader-uploadid: AHmUCY2qHH_p-XWIRdXe7qQUF4ObV1_xvSerpWqWTV1FabWsatUwQAiPiqVbcgmGUEajEK0ScmtZZ_D2dw
cache-control: public, max-age=86400,no-transform
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1727971010398211
content-length: 6717
server: UploadServer

GET
H3

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0
https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0&b=1&tp=JK%2BnXIICFiRFJtktjsmccnHZ%2FmmnFabSu%2BJ%2BT3Amdgk%3D

42 B
58 B

34ms
33ms

Fetch
application/json

35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0&b=1&tp=JK%2BnXIICFiRFJtktjsmccnHZ%2FmmnFabSu%2BJ%2BT3Amdgk%3D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: origin

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
location: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0&b=1&tp=JK%2BnXIICFiRFJtktjsmccnHZ%2FmmnFabSu%2BJ%2BT3Amdgk%3D
access-control-allow-credentials: true
referrer-policy: unsafe-url
via: 1.1 google
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
vary: origin

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58657/ 2 B
219 B 147ms
35ms Fetch
application/json 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58657/fed?v=1&1p=0&gdpr=0&gdpr_consent=&us_privacy=&url=https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/&pixelId=58657

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

ATS/9.1.10.137 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Origin
server: ATS/9.1.10.137

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=SwJhNXw2NlBvYlprb2s5dXJxN0lsSDBvSXZUcGVweVRlSGw5d2tsbEM3WkpCekE0NjdEV2R6RkpHKzhnZXE3OCtLZGx0RE41cXR3NzJ4bGl2MkNGODdEcFFtSlZlMzV1OVhUSVh0TTF6UkxQOGo5dVZvckdMYjJIb1hSbz...

396 B
974 B

244ms
125ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=SwJhNXw2NlBvYlprb2s5dXJxN0lsSDBvSXZUcGVweVRlSGw5d2tsbEM3WkpCekE0NjdEV2R6RkpHKzhnZXE3OCtLZGx0RE41cXR3NzJ4bGl2MkNGODdEcFFtSlZlMzV1OVhUSVh0TTF6UkxQOGo5dVZvckdMYjJIb1hSbzZTbUlIc0VMNkMyeGl0bFlBcktiZzlNNWNMVzZBWnh3VVFNVG03UFhTb1NnWGtpWmZvWmhUZkFuQXpWQTl0bGtnQzhqZzZDTmxUV3JxWFlhYlRXeVh3UmoyOVlMUUkxL05ISzRFdFJBRTZMSGk0ZFNEL3c3eVJvTzVoMDRlNE9NeXNxV3BpZkNTZ1pBQW5hSGRyTWkvcWZSQ1E5VmduZz09fA&cppv=2

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a064c1f21885504b7102db10b842f0dfe9156b96c48d5c9fa1328224adb556f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 590481
expires: 0
access-control-allow-origin: null
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=SwJhNXw2NlBvYlprb2s5dXJxN0lsSDBvSXZUcGVweVRlSGw5d2tsbEM3WkpCekE0NjdEV2R6RkpHKzhnZXE3OCtLZGx0RE41cXR3NzJ4bGl2MkNGODdEcFFtSlZlMzV1OVhUSVh0TTF6UkxQOGo5dVZvckdMYjJIb1hSbzZTbUlIc0VMNkMyeGl0bFlBcktiZzlNNWNMVzZBWnh3VVFNVG03UFhTb1NnWGtpWmZvWmhUZkFuQXpWQTl0bGtnQzhqZzZDTmxUV3JxWFlhYlRXeVh3UmoyOVlMUUkxL05ISzRFdFJBRTZMSGk0ZFNEL3c3eVJvTzVoMDRlNE9NeXNxV3BpZkNTZ1pBQW5hSGRyTWkvcWZSQ1E5VmduZz09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 301453
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
server: Kestrel

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
330 B 127ms
33ms Fetch
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.bleepingcomputer.com
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a36cd619ac68a4a39eb1be94925967f014d1e7dc4a679f6dc86807416c2ae930

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: br
allow: POST, OPTIONS, GET
cf-ray: 8cee0ec8394ca29c-YUL
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
673 B 599ms
119ms Fetch
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-7-94-99.compute-1.amazonaws.com

Software

Resource Hash

69ddbfe0111131323a6c637b0fcf18449cd7f4bab70211c0b2c9bb51232bdb9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 any Show response
idx.liadm.com/idex/did-0047/ 130 B
552 B 146ms
36ms Fetch
text/plain 52.7.94.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/did-0047/any?duid=83077f409aa5--01j9kgwy543pv0ybxzz1y25dqk&did=did-0047&cd=.bleepingcomputer.com&pu=https%3A%2F%2Fwww.bleepingcomputer.com&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=thetradedesk&resolve=medianet

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.7.94.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

08d5a3003ee71c4d4a41dec6a49be251023770715fb3d8b4b495422830b47ad3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 255998556a37b39c
request-time: 4
access-control-allow-credentials: true
expires: Tue, 08 Oct 2024 12:57:34 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 130
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
572 B 127ms
31ms Fetch
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=6bjin1p&fmt=json
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 73f518210498490da6d160b831f3db8cdd380436f2caf2c1ee5344a02bbbf38e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Wed, 06 Nov 2024 12:57:34 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

GET
H3

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0
https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0&b=1&tp=AxHrRCg8RANWENxVhNlckGIYLQFnJ0sJd3rD5if19Ow%3D

42 B
58 B

36ms
35ms

Fetch
application/json

35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0&b=1&tp=AxHrRCg8RANWENxVhNlckGIYLQFnJ0sJd3rD5if19Ow%3D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: origin

Redirect headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
location: https://lexicon.33across.com/v1/envelope?pid=0013300001cFpYHAA0&gdpr=0&src=pbjs&ver=8.49.83&coppa=0&b=1&tp=AxHrRCg8RANWENxVhNlckGIYLQFnJ0sJd3rD5if19Ow%3D
access-control-allow-credentials: true
referrer-policy: unsafe-url
via: 1.1 google
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
vary: origin

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58657/ 2 B
30 B 152ms
34ms Fetch
application/json 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

ATS/9.1.10.137 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

strict-transport-security: max-age=31536000
age: 0
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Origin
server: ATS/9.1.10.137

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=xK40Qnx4a0lTQzB5VXh5QytUNGh5VDdnd2tlbzR6ZEZvMEdkWFAxZGswNkNpVXJ2T1NXSnU0aUFBTVNQMktNVjdQbUxEcENhMENnM3BzMi9aZzN6dE4xK1NsaHREQmkvTkhxam1UeDlpdEVxNzdHeDBZaTc3SHM1eXJ6Ym...

384 B
963 B

243ms
124ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=xK40Qnx4a0lTQzB5VXh5QytUNGh5VDdnd2tlbzR6ZEZvMEdkWFAxZGswNkNpVXJ2T1NXSnU0aUFBTVNQMktNVjdQbUxEcENhMENnM3BzMi9aZzN6dE4xK1NsaHREQmkvTkhxam1UeDlpdEVxNzdHeDBZaTc3SHM1eXJ6YmtjbmJUZjI1V0xOaThGMEIyTVR5c3QzdXJidXpCRUtad1l0Um5taUU2ZFRZdjNKd3JsOXgxVFh3cUxKNUhrQmM5aEpXTy90SjRTaC9mTWdacHFwNkMrMXhDeC9QVE1teWdRRCt3M3Z3a2dZMWJQcE1jQzZrTkpiZWFGYW5JVHZqNyttbmRNdkpoTC9UTll3TWN4U3A3UFMwT1lyYWZFQT09fA&cppv=2

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

7d3c3ac19e1ceb360aa84b5a7e9aa3f5c0032b46aad12a1c134265c1f8c35efb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 528841
expires: 0
access-control-allow-origin: null
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=xK40Qnx4a0lTQzB5VXh5QytUNGh5VDdnd2tlbzR6ZEZvMEdkWFAxZGswNkNpVXJ2T1NXSnU0aUFBTVNQMktNVjdQbUxEcENhMENnM3BzMi9aZzN6dE4xK1NsaHREQmkvTkhxam1UeDlpdEVxNzdHeDBZaTc3SHM1eXJ6YmtjbmJUZjI1V0xOaThGMEIyTVR5c3QzdXJidXpCRUtad1l0Um5taUU2ZFRZdjNKd3JsOXgxVFh3cUxKNUhrQmM5aEpXTy90SjRTaC9mTWdacHFwNkMrMXhDeC9QVE1teWdRRCt3M3Z3a2dZMWJQcE1jQzZrTkpiZWFGYW5JVHZqNyttbmRNdkpoTC9UTll3TWN4U3A3UFMwT1lyYWZFQT09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 240329
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
server: Kestrel

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
178 B 130ms
30ms Fetch
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=474&_it=prebid&t=1&src=id&domain=www.bleepingcomputer.com
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a36cd619ac68a4a39eb1be94925967f014d1e7dc4a679f6dc86807416c2ae930

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

content-encoding: br
allow: POST, OPTIONS, GET
cf-ray: 8cee0ec8798aa29c-YUL
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
672 B 565ms
117ms Fetch
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

69ddbfe0111131323a6c637b0fcf18449cd7f4bab70211c0b2c9bb51232bdb9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 any Show response
idx.liadm.com/idex/did-0047/ 130 B
0 120ms
120ms Fetch
text/plain 52.7.94.99
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://idx.liadm.com/idex/did-0047/any?duid=83077f409aa5--01j9kgwy543pv0ybxzz1y25dqk&did=did-0047&cd=.bleepingcomputer.com&pu=https%3A%2F%2Fwww.bleepingcomputer.com&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=thetradedesk&resolve=medianet
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.7.94.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-94-99.compute-1.amazonaws.com
Software: /
Resource Hash: 08d5a3003ee71c4d4a41dec6a49be251023770715fb3d8b4b495422830b47ad3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: max-age=86399, private
trace-id: 255998556a37b39c
request-time: 4
access-control-allow-credentials: true
expires: Tue, 08 Oct 2024 12:57:34 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 130
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
0 105ms
105ms Fetch
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=6bjin1p&fmt=json
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 73f518210498490da6d160b831f3db8cdd380436f2caf2c1ee5344a02bbbf38e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: text/plain
Referer

Response headers

cache-control: private
content-encoding: gzip
access-control-allow-credentials: true
expires: Wed, 06 Nov 2024 12:57:34 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

sync Show response
capi.connatix.com/core/ Frame C4AF
Redirect Chain

https://capi.connatix.com/core/sync
https://capi.connatix.com/core/sync?final=true&UseUserScore=Yes&LiveIntentCnxUserId=&ImplementationType=0&ClientAb2=0

6 KB
3 KB

70ms
69ms

XHR
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/sync?final=true&UseUserScore=Yes&LiveIntentCnxUserId=&ImplementationType=0&ClientAb2=0
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99f3b57bf34b4dd5db1655eef3db0355bcfc42f77761192ccc4b7120af01d0f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8cee0ec8b918ac78-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 2623
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
location: https://capi.connatix.com:443/core/sync?final=true&UseUserScore=Yes&LiveIntentCnxUserId=&ImplementationType=0&ClientAb2=0
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8cee0ec8384dac78-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=86400
content-length: 29
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

POST
H3 200 pls Show response
capi.connatix.com/core/ Frame C4AF 1 KB
2 KB 74ms
73ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=534407&tier=2&cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cae4144413df21b6c3c8fab948b160eced465adba1938305385c82fabf5105

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8cee0ec83850ac78-YYZ
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 1259
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/x-protobuf
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
10 KB 231ms
39ms Script
application/javascript 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 20133cc700841ec85f087ff9834a922b482b9135e98574a9afebade4c754558c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=604800
content-encoding: gzip
etag: "HP/dXILNCv8vRT01LqWQOg=="
expires: Mon, 14 Oct 2024 12:57:34 GMT
accept-ranges: bytes
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/javascript
vary: Accept-Encoding

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ 588 KB
184 KB 343ms
91ms Script
application/x-javascript 23.209.72.204
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.209.72.204 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-209-72-204.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: c92424bdf9df72052ba3e5481148ba6869069e93a6f51ff8b67e713b3516631d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Encoding: gzip
ETag: "3caa323522c06f1b207fe7f044d92c02"
Access-Control-Allow-Methods: GET
Date: Mon, 07 Oct 2024 12:57:35 GMT
Last-Modified: Fri, 04 Oct 2024 16:26:07 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
x-amz-id-2: /IwEpf1dHCiYpJjB0cBW/W7A+49fo59v5CE/GLMyTnd6kggyWb9BQx7nw78RwcJLGt0lDKiKqlo=
Transfer-Encoding: chunked
Access-Control-Allow-Headers: *
Cache-Control: public, max-age=3600
Connection: keep-alive, Transfer-Encoding
x-amz-request-id: ZR41TP7M5YB992VK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 freestar_close_button.svg
a.pub.network/core/imgs/ 1 KB
1 KB 33ms
31ms Image
image/svg+xml 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.pub.network/core/imgs/freestar_close_button.svg

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b60f65161ce3517c2794eecab25981c51ffbcbc951a781270403e2f3572d0290

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.bleepingcomputer.com/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=xUDeFg==, md5=1OG2/3P8Bvg2SBLmidtA+g==
cf-cache-status: HIT
etag: W/"d4e1b6ff73fc06f8364812e689db40fa"
age: 568
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Mon, 07 Oct 2024 13:57:34 GMT
x-goog-stored-content-length: 1211
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: image/svg+xml
last-modified: Wed, 04 Sep 2024 08:16:13 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY39GDLzx5pkP6IYPKPN7_GssGrPDWGGSq94OxiInLUDgmzdCEWcmfJHfm0SaiNUJSBHvA
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8cee0ec87b64ac76-YYZ
access-control-allow-origin: *
x-goog-generation: 1725437773526766
server: cloudflare

GET
H3 200 fslogo-green.svg
a.pub.network/core/imgs/ 1 KB
1 KB 34ms
33ms Image
image/svg+xml 104.18.21.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.pub.network/core/imgs/fslogo-green.svg

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.21.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecc20ed3c5dedbe5bbe73d1e7b14270c65a85f7d0ec4c94c4f0c9f0071e471a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 2
access-control-expose-headers: *
x-goog-hash: crc32c=Jh+rSg==, md5=Mm1svZd2V+EgW9YW0fL6yg==
cf-cache-status: HIT
etag: W/"326d6cbd977657e1205bd616d1f2faca"
age: 568
content-encoding: br
x-goog-stored-content-encoding: identity
expires: Mon, 07 Oct 2024 13:57:34 GMT
x-goog-stored-content-length: 1193
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: image/svg+xml
last-modified: Tue, 08 Sep 2020 17:04:37 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHmUCY0RzFU1PgYeoSLwfA48oXmQuxwTIEwM1CTRFG9UjJVeGCF1x7iIkOeGGbuywju0keLBJTM
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8cee0ec88b72ac76-YYZ
access-control-allow-origin: *
x-goog-generation: 1599584677716817
server: cloudflare

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame D16D 0
0 181ms
26ms Document
text/html 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-131-10-225.us-east-2.compute.amazonaws.com

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 54
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29417
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 07 Oct 2024 12:56:40 GMT
expires: Mon, 07 Oct 2024 13:46:40 GMT
last-modified: Mon, 30 Sep 2024 19:42:40 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 66ms
45ms Fetch
text/plain 34.160.152.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 5348af936dc014d183cc06f6fe0c112b7ad321a51eb9a4c98dc869f8c8f76f1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS
H2 200 c
c.pub.network/v2/ Frame 0
0 91ms
43ms Preflight 34.160.152.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 07 Oct 2024 12:57:34 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers
via: 1.1 google

POST
H/1.1 200
OK post Show response
tag.escalated.io/ 31 B
445 B 163ms
80ms Fetch
application/json 3.131.10.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.escalated.io/post

Requested by

Host: tag.escalated.io
URL: https://tag.escalated.io/?i=KxxajmhPPCsT&d=www.bleepingcomputer.com&type=display&cust=5971&sid=direct&c=&cust2=direct

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

3.131.10.225 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cd63c7f3ef9ad599a0d22ef301fe25222b2775237591bd8998921b3a960458a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer

Response headers

Cache-Control: no-store
Connection: keep-alive
X-Content-Type-Options: nosniff
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Content-Length: 31
Date: Mon, 07 Oct 2024 12:57:34 GMT
X-XSS-Protection: 1; mode=block
Content-Type: application/json; charset=utf-8
Server: nginx
Access-Control-Allow-Headers: X-Forwarded-For, X-Requested-With, Content-Type

GET
H3 200 wrap.js Show response
cdn.confiant-integrations.net/gptprebidnative/202407090940/ 284 KB
101 KB 31ms
31ms Script
application/javascript 172.64.144.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/gptprebidnative/202407090940/wrap.js
Requested by: Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.144.166 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d3ec73884fd2e63fb637af556b4725f116702bab37326dbf7ce0e876d7b1587

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: "76074361c87e7c8d3af88302818b71f9"
age: 193734
alt-svc: h3=":443"; ma=86400
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 09 Jul 2024 14:20:21 GMT
vary: Accept-Encoding
x-amz-id-2: ceEDLMAPV8LfkBwtgPwkxekwYWHc/w08rEkB8RdQoTetB1rAY+qWH31lP6oNDqdwFMTfCIq1dq0=
cache-control: public, max-age=31536000
x-amz-request-id: NRH9Z782HM635ZYQ
cf-ray: 8cee0ec8be75aafe-YYZ
accept-ranges: bytes
content-length: 103346
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H3 200 insights.bin Show response
ins.connatix.com/01edb87e-dd11-404d-8bd2-399ed97b314b/485/ Frame C4AF 1 KB
950 B 339ms
52ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/01edb87e-dd11-404d-8bd2-399ed97b314b/485/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfcec25b509b2c313d539be2c2b43d70051d6952bdc1cfebc43374dfaf31afd0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"f9d16303f564afc3c90cb0f7ad6df99e"
access-control-allow-methods: GET, HEAD
cf-ray: 8cee0eca9d6f543d-YYZ
expires: Tue, 07 Oct 2025 12:57:35 GMT
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/x-protobuf
last-modified: Mon, 07 Oct 2024 12:41:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 485_media.bin Show response
vid.connatix.com/pid-de820c7a-cd3f-49f4-9038-04e5790f8d5e/01edb87e-dd11-404d-8bd2-399ed97b314b/4f72a3b5-c63b-4e92-991c-ac433ebbebb6/ Frame C4AF 3 KB
2 KB 295ms
55ms XHR
application/x-protobuf 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/pid-de820c7a-cd3f-49f4-9038-04e5790f8d5e/01edb87e-dd11-404d-8bd2-399ed97b314b/4f72a3b5-c63b-4e92-991c-ac433ebbebb6/485_media.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba16e0ab3c4601a6240944098735e6bcebf747580cea6288682e914ee97f7b81

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: W/"00715e8b341723f487696a030506a923"
xpid: de820c7a-cd3f-49f4-9038-04e5790f8d5e
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:35 GMT
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/x-protobuf
last-modified: Mon, 07 Oct 2024 12:41:28 GMT
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-headers: range
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0eca4c7d36b1-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H3 200 player.iframe.integration.destroy.03a10b5af1f932ad8f8c.js Show response
cds.connatix.com/a/ 748 B
739 B 37ms
36ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/player.iframe.integration.destroy.03a10b5af1f932ad8f8c.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fc8b44087def36c625fbd07d7679353f5d3d2e84e400d5fc96bb65b6ceb0c85

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "76a212c2c170d00707fac5cc48e423dd"
x-amz-version-id: YBmzTf1tB4Sid2Ro1jV5CRy_aHoom0GJ
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:34 GMT
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:05 GMT
vary: Accept-Encoding
access-control-allow-headers: range
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ec8cd3939f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 378
server: cloudflare

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 41ms
40ms Preflight
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.bleepingcomputer.com&url=https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8cee0ec8c9c6a29c-YUL
content-length: 0
content-type: application/json
date: Mon, 07 Oct 2024 12:57:34 GMT
debug: OPTIONS block
expires: Tue, 07 Oct 2025 12:57:34 GMT
server: cloudflare

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 130 B
281 B 41ms
41ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=freestar&partner_id=474&sync=0&domain=www.bleepingcomputer.com&url=https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&ref=&_it=freestar&partner_id=474&ha=_hadron
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16b8e0d0fe21f525ac9436871a9aaf916b65159634a7eb348278f49fe32bb2b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
debug: NON-OPTIONS
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
access-control-allow-credentials: true
cf-ray: 8cee0ec919f3a29c-YUL
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 271ms
27ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 07 Oct 2024 12:57:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 165401
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 0ab198dd-b265-462a-ae36-74e163ad6159 Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 289ms
19ms Script
application/javascript 108.138.106.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/0ab198dd-b265-462a-ae36-74e163ad6159
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-70.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: ee5ebc2e5e093ee9ea3485ae13632e54bba29b488b7956923112de35efe7ded4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=3600
age: 3281
via: 1.1 134f499632d1e15750219cb766bdc50c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: r4XaSZ4ZieTH90dSRfRu0YKchWSoIhHAQ74Z6YDTsUtz7bc_aK_RxA==
date: Mon, 07 Oct 2024 12:02:54 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 3 KB
3 KB 26ms
25ms XHR
application/json 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 3cc3e7477f9c8eef291c048ee6e8e4e15d57a4b95c315089e072ef1dd190fb2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 16573
access-control-allow-credentials: true
via: 1.1 c824f42276c55792245504036b5383fa.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Hit from cloudfront
content-length: 2865
x-amz-cf-id: 11tiWae8mgSA0kLkBY-QZVIRL_CKdLN-74Ho9e7zdYHbacIUhU1usg==
date: Mon, 07 Oct 2024 08:21:20 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 309 B
585 B 626ms
375ms XHR
text/javascript 18.173.140.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&pid=ZWyTIhyxOKQN8&cb=0&ws=1600x1200&v=24.827.1552&t=923&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_728x90_320x50_InContent_1%22%2C%22s%22%3A%5B%22728x90%22%2C%22554x312%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_1%22%2C%22s%22%3A%5B%22300x250%22%2C%22120x600%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_2%22%2C%22s%22%3A%5B%22300x250%22%2C%22120x600%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_300x250_300x600_160x600_Right_3%22%2C%22s%22%3A%5B%22300x250%22%2C%22120x600%22%2C%22160x600%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%2C%7B%22sd%22%3A%22bleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%2C%22554x312%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C412%2C1%2C%2C%2C&sm=be584c11-3f46-49e3-97c4-ca1eb9a0f57e&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.140.223 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-140-223.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 6b2ae20a29ff4098ba9bb9b66a7c41df1194d20b9cd4267887337785f7a80c48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 82713ebbf03d41ed38c813ce60a18fea.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 247
x-amz-cf-id: JOcPTuKSdwzXrRSDkzr0D-x0K3-3Xy9CgzRQlYc7MA9WxiAa-3ag7Q==
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK52-P2
server: Server

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 79ms
27ms XHR
application/javascript 108.138.115.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.115.149 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-115-149.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
age: 82894
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: HOPjaL0JcTyUSrc0erdQAJhXNtRK4tZscZavvjkh6_iDP-ND1Hd0zg==
date: Sun, 06 Oct 2024 13:56:00 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 749177a97cae42477f22c33c927ca0ce.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 309 B
585 B 593ms
361ms XHR
text/javascript 18.173.140.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&pid=ZWyTIhyxOKQN8&cb=1&ws=1600x1200&v=24.827.1552&t=923&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22s%22%3A%5B%221x1%22%2C%22300x50%22%2C%22320x50%22%2C%22468x60%22%2C%22728x90%22%2C%22970x90%22%2C%22300x100%22%2C%22320x100%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C412%2C1%2C%2C%2C&sm=be584c11-3f46-49e3-97c4-ca1eb9a0f57e&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.140.223 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-140-223.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: f0d82e816d4f9448e8f703ad40ede1ce7147efe73f2d34dba6746fac528e51ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 82713ebbf03d41ed38c813ce60a18fea.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 247
x-amz-cf-id: tH5BJgWKizrpfiMaedmv4TufQluz98eG803DX_ssmR__vHNFIh1IXA==
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK52-P2
server: Server

GET
H2 200 websiteconfig Show response
btloader.com/ 873 B
718 B 64ms
26ms Fetch
application/json 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/websiteconfig?bt_env=prod&o=5714937848528896&w=bleepingcomputer.com
Requested by: Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c00ebe93116b02e063110f65a8f4b9fd5f71108600be4aaabd87f85d51f4976

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "651ce3f35c516c65172ff65de7c5843e"
age: 416
via: 1.1 google
cf-ray: 8cee0ec98b07a2fe-YUL
accept-ranges: bytes
access-control-allow-origin: *
content-length: 435
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json
last-modified: Mon, 07 Oct 2024 12:50:09 GMT
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
917 B 251ms
41ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 344120
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sLOJm80xeYkspgXTY1OAG5IEHecFELMcuvXWqdSINPOXf9ehNup2z07WnvmhDHxtgwK0uZVsAYOENFp%2F75yls2vyFQzSfcFmrGJqDXl%2FiJATkpPI3QhP2zsuNfxOqpRxFwNTBB51vl5jto0wjg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Thu, 03 Oct 2024 14:06:12 GMT
x-goog-stored-content-length: 43
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHxI1nON5bDf5895erX08TY-yIFYnfWwRsCEM5OFjRsyEbQQ4Hhq8NDcqB7UeLKSQdT2bEj2L18hLqBztg
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8cee0eca9ecca2b6-YUL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 px.gif
ad-delivery.net/ 43 B
341 B 250ms
41ms Image
image/gif 2606:4700:20::ac43:4513
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7795622174711478
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4513 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 344120
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljMMQYmg%2F%2B7Ayn55kN9nT9vmxzhQloHgcAQukg%2Bo4JH8y1uxwUSldCpp%2FlEvdqewlEJzbqD3bVIVMlINsYxK2XjY6ryLk5yUbf5RUNUVRzY1GCpHEWukAElRmEjr7tA%2BeudzjUZA0ASYAlEJDw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Thu, 03 Oct 2024 14:06:12 GMT
x-goog-stored-content-length: 43
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AHxI1nON5bDf5895erX08TY-yIFYnfWwRsCEM5OFjRsyEbQQ4Hhq8NDcqB7UeLKSQdT2bEj2L18hLqBztg
cache-control: public, max-age=86400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 8cee0eca9ecda2b6-YUL
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 insights.bin Show response
ins.connatix.com/402a223e13b5ecf41f403eabc125f646/ Frame C4AF 504 B
568 B 257ms
60ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/402a223e13b5ecf41f403eabc125f646/insights.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f331ebda6dc889fd97301eec66419c08045589d3766ccc0dac1294becfda6aea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
content-encoding: br
cf-cache-status: HIT
etag: W/"09bf76b73b665f4c254b33f2e9cb5445"
access-control-allow-methods: GET, HEAD
cf-ray: 8cee0eca9d71543d-YYZ
expires: Tue, 07 Oct 2025 12:57:35 GMT
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/x-protobuf
last-modified: Tue, 25 Jun 2024 21:24:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17331/ 43 KB
13 KB 245ms
41ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17331/sync.min.js?gdpr=0
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/788.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f48c5d349a73b41850ff4349fc02a2e43f172ecfbb5efe7e9437e6ca38403178

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7a801cdc14047a14bf5f276389e89151"
age: 6454
via: 1.1 41c6f8f93eca2f7c81a04a82e2d6ae92.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: QPyPSvL9UWiqTamKLQEQybvOeOmhwkzb-dKp-Atm1d7dO7yS-fzUGQ==
date: Mon, 07 Oct 2024 11:10:40 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:59:45 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.colossusssp.com/1a1c07e870d45c05896c3f9e9973d4b4.gif?puid=acd8b52023174a60a422f5ac2c1f9dcf&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D34%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf...
https://cks.connatix.com/cks?pid=34&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Colossus&api-tier=2&uid=c97c5f66-0c0c-4062-b3ea-464fe488b046

146 B
235 B

153ms
132ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=34&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Colossus&api-tier=2&uid=c97c5f66-0c0c-4062-b3ea-464fe488b046
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b449177fecf91684b5afd3521b05f0999c465ee1cce1ccdbfb4528c15cbf09c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecb9f9a39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Cache-Control: no-cache, no-store, must-revalidate
Location: https://cks.connatix.com/cks?pid=34&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Colossus&api-tier=2&uid=c97c5f66-0c0c-4062-b3ea-464fe488b046
Pragma: no-cache
Connection: keep-alive
Expires: 0
Date: Mon, 07 Oct 2024 12:57:35 GMT
Server: nginx

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D18%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DLoopMe%26api-tier%3D2%26uid%3D%7Bdevice_id%7D%26pubid%3D11186&gdpr=0
https://cks.connatix.com/cks?pid=18&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=LoopMe&api-tier=2&uid=50e3848a-0ff1-4540-9414-e4595cbaaac4&pubid=11186&gdpr=0

146 B
236 B

57ms
48ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=18&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=LoopMe&api-tier=2&uid=50e3848a-0ff1-4540-9414-e4595cbaaac4&pubid=11186&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: deb102fb83f46b640d193549caa72e857ace5b01459d9f1661d2ea05461c7e1e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecc88d539f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=18&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=LoopMe&api-tier=2&uid=50e3848a-0ff1-4540-9414-e4595cbaaac4&pubid=11186&gdpr=0
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
server: _

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://connatix-supply-partners.tremorhub.com/sync?UISCX=acd8b52023174a60a422f5ac2c1f9dcf&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D5%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DTel...
https://cks.connatix.com/cks?pid=5&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Telaria&api-tier=2&uid=a4be4135461a4c549e7b42280fabdeef

141 B
231 B

156ms
133ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=5&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Telaria&api-tier=2&uid=a4be4135461a4c549e7b42280fabdeef
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0909a7c608a058b79a91d96f7b90840a27994bcab7756f0524c38d73362efa93

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecb9f9939f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=5&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Telaria&api-tier=2&uid=a4be4135461a4c549e7b42280fabdeef
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 07 Oct 2024 12:57:35 GMT
server: nginx

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://i.ctnsnet.com/int/cm?exc=24&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D28%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DCrimtan%26api-tier%3D2%26uid%3D%5Buser_id%5D&gdpr=0
https://cks.connatix.com/cks?pid=28&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Crimtan&api-tier=2&uid=c22ed97006454c2e90a98bdd37b403e9

142 B
232 B

140ms
130ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=28&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Crimtan&api-tier=2&uid=c22ed97006454c2e90a98bdd37b403e9
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eba00392b73f911d973771b568a948f4f9105928872ea777948755e851834278

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecb9f9b39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cks.connatix.com/cks?pid=28&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Crimtan&api-tier=2&uid=c22ed97006454c2e90a98bdd37b403e9
pragma: no-cache
via: 1.1 google
expires: Fri, 01 Jan 1990 00:00:00 GMT
status: 302
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CUR OUR NOR"
content-length: 0
x-xss-protection: 1; mode=block
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: text/html;charset=UTF-8

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D1%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DSundaySky%26api-tier%3D2%26uid%3D%24%7Bssky_uuid%7D&gdpr=0
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D1%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DSundaySky%26api-tier%3D2%26uid%3D%24%7Bssky_uuid%7D&gdpr...
https://cks.connatix.com/cks?pid=1&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=SundaySky&api-tier=2&uid=d6.ab7c4bd374964821a27451911a879927

144 B
252 B

37ms
32ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=1&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=SundaySky&api-tier=2&uid=d6.ab7c4bd374964821a27451911a879927
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a98593bbd2202fa8f8003ff1bcf898dc08918ccd34d5140075c976ac0f19617

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecce95839f3-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

x-content-type-options: nosniff
location: https://cks.connatix.com/cks?pid=1&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=SundaySky&api-tier=2&uid=d6.ab7c4bd374964821a27451911a879927
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
x-frame-options: DENY

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1&gdpr=0
https://cks.connatix.com/cks?pid=19&uid=07cf6090-9015-435a-8659-b85bf04dddd0&ttl=1730897854

146 B
235 B

92ms
53ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=19&uid=07cf6090-9015-435a-8659-b85bf04dddd0&ttl=1730897854
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f21029506b4309de36696dd477d8b461921b03bf69de1e43a80a6dc8d40253f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0eca4e8739f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=19&uid=07cf6090-9015-435a-8659-b85bf04dddd0&ttl=1730897854
content-length: 213
date: Mon, 07 Oct 2024 12:57:34 GMT
server: Kestrel

GET
H2 200 sync-iframe
cs-server-s2s.yellowblue.io/ Frame CA3D 0
0 188ms
33ms Document
text/html 18.209.76.112
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr={gdpr}&gdpr_consent={gdpr_consent}&redirect=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d24%26ev%3dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3dIronSource%26api-tier%3d2%26uid%3d{partnerId}%26direct%3D1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/788.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.209.76.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-209-76-112.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: cs-server-s2s.yellowblue.io
content-type: text/html
date: Mon, 07 Oct 2024 12:57:35 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D43%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DSonobi%26api-tier%3D2%26uid%3D%5BUID%5D&gdpr=0
https://cks.connatix.com/cks?pid=43&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Sonobi&api-tier=2&uid=793b976b-1638-43c7-a6cc-4b54e1f207b4

146 B
235 B

57ms
49ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=43&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Sonobi&api-tier=2&uid=793b976b-1638-43c7-a6cc-4b54e1f207b4
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48b63d0fe68d366674b9bdde31bc7455c2fb4ee11ce0246e42d865da540130f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecc88db39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://cks.connatix.com/cks?pid=43&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Sonobi&api-tier=2&uid=793b976b-1638-43c7-a6cc-4b54e1f207b4
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Mon, 07 Oct 2024 12:57:35 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-18
x-xss-protection: 0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=561340&daaqp=1&ev=1&rurl=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D13%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DPulsePoint%26api-tier%3D2%26uid%3D%...
https://cks.connatix.com/cks?pid=13&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=PulsePoint&api-tier=2&uid=eZBfwQyBp4iL

122 B
222 B

35ms
35ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=13&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=PulsePoint&api-tier=2&uid=eZBfwQyBp4iL
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2684c7ce4aa7e586268bddef799192b694a7f5a7de962ec1494da5133815a8f9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecd69d839f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cks.connatix.com/cks?pid=13&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=PulsePoint&api-tier=2&uid=eZBfwQyBp4iL
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-69fb9654cf-wjfvz
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
server: Jetty(10.0.14)

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=WIMKYDH0&gdpr=0&gdpr_consent=null&redirectUri=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d45%26ev%3dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3...
https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=249b6685-c983-4710-915c-220996591472&gdpr=0&gdpr_consent=null

146 B
235 B

32ms
32ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=249b6685-c983-4710-915c-220996591472&gdpr=0&gdpr_consent=null
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 268650bc5e589483ac0139e315d76d1c3e40b4a1e6250cbc87245af032db9211

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecd399d39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cks.connatix.com/cks?pid=45&pname=Sharethrough&api-tier=1&uid=249b6685-c983-4710-915c-220996591472&gdpr=0&gdpr_consent=null
content-length: 0

GET
H2

200

usync.html
eus.rubiconproject.com/ Frame DD68
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east&gdpr=0
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0

0
0

146ms
23ms

Document
text/html

23.217.173.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/788.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.217.173.107 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-217-173-107.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html; charset=UTF-8
date: Mon, 07 Oct 2024 12:57:35 GMT
etag: "28052a-10d-6142d69a886c0"
last-modified: Thu, 21 Mar 2024 15:32:19 GMT
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
location: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east&gdpr=0
server: AkamaiGHost

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=connatix&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D44%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DNexxen%26api-tier%3D2%26uid%3D%5BRX_UUID%5D...
https://cks.connatix.com/cks?pid=44&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Nexxen&api-tier=2&uid=OPTOUT

116 B
213 B

37ms
32ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=44&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Nexxen&api-tier=2&uid=OPTOUT
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e87520999fa41b89eb9ee1be2d61297d4ae85402366ee6313032d3bbc473ab9c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecce95739f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://cks.connatix.com/cks?pid=44&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Nexxen&api-tier=2&uid=OPTOUT
date: Mon, 07 Oct 2024 12:57:35 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://x.bidswitch.net/sync?ssp=connatix&user_id=acd8b52023174a60a422f5ac2c1f9dcf&gdpr=0
https://x.bidswitch.net/ul_cb/sync?ssp=connatix&user_id=acd8b52023174a60a422f5ac2c1f9dcf&gdpr=0
https://p.rfihub.com/cm?in=1&pub=20513&ssp=connatix&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=119&user_id=978477430534166825&expires=30&ssp=connatix
https://cks.connatix.com/cks?pid=47&ev={cnxId}&pname=BidSwitch&api-tier=1&uid=255fd573-1d9a-481e-a82b-9887aa1d4bfa&gdpr=&gdpr_consent=&us_privacy=

146 B
235 B

132ms
131ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=47&ev={cnxId}&pname=BidSwitch&api-tier=1&uid=255fd573-1d9a-481e-a82b-9887aa1d4bfa&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08c26530e4cca48260bb760a78bf79aecd755d175d8e6e1c7d492cfe8cf18bea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecf3b7339f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //cks.connatix.com/cks?pid=47&ev={cnxId}&pname=BidSwitch&api-tier=1&uid=255fd573-1d9a-481e-a82b-9887aa1d4bfa&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 12:57:35 GMT

GET

/
de.tynt.com/deb/ Frame D6BF
Redirect Chain

https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D37%26UserId%3Dacd8b52023174a60a422f5ac2c1f9dcf%26DemandPartnerN...
https://de.tynt.com/deb/?m=xch&rt=html&id=0015a00002y7TWTAA2&ru=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D37%26UserId%3Dacd8b52023174a60a422f5ac2c1f9dcf%26DemandPartnerName%3D_3...

0
0

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DTripleLift%26api-tier%3D2%26uid%3D%24UID&gdpr=0
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D25%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DTripleLift%26api-tier%3D2%26uid%...
https://cks.connatix.com/cks?pid=25&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=TripleLift&api-tier=2&uid=2550565118110846920571

132 B
224 B

34ms
34ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=25&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=TripleLift&api-tier=2&uid=2550565118110846920571
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d07296821808e7ce47c53b4e66dc2a845bcc72ae15d8224d82f6cc9e28cb548

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecdba1239f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cks.connatix.com/cks?pid=25&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=TripleLift&api-tier=2&uid=2550565118110846920571
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Mon, 07 Oct 2024 12:57:35 GMT

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ad.turn.com/r/cs?pid=67&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D21%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DAmobee%26api-tier%3D2%26uid%3D%23USER_ID%23&gdpr=0
https://cks.connatix.com/cks?pid=21&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Amobee&api-tier=2&uid=2745866975630558306

129 B
222 B

35ms
34ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=21&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Amobee&api-tier=2&uid=2745866975630558306
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcafe96454f8e6388e3724b20a71e3de6d5aaeb1f7709f44d073b22d3ff594db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecd69db39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://cks.connatix.com/cks?pid=21&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Amobee&api-tier=2&uid=2745866975630558306
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Mon, 07 Oct 2024 12:57:30 GMT

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 5372 0
0 238ms
109ms Document
text/html 23.41.168.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156592&predirect=https%3A%2F%2Fcapi.connatix.com%2Fcore%2Fus%3FDemandPartner%3D2%26UserId%3Dacd8b52023174a60a422f5ac2c1f9dcf%26DemandPartnerName%3DPubmatic%26tier%3D2%26DemandPartnerUserId%3D&gdpr=0
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/788.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-202.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=35757
content-encoding: gzip
content-length: 5633
content-type: text/html
date: Mon, 07 Oct 2024 12:57:35 GMT
expires: Mon, 07 Oct 2024 22:53:32 GMT
last-modified: Mon, 26 Aug 2024 15:25:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DBeeswax%26api-tier%3D2%26uid%3D%7Buserid%7D&g...
https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DBeeswax%26api-tier%3D2%26uid%3D%7Buserid%7D&g...
https://cks.connatix.com/cks?pid=15&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Beeswax&api-tier=2&uid=AABiMk7OB7UAABhCMGL_GA&gdpr=0

132 B
227 B

40ms
39ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=15&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Beeswax&api-tier=2&uid=AABiMk7OB7UAABhCMGL_GA&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbfe0b92fb7a43a9a778c1623e8e4dad8d99c024c22be9673f3a76ef2fe61e87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ece2abd39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://cks.connatix.com/cks?pid=15&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Beeswax&api-tier=2&uid=AABiMk7OB7UAABhCMGL_GA&gdpr=0
Content-Length: 0
Date: Mon, 07 Oct 2024 12:57:35 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D6%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DAppNexus%26api-tier%3D2%26uid%3D%24UID=&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fcks.connatix.com%252Fcks%253Fpid%253D6%2526ev%253Dacd8b52023174a60a422f5ac2c1f9dcf%2526pname%253DAppNexus%2526api-tier%253D2%2526uid%...
https://cks.connatix.com/cks?pid=6&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=AppNexus&api-tier=2&uid=8136617992481294204=&gdpr=0

129 B
223 B

40ms
40ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=6&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=AppNexus&api-tier=2&uid=8136617992481294204=&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a5c67ba45569fd9f0eaf416b6806ecfb03846e2d503cefbf8e4c4a9cba9f42d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecdea4539f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://cks.connatix.com/cks?pid=6&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=AppNexus&api-tier=2&uid=8136617992481294204=&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 167.114.209.103; 167.114.209.103; 672.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 77fbe750-fc51-4e85-a5d2-3744ab9ce853
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 07 Oct 2024 12:57:35 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=g&gdpr={gdpr}&gdpr_consent={gdpr_consent}&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d48%26ev%3dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3dSmaato%26api-ti...
https://cks.connatix.com/cks?pid=48&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Smaato&api-tier=2&uid=ecab075dc6

120 B
215 B

31ms
31ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=48&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Smaato&api-tier=2&uid=ecab075dc6
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d13c65cb0ad3094d36f40df062b73668fbad1e17e3ed592b035bf8a8086508fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecdba1439f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cks.connatix.com/cks?pid=48&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Smaato&api-tier=2&uid=ecab075dc6
via: 1.1 e43394d21905c9e6ce0980d7e55974f4.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: k9kNJKCEJk9HWyJMPqQpDH1bjwPDqL1tPTyVPvLnb82tJ5F51MlVBg==
date: Mon, 07 Oct 2024 12:57:35 GMT
x-amz-cf-pop: JFK52-P7
server: CloudFront

GET
H2 200 cookie Show response
c1.adform.net/ 35 B
521 B 103ms
22ms Script
image/gif 185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/cookie?redirect_url=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D46%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DAdForm%26api-tier%3D2%26uid%3D%24UID&gdpr=0

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/788.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7fff1569ea68ef52782ba25b0cf3934627f7a4fc1e8e22f4652de959c5f97978

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.resetdigital.co/csync?pid=connatix&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D35%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DResetDigital%26api-tier%3D2%26uid%3D%24USER_I...
https://cks.connatix.com/cks?pid=35&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=ResetDigital&api-tier=2&uid=0000015E5866EE0D

126 B
220 B

40ms
39ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=35&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=ResetDigital&api-tier=2&uid=0000015E5866EE0D
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53e62ce131ab2a8296e18427383c9c4bae82940a7a3cee412dd232af104331b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecdda2c39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
location: https://cks.connatix.com/cks?pid=35&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=ResetDigital&api-tier=2&uid=0000015E5866EE0D
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/html

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ads.yieldmo.com/pbsync?is=smartnews&redirectUri=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D39%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DYieldMo%26api-tier%3D2%26uid%3D%24UID&gdpr=0
https://cks.connatix.com/cks?pid=39&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=YieldMo&api-tier=2&uid=Vea3tmm2z3mcb3G8Aj9N&gdpr=0

130 B
223 B

46ms
42ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=39&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=YieldMo&api-tier=2&uid=Vea3tmm2z3mcb3G8Aj9N&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 260f6910ce5e2c5a89a7113a96d2501ebc5b4a1dc6ad6aed79dc9acf984f2f44

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ece2ab739f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://cks.connatix.com/cks?pid=39&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=YieldMo&api-tier=2&uid=Vea3tmm2z3mcb3G8Aj9N&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 218ms
29ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Mon, 07 Oct 2024 12:57:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 227955
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DIndex%26api-tier%3D2%26uid%3D&gdpr=0
https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DIndex%26api-tier%3D2%26uid%3D&gdpr=0&s=190549&C=1
https://cks.connatix.com/cks?pid=17&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Index&api-tier=2&uid=ZwPav9HM6b4AAH5TAHEQsgAA%263618

139 B
235 B

37ms
33ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=17&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Index&api-tier=2&uid=ZwPav9HM6b4AAH5TAHEQsgAA%263618
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b19b581e8a1124b23085897628e4795314f7725bc2cd02275ea6f03d02d0b64e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ecefb5439f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: https://cks.connatix.com/cks?pid=17&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Index&api-tier=2&uid=ZwPav9HM6b4AAH5TAHEQsgAA%263618
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BRJRVHaXT6roIEX4JS3eikuKsgnnlAIx7UqgGj3TCnstSBDEhyhwu%2B9j6gcb2%2BRs4BG%2BAujAP%2FFnJYzP%2B5abMUSfibc8auSmyKpXDV1ov0SQ0V6Gv9FY7BLf4S4m5CdbAWlo4YVh"}],"group":"cf-nel","max_age":604800}
cf-ray: 8cee0eceacf6aab3-YYZ
expires: 0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Mon, 07 Oct 2024 12:57:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

us Show response
capi.connatix.com/core/
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3672&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=b9675a345f8c41e5a5fc1bfaaeb6f56&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0

0
234 B

62ms
57ms

Script
application/json

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=b9675a345f8c41e5a5fc1bfaaeb6f56&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
cf-ray: 8cee0ece8eebac78-YYZ
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache
Location: https://capi.connatix.com/core/us?DemandPartner=33&DemandPartnerName=FreeWheel&DemandPartnerUserId=b9675a345f8c41e5a5fc1bfaaeb6f56&_fw_gdpr=0&_fw_gdpr_consent=null&gdpr=0
Pragma: no-cache
x-sticky-vk: 1728305855727045-13
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Mon, 07 Oct 2024 12:57:35 GMT
Server: nginx

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=connatix&cspid=25&append=0&cb=%24%7BADELPHIC_CACHE_BUSTER%7D&redirect=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D29%26ev%3Dacd8b52023174...
https://cks.connatix.com/cks?pid=29&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Adelphic&api-tier=2&uid=993b3d2e-c2c3-4b08-a8af-ed9f629559d4

146 B
234 B

36ms
33ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=29&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Adelphic&api-tier=2&uid=993b3d2e-c2c3-4b08-a8af-ed9f629559d4
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da275deaeeccd365053a49c8c9dab9f635baecb79e29e7b80881d2cae4fe7c0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ececb2e39f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

X-CI-RTID: 5ccba340-78ee-4be4-892c-02c9b32024d4
Location: https://cks.connatix.com/cks?pid=29&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Adelphic&api-tier=2&uid=993b3d2e-c2c3-4b08-a8af-ed9f629559d4
Content-Length: 177
Date: Mon, 07 Oct 2024 12:57:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

cks Show response
cks.connatix.com/
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=105&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DCentro%26api-tier%3D2%26uid%3D%7BuserId...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=105&redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3Dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3DCentro%26api-tier%3D2%26uid%3...
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=a93df486-d239-4740-aa62-793ede4cfcb2-6703dabf-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=a93df486-d239-4740-aa62-793ede4cfcb2-6703dabf-5553&partner_url=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3Dacd8b52...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2499&partner_device_id=a93df486-d239-4740-aa62-793ede4cfcb2-6703dabf-5553&partner_url=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D9%26ev%3Da...
https://cks.connatix.com/cks?pid=9&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Centro&api-tier=2&uid=a93df486-d239-4740-aa62-793ede4cfcb2-6703dabf-5553&gdpr=0

159 B
243 B

44ms
38ms

Script
application/javascript

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cks.connatix.com/cks?pid=9&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Centro&api-tier=2&uid=a93df486-d239-4740-aa62-793ede4cfcb2-6703dabf-5553&gdpr=0
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f733f3c4c656d3eab761b196ab49e14052ce02428a8a7b492ff594464eb1d74f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET
cf-ray: 8cee0ed0ddf739f3-YYZ
access-control-allow-origin: *
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://cks.connatix.com/cks?pid=9&ev=acd8b52023174a60a422f5ac2c1f9dcf&pname=Centro&api-tier=2&uid=a93df486-d239-4740-aa62-793ede4cfcb2-6703dabf-5553&gdpr=0
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Mon, 07 Oct 2024 12:57:36 GMT
server: Jetty(11.0.13)

GET
H3

200

pixel Show response
capi.connatix.com/us/
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=6&nwid=3630&gdpr=0&gdpr_consent=null&url=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d40%26ev%3dacd8b52023174a60a422f5ac2c1f9dcf%26pname%3dSmartA...
https://capi.connatix.com/us/pixel?puid=2088784279067961703&pId=40&gdpr=0&gdpr_consent=

82 B
399 B

132ms
131ms

Script
image/gif

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/us/pixel?puid=2088784279067961703&pId=40&gdpr=0&gdpr_consent=
Requested by: Host: blank
URL: about:blank
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7f28e33d6a65a4269a7f4e327a177ead60fea39cb13129a35c4b24fef84f5af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

surrogate-control: no-cache, no-store, must-revalidate, max-age=0
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8cee0ecf3f80ac78-YYZ
content-length: 100
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

cache-control: no-cache,no-store
location: https://capi.connatix.com/us/pixel?puid=2088784279067961703&pId=40&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Mon, 07 Oct 2024 12:57:34 GMT
pragma: no-cache

GET 712202.gif
id.rlcdn.com/ Frame C4AF 0
0

GET
H3

200

report
capi.connatix.com/us/google/ Frame C4AF
Redirect Chain

https://capi.connatix.com/us/google/pixel?tier=2&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=connatix&google_hm=YWNkOGI1MjAyMzE3NGE2MGE0MjJmNWFjMmMxZjlkY2Y&extra1=acd8b52023174a60a422f5ac2c1f9dcf&gdpr=0&google_redir=https%3a%2f%2fcapi.connatix....
https://capi.connatix.com/us/google/report?extra1=acd8b52023174a60a422f5ac2c1f9dcf&gdpr=0

82 B
82 B

72ms
68ms

Image
image/gif

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/google/report?extra1=acd8b52023174a60a422f5ac2c1f9dcf&gdpr=0
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

surrogate-control: no-cache, no-store, must-revalidate, max-age=0
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8cee0ecb3bb2ac78-YYZ
content-length: 95
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

cache-control: no-cache, must-revalidate
location: https://capi.connatix.com/us/google/report?extra1=acd8b52023174a60a422f5ac2c1f9dcf&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 290
date: Mon, 07 Oct 2024 12:57:35 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET cm
us-u.openx.net/w/1.0/ Frame C4AF 0
0

GET cksync
cs.media.net/ Frame C4AF 0
0

GET
H2 200 474 Show response
a.ad.gt/api/v1/u/matches/ 13 KB
4 KB 98ms
29ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/474?_it=freestar
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&ref=&_it=freestar&partner_id=474&ha=_hadron
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24aa7c32a00dcf72d20d6e475d91864ae8907e22f51a5e784f438c2ecb3f0440

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 62
cross-origin-resource-policy: cross-origin
cf-ray: 8cee0ece9fb8a2b1-YUL
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
last-modified: Mon, 07 Oct 2024 12:55:05 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 96ms
26ms Script
application/javascript 23.203.179.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.179.38 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-179-38.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Mon, 07 Oct 2024 13:12:35 GMT
accept-ranges: bytes
content-length: 17407
date: Mon, 07 Oct 2024 12:57:35 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 33ms
29ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 23804
via: 1.1 41c6f8f93eca2f7c81a04a82e2d6ae92.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: UgQ-Ti2TXRJUh-39hceSPOm5gvyFhBs7CDPEMCULSXs45CToj4OIZg==
date: Mon, 07 Oct 2024 06:20:52 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 16 KB
6 KB 102ms
34ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 712369aef7db8ee613780ed94892762890345add2113c7749b2f03b819c0a4fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"66ce363e-403e"
age: 490455
cf-ray: 8cee0eceee46ab3b-YYZ
expires: Thu, 10 Oct 2024 12:57:35 GMT
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/javascript
last-modified: Tue, 27 Aug 2024 20:25:34 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 98 KB
29 KB 87ms
29ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/hackers-stole-data-from-us-defense-org-using-impacket-covalentstealer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a7c35a58c1ad79d4fc96dad3bf9ef24b49d9d439ad3fb9b454cdcfe7c445724

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-amz-id-2: ltO7tyQZqiXvgYy6YbJZ1TMywRUqT8eNAFjNCYfp7KyLfJ1lqduKkag/+kqKJbgYOFSR+PhtyFVI2CWwL2gH1zExfpZYJZN2
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"f24286e1b73c01841e789906d50ce23f"
age: 3350
x-amz-request-id: YE0HKZHGD69BQJ69
cf-ray: 8cee0ecede68a28c-YUL
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/javascript;charset=utf-8
last-modified: Wed, 02 Oct 2024 12:26:13 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1728305855202&did=did-0047&se=e30&duid=83077f409aa5--01j9kgwy543pv0ybxzz1y25dqk&tv=8.49.83&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-...
https://rp4.liadm.com/j?dtstmp=1728305855202&did=did-0047&se=e30&duid=83077f409aa5--01j9kgwy543pv0ybxzz1y25dqk&tv=8.49.83&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole...

13 B
347 B

161ms
31ms

Fetch
application/json

3.210.137.246
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1728305855202&did=did-0047&se=e30&duid=83077f409aa5--01j9kgwy543pv0ybxzz1y25dqk&tv=8.49.83&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&wpn=prebid&cd=.bleepingcomputer.com&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjEy
Requested by: Host: blank
URL: about:blank
Protocol: H2
Server: 3.210.137.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-137-246.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

x-pixel-event-id: 228809b6-efad-4b3d-a2e1-1c1e63a2a0d8
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json

Redirect headers

access-control-allow-origin: https://www.bleepingcomputer.com
location: https://rp4.liadm.com/j?dtstmp=1728305855202&did=did-0047&se=e30&duid=83077f409aa5--01j9kgwy543pv0ybxzz1y25dqk&tv=8.49.83&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&wpn=prebid&cd=.bleepingcomputer.com&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjEy
content-length: 0
access-control-expose-headers: *
date: Mon, 07 Oct 2024 12:57:35 GMT
access-control-allow-credentials: true
access-control-allow-methods: GET

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 309 B
585 B 332ms
282ms XHR
text/javascript 18.173.140.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&pid=ZWyTIhyxOKQN8&cb=2&ws=1600x1200&v=24.827.1552&t=923&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_728x90_300x250__320x100_320x50_dynamic1_slot%22%2C%22s%22%3A%5B%22468x60%22%2C%22728x90%22%2C%22300x250%22%2C%22336x280%22%2C%22554x312%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_728x90_300x250__320x100_320x50_dynamic%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&schain=1.0%2C1%21freestar.com%2C412%2C1%2C%2C%2C&sm=be584c11-3f46-49e3-97c4-ca1eb9a0f57e&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&vm=%7B%22ids%22%3A%7B%22audigent%22%3A%22%257B%2522id%2522%253A%257B%2522hadronId%2522%253A%25220001yum0eabkba98bciae6gibddj96ldclf786khdaabackkc2jl%2522%257D%257D%22%7D%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.140.223 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-140-223.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 2a3450197c4f62187d8443c6913f6d9a8180c3ccbc572f657072b3a63a7c99e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 82713ebbf03d41ed38c813ce60a18fea.cloudfront.net (CloudFront)
access-control-allow-origin: https://www.bleepingcomputer.com
x-cache: Miss from cloudfront
content-length: 247
x-amz-cf-id: 9nMEUoSVX6BkHHjEs5uIWN9IYw3ZlTzRPhc0hO4rsWzne6du0pT_3g==
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/javascript;charset=UTF-8
x-amz-cf-pop: JFK52-P2
server: Server

GET
H2 200 rules-p-UeXruRVtZz7w6.js Show response
rules.quantcount.com/ 2 KB
1 KB 90ms
25ms Script
application/javascript 2600:9000:21dd:b200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-UeXruRVtZz7w6.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:b200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: gzip
etag: W/"cbc97d16c77ea1fcbbf42d246001e982"
age: 1484
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: btgtrQudqFGmJhlc3o1IfEZJW0lfEBu8tsCklQayoEXgORNDzc2zZQ==
date: Mon, 07 Oct 2024 12:32:51 GMT
content-type: application/javascript
last-modified: Thu, 07 Dec 2017 17:06:25 GMT
vary: Accept-Encoding
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
via: 1.1 08e4533f506df09f2c978ceaed6e2310.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: EWR53-C2
server: AmazonS3

GET
H3 200 player.lit.ui.js Show response
cds.connatix.com/p/534407/ 173 KB
36 KB 129ms
40ms Script
text/javascript 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/534407/player.lit.ui.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/534407/connatix.player.js?cid=1ffdf4d6-eb53-11e9-b4d2-06948452ae1a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84b0887d14adb68212d43334db9af8b90294423041327a97f67600f389d6fb8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 86400
content-encoding: br
cf-cache-status: HIT
etag: "86c06e1032ff525624b288fbea92c47e"
x-amz-version-id: oLw2m3PCuzVE2DdqxJ6Yi28CUzoxRwWL
access-control-allow-methods: *
expires: Tue, 07 Oct 2025 12:57:35 GMT
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/javascript
last-modified: Fri, 04 Oct 2024 11:15:04 GMT
x-amz-expiration: expiry-date="Wed, 23 Apr 2025 00:00:00 GMT", rule-id="Auto delete after 6 months"
access-control-allow-headers: range
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
cf-ray: 8cee0ecc489739f3-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36733
server: cloudflare

GET ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame C4AF 0
0

GET 81549
i.liadm.com/s/ Frame C4AF 0
0

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 173ms
53ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country?o=5714937848528896
Requested by: Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 63c8a71e02dad8f567226247d5694840937f61e94ddb0c49288e8e68873c6097

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json
vary: Origin

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 123ms
54ms XHR
text/plain 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=nBoE1u9ZxG&w=5733492711227392&o=5714937848528896&cv=2.1.59-1-g78ed83d&widget=false&checksum=10f2b6aa&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-stole-data-from-us-defense-org-using-impacket-covalentstealer%2F&sid=HMJ1mNMDA&pm=true&upapi=true
Requested by: Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 12:57:35 GMT
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
296 B 368ms
114ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

429c09ef872b45d80fa51a8ed156e581ed31fd094c179e4d6dd1d3f1bf18f20b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
295 B 485ms
99ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

429c09ef872b45d80fa51a8ed156e581ed31fd094c179e4d6dd1d3f1bf18f20b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://www.bleepingcomputer.com
date: Mon, 07 Oct 2024 12:57:34 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
620 B 165ms
40ms XHR
application/json 44.205.225.72
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17331/sync.min.js?gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.205.225.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-205-225-72.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 273bd14f0dde616060bca0149a5f7d52cac5fdd79210645920e7ea8124d14c5a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json;charset=utf-8
x-server: 10.40.2.118
server: Jetty(9.4.38.v20210224)

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 438 B
192 B 82ms
81ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c68b1283713128c5f53e0a49046e05c2ff4fba785a6f5f14174d3f1421e7151a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 163
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
266 B 227ms
227ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1659096474971687&correlator=1138082172308285&eid=31083339%2C31083341%2C31085738%2C31087357%2C31087719&output=ldjh&gdfp_req=1&vrg=202410010101&ptt=17&impl=fifs&iu_parts=15184186%3A1006593%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_300x250_300x600_160x600_Right_3%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=320x50%7C728x90%7C554x312%2C300x250%7C120x600%7C160x600%7C300x600%2C300x250%7C120x600%7C160x600%7C300x600%2C300x250%7C120x600%7C160x600%7C300x600%2C320x50%7C728x90%7C970x90%7C970x250%7C554x312&fluid=height%2C0%2C0%2C0%2Cheight&ifi=4&didk=1410863669~1679461619~1679461618~1679461617~2757140747&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1728305855567&lmt=1690998835&adxs=-9%2C-9%2C-9%2C-9%2C-9&adys=-9%2C-9%2C-9%2C-9%2C-9&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=2%7C3%7C4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=about%3Ablank&vis=1&psz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&fws=2%2C2%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0&td=1&egid=40629&tan=f53f0d5a-75fc-44e0-a440-980132e59412%2Cf53f0d5a-75fc-44e0-a440-980132e59413%2Cf53f0d5a-75fc-44e0-a440-980132e59414%2Cf53f0d5a-75fc-44e0-a440-980132e59415%2Cf53f0d5a-75fc-44e0-a440-980132e59416&tdf=2&topics=9&tps=9&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGU5MmQ0ZGQ2LTEyZDMtNGU1Ni04OWI0LWM4MjMyZjRmNGVhZlgBEooBCg5saXZlaW50ZW50LmNvbRJ2Ny1KWENDSk1laSszVlZqMjRqeHNaRWFQRURpZi9KTTBERy84UDlLajhOYXRWaTFmM2xJWUJzbXB2eUdoNm00VEpUZHRiUWs3ek1PNnBCb0ExTUJkcXFwZHBXb3YraElEUWsya2NJL0NTOThOSS9DQ2Y1YWdLSlgBEkYKDGF1ZGlnZW50LmNvbRI0MDAwMXl1bTBlYWJrYmE5OGJjaWFlNmdpYmRkajk2bGRjbGY3ODZraGRhYWJhY2trYzJqbFgB&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1728305852689&idt=1779&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3Dac4219dd-729e-4912-8aa3-d4f8e100789a%26floors_id%3Dd351e2%26floors_hour%3D12%26fs_placementName%3Dbleepingcomputer_728x90_320x50_InContent_1%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D55fb04e7-0a51-4c65-b909-5193cdee455a%26floors_id%3D332193%26floors_hour%3D12%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_1%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D89207ac3-6c62-481a-94ba-8b3ccc2a2814%26floors_id%3D6e6ece%26floors_hour%3D12%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_2%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D7a375b70-f3be-42ba-8a8d-351328b84feb%26floors_id%3D640f6c%26floors_hour%3D12%26fs_placementName%3Dbleepingcomputer_300x250_300x600_160x600_Right_3%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2%7Cfsrefresh%3D0%26fsrebid%3D0%26fs_uuid%3D5947f679-f19e-43dd-aead-e81d72c27721%26floors_id%3D133d59%26floors_hour%3D12%26fs_placementName%3Dbleepingcomputer_728x90_970x90_970x250_320x50_BTF%26fs_ad_product%3Dbanner%26amznbid%3D2%26amznp%3D2&cust_params=fsitf%3DY-YYY-YYYY-YY-YY------------------------%26fs_liveintent%3DY%26fs_session_id%3D2183e39f-0907-4e9a-b204-7b59f77b72c9%26fs_pageview_id%3D15dd35449029dbdff2c7355915cf2c8d%26user-agent%3DChrome%26section%3Dnews%252Csecurity%26floors_user%3D1%26floors_rtt%3D17%26fs_testgroup%3Doptimised&adks=3006093167%2C1994841743%2C1512476352%2C3569010014%2C4003487347&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f778e01d75ad49a8f70d0111df56d58fa011315c38b8275378d6725df47c2fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2,-2,-2,-2,-2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2,-2,-2,-2,-2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 236
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 446 B
196 B 386ms
385ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

eb8b42e6c6f65c6e190e6ad78ed0d4845b3b7b36410a2a76b8b98ad49b4f298f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 166
x-xss-protection: 0
server: cafe

OPTIONS
H2 200 floors
api.floors.dev/sgw/v1/ Frame 0
0 146ms
43ms Preflight 34.160.128.112
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/floors?d=bleepingcomputer.com&t=desktop&k=1&r=1&c=CA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: x-api-key,x-lm
Access-Control-Request-Method: GET
Origin: https://www.bleepingcomputer.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
cache-status: disabled
content-length: 0
date: Mon, 07 Oct 2024 12:57:35 GMT
expires: 0
pragma: no-cache
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H2 200 floors Show response
api.floors.dev/sgw/v1/ 4 KB
4 KB 50ms
47ms Fetch
application/json 34.160.128.112
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/floors?d=bleepingcomputer.com&t=desktop&k=1&r=1&c=CA

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

Resource Hash

5680f26bb4372263a9994c4930d57c56dd37576a18eaba1b81c69fec9db75e9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
x-api-key: 4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
x-lm: 0

Response headers

strict-transport-security: max-age=31536000
access-control-max-age: 3600
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
via: 1.1 google
expires: 0
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 07 Oct 2024 12:57:35 GMT
cache-status: disabled
content-type: application/json
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key, x-lm

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 56ms
47ms Fetch
text/plain 34.160.152.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 5348af936dc014d183cc06f6fe0c112b7ad321a51eb9a4c98dc869f8c8f76f1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H2 200 882.json Show response
id5-sync.com/g/v2/ 632 B
1 KB 196ms
187ms Fetch
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/882.json

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

ea957b85370db0e25f0fdf26e8447b5e89333fc12cc6e634c75a5d26f776286a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Mon, 07 Oct 2024 12:57:35 GMT
content-type: application/json
vary: Origin

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
144 B 564ms
97ms Image
image/gif 34.209.157.212
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001728305856-RRP37L1P-B4O3&halo_id=060ixe7ju6a65dg9iefi9ld8dfc9glgge7huom2wi0e0ykq6umou60k4koi6q0qqm
Requested by: Host: blank
URL: about:blank
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.209.157.212 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-209-157-212.us-west-2.compute.amazonaws.com
Software: nginx/1.27.1 /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache
content-length: 43
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: image/gif
server: nginx/1.27.1

POST
H2 200 882.json Show response
id5-sync.com/g/v2/ 632 B
1 KB 217ms
115ms Fetch
application/json 141.95.33.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/882.json

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-8.49.83.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.120 , Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

f4e18c101b6a6f18639b6fc2abcdce0f612d1984730cb48a1a2d11ab7c880f4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://www.bleepingcomputer.com
p3p: CP="CAO PSA OUR"
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: application/json
vary: Origin

POST
H3 200 c Show response
c.pub.network/v2/ 36 B
53 B 62ms
48ms Fetch
text/plain 34.160.152.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/v2/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.engine.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.152.31 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 31.152.160.34.bc.googleusercontent.com
Software: /
Resource Hash: 5348af936dc014d183cc06f6fe0c112b7ad321a51eb9a4c98dc869f8c8f76f1b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://www.bleepingcomputer.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 438 B
192 B 209ms
166ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7780588c525f8b34d943dcb9a3d1f23c5d690f416770877690031b7815e276b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 163
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 433 B
189 B 300ms
279ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d655c5da8430e4fe1641cd5ebe56e2b183fe19fc67022e8db0b4e1b0f1b8d818

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 159
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 443 B
191 B 257ms
218ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ab5ed4f38db488fbe3d1e9a932d6345441e2780f92eff95de91f81bf0546c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 162
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 443 B
192 B 256ms
217ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21731ecd8a74fcc143d243559597ba3af527e5772de08c404e58f8f348483a25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:36 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 163
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 443 B
191 B 207ms
203ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

964930628cde26be72c913cd9f5f7bcb168c3de054666aa0547c34f4681f1bb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:37 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 162
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 443 B
190 B 203ms
199ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04dfd375b167916170c19764b7d525645aa838f06574eaf86ab79efc3dadb2cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 07 Oct 2024 12:57:37 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com
content-length: 161
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 446 B
196 B 185ms
182ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410010101/pubads_impl.js?cb=31087719

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS