www.americanbanker.com Open in urlscan Pro
18.66.122.124 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQt...
Effective URL:
https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20N...
Submission: On March 17 via api (March 17th 2022, 2:54:54 am UTC) from SG — Scanned from DE

Summary HTTP 240 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 93 IPs in 9 countries across 85 domains to perform 240 HTTP transactions. The main IP is 18.66.122.124, located in United States and belongs to AMAZON-02, US. The main domain is www.americanbanker.com. The Cisco Umbrella rank of the primary domain is 250517.
TLS certificate: Issued by Amazon on February 21st 2022. Valid for: a year.

This is the only time www.americanbanker.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:2c40::c7... 2606:2c40::c73c:67e1	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	18.66.122.124 18.66.122.124	16509 (AMAZON-02) (AMAZON-02)
8	18.66.248.66 18.66.248.66	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:7eaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::282	54113 (FASTLY) (FASTLY)
3	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	52.222.214.67 52.222.214.67	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3030::6815:5476	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.224.195.112 13.224.195.112	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
11	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
18	2606:4700::68... 2606:4700::6811:b6b1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.159.47.124 54.159.47.124	14618 (AMAZON-AES) (AMAZON-AES)
2	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba0a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 4	185.167.164.39 185.167.164.39	198622 (ADFORM) (ADFORM)
1	37.157.5.72 37.157.5.72	198622 (ADFORM) (ADFORM)
2	34.252.195.101 34.252.195.101	16509 (AMAZON-02) (AMAZON-02)
1	52.222.250.115 52.222.250.115	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:200... 2a04:4e42:200::729	54113 (FASTLY) (FASTLY)
1	13.32.99.47 13.32.99.47	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 4	2600:9000:225... 2600:9000:225f:7800:e:ec66:e40:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	18.66.245.59 18.66.245.59	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2a02:26f0:6c0... 2a02:26f0:6c00:2bf::268b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 4	185.33.220.100 185.33.220.100	29990 (ASN-APPNEX) (ASN-APPNEX)
3	35.172.177.82 35.172.177.82	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:400c:c04::9c	15169 (GOOGLE) (GOOGLE)
2 9	2a00:1450:400... 2a00:1450:400e:811::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	52.205.167.202 52.205.167.202	14618 (AMAZON-AES) (AMAZON-AES)
5	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	54.88.65.136 54.88.65.136	14618 (AMAZON-AES) (AMAZON-AES)
1	3.234.21.226 3.234.21.226	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6810:2a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.80.32.197 54.80.32.197	14618 (AMAZON-AES) (AMAZON-AES)
3	184.30.21.51 184.30.21.51	16625 (AKAMAI-AS) (AKAMAI-AS)
2	108.156.253.115 108.156.253.115	16509 (AMAZON-02) (AMAZON-02)
8	52.18.8.201 52.18.8.201	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:225... 2600:9000:2250:1000:8:2b19:8600:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.26.11.16 104.26.11.16	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	147.75.83.64 147.75.83.64	54825 (PACKET) (PACKET)
2	2.18.232.7 2.18.232.7	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
5 6	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	2600:9000:249... 2600:9000:2490:8200:18:6c16:27c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2 16	37.157.4.28 37.157.4.28	198622 (ADFORM) (ADFORM)
1	37.157.3.29 37.157.3.29	198622 (ADFORM) (ADFORM)
2	34.107.203.234 34.107.203.234	15169 (GOOGLE) (GOOGLE)
1 2	54.76.102.147 54.76.102.147	16509 (AMAZON-02) (AMAZON-02)
1	104.111.218.85 104.111.218.85	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	52.58.193.70 52.58.193.70	16509 (AMAZON-02) (AMAZON-02)
1	185.86.137.110 185.86.137.110	201081 (SMARTADSE...) (SMARTADSERVER)
2 2	3.120.46.173 3.120.46.173	16509 (AMAZON-02) (AMAZON-02)
1 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	2.21.142.210 2.21.142.210	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	35.211.178.172 35.211.178.172	19527 (GOOGLE-2) (GOOGLE-2)
1 3	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1 2	2.21.141.232 2.21.141.232	16625 (AKAMAI-AS) (AKAMAI-AS)
4 4	77.243.60.138 77.243.60.138	42697 (NETIC-AS) (NETIC-AS)
2 2	184.30.20.207 184.30.20.207	16625 (AKAMAI-AS) (AKAMAI-AS)
4 4	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
2	18.184.216.10 18.184.216.10	16509 (AMAZON-02) (AMAZON-02)
3 3	54.78.254.47 54.78.254.47	16509 (AMAZON-02) (AMAZON-02)
1	2a02:6ea0:c70... 2a02:6ea0:c700::4	60068 (CDN77 ^_^) (CDN77 ^_^)
2 3	52.208.103.128 52.208.103.128	16509 (AMAZON-02) (AMAZON-02)
2	104.89.42.102 104.89.42.102	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 1	52.215.106.171 52.215.106.171	16509 (AMAZON-02) (AMAZON-02)
1	52.218.108.67 52.218.108.67	16509 (AMAZON-02) (AMAZON-02)
3 3	141.94.170.77 141.94.170.77	16276 (OVH) (OVH)
1 2	2606:4700:10:... 2606:4700:10::ac43:db6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 6	139.162.146.37 139.162.146.37	63949 (LINODE-AP...) (LINODE-AP Linode)
1 1	51.77.65.171 51.77.65.171	16276 (OVH) (OVH)
1 1	80.82.217.93 80.82.217.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 2	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1 1	80.85.85.173 80.85.85.173	63949 (LINODE-AP...) (LINODE-AP Linode)
1	54.171.37.193 54.171.37.193	16509 (AMAZON-02) (AMAZON-02)
1 4	185.33.220.243 185.33.220.243	29990 (ASN-APPNEX) (ASN-APPNEX)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	18.64.115.91 18.64.115.91	16509 (AMAZON-02) (AMAZON-02)
2 2	34.206.192.53 34.206.192.53	14618 (AMAZON-AES) (AMAZON-AES)
2 2	34.248.186.252 34.248.186.252	16509 (AMAZON-02) (AMAZON-02)
1 1	3.68.148.208 3.68.148.208	16509 (AMAZON-02) (AMAZON-02)
2 2	18.159.83.65 18.159.83.65	16509 (AMAZON-02) (AMAZON-02)
1	54.36.109.46 54.36.109.46	16276 (OVH) (OVH)
2 2	35.190.16.14 35.190.16.14	15169 (GOOGLE) (GOOGLE)
1	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	136.243.148.229 136.243.148.229	24940 (HETZNER-AS) (HETZNER-AS)
1	2600:9000:223... 2600:9000:223f:1a00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1	46.19.11.36 46.19.11.36	51790 (SIEL) (SIEL)
1	18.195.155.181 18.195.155.181	16509 (AMAZON-02) (AMAZON-02)
2	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:2156:5c00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
4	2600:9000:215... 2600:9000:2156:3400:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
11	104.244.36.20 104.244.36.20	7415 (ADSAFE-1) (ADSAFE-1)
5	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
240	93

2 2606:2c40::c73c:67e1 (United States) 1 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

info.appdome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-124.fra60.r.cloudfront.net

www.americanbanker.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.66.248.66 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-66.dus51.r.cloudfront.net

arizent.brightspotcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:7eaf (United States)

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-67.fra56.r.cloudfront.net

cdn.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:5476 (United States)

ASN13335 (CLOUDFLARENET, US)

www.npttech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.195.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-195-112.fra2.r.cloudfront.net

cdn.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2606:4700::6811:b6b1 (United States)

ASN13335 (CLOUDFLARENET, US)

experience.tinypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.tinypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
buy.tinypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
id.tinypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.159.47.124 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-47-124.compute-1.amazonaws.com

people.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.98 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba0a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.167.164.39 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

a2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.5.72 (Denmark)

ASN198622 (ADFORM, DK)

s2.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.252.195.101 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-195-101.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.250.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-250-115.fra60.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::729 (United States)

ASN54113 (FASTLY, US)

vjs.zencdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-47.fra60.r.cloudfront.net

s.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:225f:7800:e:ec66:e40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cdn.keywee.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.245.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-245-59.dus51.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:6c00:2bf::268b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.220.100 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.172.177.82 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-177-82.compute-1.amazonaws.com

a.dpmsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:400e:811::2004 (Ireland) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.205.167.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-167-202.compute-1.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.88.65.136 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-88-65-136.compute-1.amazonaws.com

api.zetaglobal.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.234.21.226 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-234-21-226.compute-1.amazonaws.com

events.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:2a41 (United States)

ASN13335 (CLOUDFLARENET, US)

c2.piano.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.80.32.197 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-80-32-197.compute-1.amazonaws.com

pixel.keywee.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.30.21.51 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-21-51.deploy.static.akamaitechnologies.com

a.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.156.253.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-253-115.dus51.r.cloudfront.net

d10lpsik1i8c69.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.18.8.201 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:1000:8:2b19:8600:93a1 (United States)

ASN16509 (AMAZON-02, US)

images.newsletters.arizent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.11.16 (United States)

ASN13335 (CLOUDFLARENET, US)

settings.luckyorange.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 147.75.83.64 (Schiphol, Netherlands)

ASN54825 (PACKET, US)

p1cluster.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
comcluster.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
id.cxense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.232.7 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-7.deploy.static.akamaitechnologies.com

t.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.194 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:8200:18:6c16:27c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

d20519brkbo4nz.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 37.157.4.28 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmp.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.3.29 (Denmark)

ASN198622 (ADFORM, DK)

a1.seadform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.203.234 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 234.203.107.34.bc.googleusercontent.com

settings.luckyorange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.76.102.147 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-102-147.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.218.85 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-218-85.deploy.static.akamaitechnologies.com

ad.yieldlab.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.58.193.70 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-193-70.eu-central-1.compute.amazonaws.com

ih.adscale.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.110 (France)

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.120.46.173 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-46-173.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.142.210 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-142-210.deploy.static.akamaitechnologies.com

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.211.178.172 (North Charleston, United States) 2 redirects

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.248.245.213 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.21.141.232 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-21-141-232.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 77.243.60.138 (Viby, Denmark) 4 redirects

ASN42697 (NETIC-AS, DK)

uipglob.semasio.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.20.207 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-207.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.33.220.150 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.184.216.10 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-216-10.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.78.254.47 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
loada.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6ea0:c700::4 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)

load77.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.208.103.128 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-103-128.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.89.42.102 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-42-102.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.215.106.171 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-106-171.eu-west-1.compute.amazonaws.com

api.adrtx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.108.67 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1.amazonaws.com

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 141.94.170.77 (France) 3 redirects

ASN16276 (OVH, FR)
PTR: pikafka-eu-6.cloudy.ovh

pixel.onaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::ac43:db6 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

spl.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mwzeom.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 139.162.146.37 (Frankfurt am Main, Germany) 5 redirects

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1413-37.members.linode.com

cm.adsafety.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.77.65.171 (Germany) 1 redirects

ASN16276 (OVH, FR)
PTR: tags10.adsafety.net

tags.adsafety.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.82.217.93 (Düsseldorf, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

ads.smartstream.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 85.114.159.93 (Germany) 2 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.85.85.173 (London, United Kingdom) 1 redirects

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li749-173.members.linode.com

cm.smartstream.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.37.193 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-37-193.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.33.220.243 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.64.115.91 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-115-91.txl50.r.cloudfront.net

pdw-adf.userreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.206.192.53 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-192-53.compute-1.amazonaws.com

a.audrte.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.248.186.252 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-186-252.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.68.148.208 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-68-148-208.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.159.83.65 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-83-65.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.36.109.46 (France)

ASN16276 (OVH, FR)
PTR: p01.id5-sync.com

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.16.14 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 14.16.190.35.bc.googleusercontent.com

redirect.frontend.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 136.243.148.229 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.229.148.243.136.clients.your-server.de

sync.1dmp.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223f:1a00:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.19.11.36 (Slovenia)

ASN51790 (SIEL, SI)
PTR: ilog.vsn.si

match.contentexchange.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com

e1.emxdgt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:5c00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2156:3400:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.244.36.20 (United States)

ASN7415 (ADSAFE-1, US)
PTR: nyidt.adsafeprotected.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	adsafeprotected.com cdn.adsafeprotected.com — Cisco Umbrella Rank: 3092 pixel.adsafeprotected.com — Cisco Umbrella Rank: 521 static.adsafeprotected.com — Cisco Umbrella Rank: 500 dt.adsafeprotected.com — Cisco Umbrella Rank: 458	201 KB
22	doubleclick.net 6 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 159 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 stats.g.doubleclick.net — Cisco Umbrella Rank: 68 cm.g.doubleclick.net — Cisco Umbrella Rank: 176	164 KB
21	adform.net 4 redirects a2.adform.net — Cisco Umbrella Rank: 5998 s2.adform.net — Cisco Umbrella Rank: 4901 c1.adform.net — Cisco Umbrella Rank: 524 dmp.adform.net — Cisco Umbrella Rank: 2334	42 KB
18	googlesyndication.com 96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 122 pagead2.googlesyndication.com — Cisco Umbrella Rank: 90	271 KB
18	tinypass.com experience.tinypass.com — Cisco Umbrella Rank: 6242 cdn.tinypass.com — Cisco Umbrella Rank: 4116 buy.tinypass.com — Cisco Umbrella Rank: 3573 id.tinypass.com — Cisco Umbrella Rank: 12140	458 KB
10	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 57	3 KB
8	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 205 secure.adnxs.com — Cisco Umbrella Rank: 359	9 KB
8	brightspotcdn.com arizent.brightspotcdn.com — Cisco Umbrella Rank: 105565	1 MB
7	adsafety.net 6 redirects cm.adsafety.net — Cisco Umbrella Rank: 4447 tags.adsafety.net — Cisco Umbrella Rank: 81397	12 KB
7	cxense.com cdn.cxense.com — Cisco Umbrella Rank: 4226 p1cluster.cxense.com — Cisco Umbrella Rank: 6281 comcluster.cxense.com — Cisco Umbrella Rank: 3989 id.cxense.com — Cisco Umbrella Rank: 7754	52 KB
7	gstatic.com fonts.gstatic.com	160 KB
6	teads.tv a.teads.tv — Cisco Umbrella Rank: 1118 t.teads.tv — Cisco Umbrella Rank: 2303 sync.teads.tv — Cisco Umbrella Rank: 870	134 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
5	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 343	111 KB
5	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	592 B
5	google.de www.google.de — Cisco Umbrella Rank: 6433 adservice.google.de — Cisco Umbrella Rank: 8832	1 KB
5	keywee.co 1 redirects cdn.keywee.co — Cisco Umbrella Rank: 6197 pixel.keywee.co — Cisco Umbrella Rank: 4990	35 KB
4	exelator.com 3 redirects loadm.exelator.com — Cisco Umbrella Rank: 950 load77.exelator.com — Cisco Umbrella Rank: 3015 loada.exelator.com — Cisco Umbrella Rank: 22115	3 KB
4	adsrvr.org 4 redirects match.adsrvr.org — Cisco Umbrella Rank: 293	2 KB
4	semasio.net 4 redirects uipglob.semasio.net — Cisco Umbrella Rank: 1090	3 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 434 www.linkedin.com — Cisco Umbrella Rank: 609 px4.ads.linkedin.com — Cisco Umbrella Rank: 5153	4 KB
4	dpmsrv.com s.dpmsrv.com — Cisco Umbrella Rank: 20600 a.dpmsrv.com — Cisco Umbrella Rank: 17705	41 KB
4	cloudfront.net d1z2jf7jlzjs58.cloudfront.net d10lpsik1i8c69.cloudfront.net d20519brkbo4nz.cloudfront.net	101 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 124	197 KB
4	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 251 fonts.googleapis.com — Cisco Umbrella Rank: 35	33 KB
3	onaudience.com 3 redirects pixel.onaudience.com — Cisco Umbrella Rank: 1868	1 KB
3	crwdcntrl.net 2 redirects sync.crwdcntrl.net — Cisco Umbrella Rank: 628	1 KB
3	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 346	1 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 338	12 KB
3	boomtrain.com cdn.boomtrain.com — Cisco Umbrella Rank: 4552 people.api.boomtrain.com — Cisco Umbrella Rank: 5003 events.api.boomtrain.com — Cisco Umbrella Rank: 14645	26 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 147	99 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 839 pixel.quantserve.com — Cisco Umbrella Rank: 381	10 KB
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 365	909 B
2	1dmp.io 1 redirects sync.1dmp.io — Cisco Umbrella Rank: 9987	805 B
2	weborama.fr 2 redirects redirect.frontend.weborama.fr — Cisco Umbrella Rank: 8470	518 B
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 730	1 KB
2	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 184	2 KB
2	audrte.com 2 redirects a.audrte.com — Cisco Umbrella Rank: 2378	4 KB
2	adition.com 2 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1438	913 B
2	smartstream.tv 2 redirects ads.smartstream.tv — Cisco Umbrella Rank: 35180 cm.smartstream.tv — Cisco Umbrella Rank: 241401	1 KB
2	zeotap.com 1 redirects spl.zeotap.com — Cisco Umbrella Rank: 1469 mwzeom.zeotap.com — Cisco Umbrella Rank: 1307	897 B
2	bluekai.com tags.bluekai.com — Cisco Umbrella Rank: 404	891 B
2	eyeota.net ps.eyeota.net — Cisco Umbrella Rank: 899	688 B
2	mathtag.com 2 redirects pixel.mathtag.com — Cisco Umbrella Rank: 1093	1 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 496	2 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 257	1 KB
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 268	605 B
2	advertising.com 2 redirects pixel.advertising.com — Cisco Umbrella Rank: 307	679 B
2	adscale.de 2 redirects ih.adscale.de — Cisco Umbrella Rank: 4504	693 B
2	360yield.com 1 redirects ad.360yield.com — Cisco Umbrella Rank: 630	828 B
2	luckyorange.com settings.luckyorange.com — Cisco Umbrella Rank: 21131	181 B
2	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 281	66 B
2	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 2441 p1.parsely.com — Cisco Umbrella Rank: 1953	26 KB
2	ml314.com ml314.com — Cisco Umbrella Rank: 1299	13 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 101	17 KB
2	appdome.com 1 redirects info.appdome.com	4 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 792	1 KB
1	emxdgt.com e1.emxdgt.com — Cisco Umbrella Rank: 1076	59 B
1	contentexchange.me match.contentexchange.me — Cisco Umbrella Rank: 16790	49 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 698	241 B
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 488	1009 B
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 393	345 B
1	userreport.com pdw-adf.userreport.com — Cisco Umbrella Rank: 13291	444 B
1	pubmatic.com simage2.pubmatic.com — Cisco Umbrella Rank: 554	545 B
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 375	338 B
1	amazonaws.com s3-eu-west-1.amazonaws.com	390 B
1	adrtx.net 1 redirects api.adrtx.net — Cisco Umbrella Rank: 16679	406 B
1	openx.net eu-u.openx.net — Cisco Umbrella Rank: 1751	274 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 626	713 B
1	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 603	163 B
1	rubiconproject.com token.rubiconproject.com — Cisco Umbrella Rank: 595	214 B
1	yieldlab.net ad.yieldlab.net — Cisco Umbrella Rank: 4271	522 B
1	seadform.net a1.seadform.net — Cisco Umbrella Rank: 15102	344 B
1	luckyorange.net settings.luckyorange.net — Cisco Umbrella Rank: 6766	2 KB
1	arizent.com images.newsletters.arizent.com — Cisco Umbrella Rank: 144523	9 KB
1	piano.io c2.piano.io — Cisco Umbrella Rank: 3563	10 KB
1	zetaglobal.net api.zetaglobal.net — Cisco Umbrella Rank: 5493	939 B
1	zencdn.net vjs.zencdn.net — Cisco Umbrella Rank: 4178	395 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 799	3 KB
1	npttech.com www.npttech.com — Cisco Umbrella Rank: 3944	3 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 54	100 KB
1	polyfill.io polyfill.io — Cisco Umbrella Rank: 1238	580 B
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 821	7 KB
1	americanbanker.com www.americanbanker.com — Cisco Umbrella Rank: 250517	76 KB
0	ib-ibi.com Failed global.ib-ibi.com Failed
240	85

	Domain	Requested by
15	buy.tinypass.com	cdn.tinypass.com buy.tinypass.com
12	c1.adform.net	2 redirects a2.adform.net c1.adform.net
11	dt.adsafeprotected.com	www.americanbanker.com
11	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net info.appdome.com www.americanbanker.com
10	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.americanbanker.com tpc.googlesyndication.com
9	www.google.com	2 redirects www.americanbanker.com securepubads.g.doubleclick.net tpc.googlesyndication.com
8	pixel.adsafeprotected.com	cdn.adsafeprotected.com www.americanbanker.com
8	arizent.brightspotcdn.com	www.americanbanker.com
7	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
7	fonts.gstatic.com	fonts.googleapis.com
6	cm.adsafety.net	5 redirects c1.adform.net
6	cm.g.doubleclick.net	5 redirects c1.adform.net
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.americanbanker.com
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	www.facebook.com	www.americanbanker.com
4	static.adsafeprotected.com	pixel.adsafeprotected.com www.americanbanker.com
4	dmp.adform.net	c1.adform.net
4	secure.adnxs.com	1 redirects c1.adform.net a2.adform.net www.americanbanker.com
4	match.adsrvr.org	4 redirects
4	uipglob.semasio.net	4 redirects
4	www.google.de	www.americanbanker.com
4	ib.adnxs.com	2 redirects a2.adform.net www.americanbanker.com
4	cdn.cxense.com	cdn.tinypass.com cdn.cxense.com
4	cdn.keywee.co	1 redirects www.americanbanker.com cdn.keywee.co
4	a2.adform.net	2 redirects www.americanbanker.com a2.adform.net
4	connect.facebook.net	www.americanbanker.com connect.facebook.net info.appdome.com
3	pixel.onaudience.com	3 redirects
3	sync.crwdcntrl.net	2 redirects c1.adform.net
3	eb2.3lift.com	1 redirects c1.adform.net
3	a.teads.tv	info.appdome.com a.teads.tv
3	a.dpmsrv.com	www.americanbanker.com s.dpmsrv.com
3	googleads.g.doubleclick.net	1 redirects www.googleadservices.com www.americanbanker.com
3	bat.bing.com	info.appdome.com bat.bing.com www.americanbanker.com
3	fonts.googleapis.com	www.americanbanker.com buy.tinypass.com
3	www.googletagservices.com	www.americanbanker.com securepubads.g.doubleclick.net
2	pixel.tapad.com	2 redirects
2	sync.1dmp.io	1 redirects c1.adform.net
2	redirect.frontend.weborama.fr	2 redirects
2	pm.w55c.net	2 redirects
2	dpm.demdex.net	2 redirects
2	a.audrte.com	2 redirects
2	dsp.adfarm1.adition.com	2 redirects
2	tags.bluekai.com	c1.adform.net
2	loadm.exelator.com	2 redirects
2	ps.eyeota.net	c1.adform.net
2	pixel.mathtag.com	2 redirects
2	dsum-sec.casalemedia.com	1 redirects c1.adform.net
2	x.bidswitch.net	2 redirects
2	ups.analytics.yahoo.com	1 redirects c1.adform.net
2	pixel.advertising.com	2 redirects
2	ih.adscale.de	2 redirects
2	ad.360yield.com	1 redirects c1.adform.net
2	settings.luckyorange.com	d20519brkbo4nz.cloudfront.net
2	idsync.rlcdn.com	www.americanbanker.com c1.adform.net
2	t.teads.tv	www.americanbanker.com
2	d10lpsik1i8c69.cloudfront.net	info.appdome.com d10lpsik1i8c69.cloudfront.net
2	stats.g.doubleclick.net	www.google-analytics.com
2	px.ads.linkedin.com	2 redirects
2	ml314.com	info.appdome.com ml314.com
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
2	info.appdome.com	1 redirects
1	pixel.quantserve.com	a2.adform.net
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	a2.adform.net
1	e1.emxdgt.com	c1.adform.net
1	match.contentexchange.me	c1.adform.net
1	s.ad.smaato.net	c1.adform.net
1	sync.teads.tv	c1.adform.net
1	id5-sync.com	c1.adform.net
1	aa.agkn.com	1 redirects
1	pdw-adf.userreport.com	c1.adform.net
1	simage2.pubmatic.com	c1.adform.net
1	beacon.krxd.net	c1.adform.net
1	cm.smartstream.tv	1 redirects
1	ads.smartstream.tv	1 redirects
1	tags.adsafety.net	1 redirects
1	mwzeom.zeotap.com	c1.adform.net
1	spl.zeotap.com	1 redirects
1	loada.exelator.com	1 redirects
1	s3-eu-west-1.amazonaws.com	c1.adform.net
1	api.adrtx.net	1 redirects
1	eu-u.openx.net	c1.adform.net
1	load77.exelator.com	c1.adform.net
1	ads.stickyadstv.com	c1.adform.net
1	rtb-csync.smartadserver.com	c1.adform.net
1	token.rubiconproject.com	c1.adform.net
1	ad.yieldlab.net	c1.adform.net
1	a1.seadform.net	www.americanbanker.com
1	id.cxense.com	cdn.cxense.com
1	d20519brkbo4nz.cloudfront.net	d10lpsik1i8c69.cloudfront.net
1	comcluster.cxense.com	cdn.cxense.com
1	96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	p1cluster.cxense.com	cdn.cxense.com
1	settings.luckyorange.net	d10lpsik1i8c69.cloudfront.net
1	images.newsletters.arizent.com	buy.tinypass.com
1	pixel.keywee.co	www.americanbanker.com
1	c2.piano.io	cdn.tinypass.com
1	events.api.boomtrain.com	cdn.boomtrain.com
1	api.zetaglobal.net	cdn.boomtrain.com
1	p1.parsely.com	www.americanbanker.com
1	id.tinypass.com	cdn.tinypass.com
1	px4.ads.linkedin.com	www.americanbanker.com
1	www.linkedin.com	1 redirects
1	cdn.parsely.com	d1z2jf7jlzjs58.cloudfront.net
1	cdn.tinypass.com	experience.tinypass.com
1	s.dpmsrv.com	info.appdome.com
1	vjs.zencdn.net	info.appdome.com
1	d1z2jf7jlzjs58.cloudfront.net	info.appdome.com
1	s2.adform.net	www.americanbanker.com
1	snap.licdn.com	www.googletagmanager.com
1	people.api.boomtrain.com	cdn.boomtrain.com
1	experience.tinypass.com	www.americanbanker.com
1	cdn.boomtrain.com	www.americanbanker.com
1	www.npttech.com	www.americanbanker.com
1	www.googletagmanager.com	www.americanbanker.com
1	ajax.googleapis.com	www.americanbanker.com
1	cdn.adsafeprotected.com	www.americanbanker.com
1	polyfill.io	www.americanbanker.com
1	unpkg.com	www.americanbanker.com
1	www.americanbanker.com	info.appdome.com
0	global.ib-ibi.com Failed	c1.adform.net
240	123

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.linkedin.com
www.forbes.com
enterprise.verizon.com
documents.trendmicro.com
info.wrightsmedia.com
news.google.com
news.apple.com
www.arizent.com

Subject Issuer	Validity	Valid
info.appdome.com Cloudflare Inc ECC CA-3	`2021-06-20` - `2022-06-19`	a year	crt.sh
*.accountingtechnology.com Amazon	`2022-02-21` - `2023-03-22`	a year	crt.sh
*.sourcemedia.com Amazon	`2022-03-16` - `2023-04-13`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-02` - `2022-07-01`	a year	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-03-08` - `2023-04-09`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.adsafeprotected.com Amazon	`2021-07-21` - `2022-08-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
cdn.boomtrain.com Amazon	`2021-03-16` - `2022-04-14`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-12-24` - `2022-03-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.piano.io Sectigo RSA Domain Validation Secure Server CA	`2021-08-19` - `2022-09-18`	a year	crt.sh
*.api.boomtrain.com Amazon	`2021-11-16` - `2022-12-14`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.ml314.com Amazon	`2021-12-17` - `2023-01-14`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
vjs.zencdn.net GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-11-26` - `2022-12-28`	a year	crt.sh
*.dpmsrv.com Amazon	`2021-05-17` - `2022-06-15`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2022-03-16` - `2022-09-16`	6 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.parsely.com Amazon	`2021-07-05` - `2022-08-03`	a year	crt.sh
*.cxense.com DigiCert SHA2 Secure Server CA	`2021-05-21` - `2022-05-26`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.anyword.com Amazon	`2021-08-04` - `2022-09-02`	a year	crt.sh
app.zetaglobal.net Amazon	`2021-06-14` - `2022-07-13`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
pixel.keywee.co Sectigo ECC Domain Validation Secure Server CA	`2022-02-01` - `2023-03-03`	a year	crt.sh
teads.tv R3	`2022-01-03` - `2022-04-03`	3 months	crt.sh
fw.adsafeprotected.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
view.newsletters.arizent.com GeoTrust RSA CA 2018	`2022-01-06` - `2023-01-06`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.seadform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-11-04`	a year	crt.sh
settings.luckyorange.com R3	`2022-03-05` - `2022-06-03`	3 months	crt.sh
*.yieldlab.net DigiCert SHA2 Secure Server CA	`2022-01-14` - `2023-01-13`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-25` - `2023-01-25`	a year	crt.sh
ads.stickyadstv.com DigiCert SHA2 Secure Server CA	`2021-09-19` - `2022-09-20`	a year	crt.sh
*.eyeota.net R3	`2022-03-08` - `2022-06-06`	3 months	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-26` - `2023-03-01`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2021-08-04` - `2022-09-04`	a year	crt.sh
*.userreport.com Amazon	`2022-01-19` - `2023-02-17`	a year	crt.sh
*.id5-sync.com R3	`2022-03-08` - `2022-06-06`	3 months	crt.sh
s.ad.smaato.net Amazon	`2021-09-21` - `2022-10-20`	a year	crt.sh
*.contentexchange.me Sectigo RSA Domain Validation Secure Server CA	`2021-05-05` - `2022-06-04`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
*.emxdgt.com Go Daddy Secure Certificate Authority - G2	`2021-05-18` - `2022-06-19`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
static.adsafeprotected.com Amazon	`2021-09-05` - `2022-10-04`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh

This page contains 18 frames:

Primary Page: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Frame ID: 9332ED745DE69D89261E787AA45265CA
Requests: 125 HTTP requests in this frame

Frame: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
Frame ID: 17E0EEBAACD6576464E0C884B907B2CC
Requests: 9 HTTP requests in this frame

Frame: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
Frame ID: E6F8774C32345D381285D884106113FC
Requests: 10 HTTP requests in this frame

Frame: https://cdn.cxense.com/sp1.html
Frame ID: 3B6CF2B95B1907C0B59D6469DA9E406B
Requests: 4 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 996B2C8AF67CCE04FBCDDCBA1BE389D3
Requests: 1 HTTP requests in this frame

Frame: https://96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 7996D05D0069FDB657A1EC7725C3740C
Requests: 1 HTTP requests in this frame

Frame: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Frame ID: 18EDD4BC21AEDD72083995F90DC14D40
Requests: 1 HTTP requests in this frame

Frame: https://a2.adform.net/serving/container/?pm=1662401&lid=56730269&ctype=0&media=0&PageName=American_Banker+Universal+Tag&orderid=UNIQUE_ORDER_ID&sysvars=%7corderid%3dUNIQUE_ORDER_ID%7c%7c%7c%40%40%7cpid%3dOFFER_ID%7cpnm%3dProductRatePlanName%7c&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&rnd=1860967004&cpref=&loc=https%3a%2f%2fwww.americanbanker.com%2fpayments%2fopinion%2fnew-bot-malware-leaves-financial-apps-dangerously-e
Frame ID: C6D2D02CCB0323A800633EB39AED741B
Requests: 6 HTTP requests in this frame

Frame: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Frame ID: 940E172873FAEA4DB8C1CF0788200A63
Requests: 46 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstF6BXzDr2g3iWkoNQBQkaXLOBTSvjM-6BHtyVjagrDJcel2sRNgkDSX7fvdn84eiV4npXnDs5EM8OKQ00yR2koFsDoH6DZ4ye5ofHCyjO03HRaPPIpB_U535jVP6M7mdDORQklHKLbytT4UNg7SayMVOP1Uj_5FQfmDhe80zxRBVGuUl5USWsO4vPKcaWUdwtSnB1508saNwsWyQL8L5CJYYUgbfaZQF8rL_YTAK2d9oh_y8KiF74UReHSqYCHVERbTdfNQavfH45loyka5jLMArLt7oRgZ0Tr7N1ykNLV-7N-WmCqM0emOs4QDmu7uZRYYEOBmDiAHpLM4uEU_7SHEcL0Q8Ps&sig=Cg0ArKJSzPkNm57-RgZ7EAE&uach_m=[UACH]&adurl=
Frame ID: 56AE1E596C2F76A4D97FAC4C1D5FB11D
Requests: 8 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=11046&campId=728x90&pubId=4576190830&chanId=22464082146&placementId=5878184535&pubCreative=138383166747&pubOrder=2964105075&cb=1760119229&custom=collapsed_header1&adsafe_par&impId=9b2cde55-a59d-11ec-a029-0231bf2059f1&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email
Frame ID: AB95CEC8442EDAF1A71F170DF57A6C02
Requests: 2 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 76042C2E0485B5809789B9D9F704F28C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012202142035000/amp4ads-v0.mjs
Frame ID: C1311B60C1FD9A930228408282513001
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvZVRk204CUda-yEkE0JHBJ3ljlVD1dR7GZHmG_wTtuuQ5FCXPUzEgut9AhXj-VnGnSHYhka28ZOfpDMUBCrKZv6d5UqJua2xZvNJqArNHnS37ChUPRZFe73T_wAmI-ATPi9SXMBUY_DsYjQrPDrvwhPBmqN_DP7A_OhYA6KisckkjwdwZ1f_lDUNk7c4qW_AhUQ9HcjOCesC86FSRaGBSAABS6V0LOxHeTMq_sEdTrkNnHdPngwEb2hqbkz6WrVTWMhDNe587rD5JV0p8HdC77vb54gGFDEsjD-S8lyBNK2eoAITwhIYDYUojuW4fdh4m_MzHyWg2EE2F5XtGx4RAJn_c&sig=Cg0ArKJSzAQoFAwxbroCEAE&uach_m=[UACH]&adurl=
Frame ID: 7ACD6F94BBB6E020DE45E649C211A2B7
Requests: 8 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=11046&campId=300x250&pubId=19988173&chanId=22464082146&placementId=4790764721&pubCreative=138328581479&pubOrder=2385617724&cb=1427639636&custom=bigbox2&adsafe_par&impId=9b44abdd-a59d-11ec-8155-02caf40e7d43&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email
Frame ID: 11B17D2673BE096EACCBE63B9E82743E
Requests: 2 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 30C69C722135686BD1A73BAFF70C5B70
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 46A69A4E775C56D9143DC97E2192835B
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: ADCD8355056CB9F278B28ED97492D789
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New bot malware leaves financial apps dangerously exposed | PaymentsSource | American BankerAuthor

Page URL History Show full URLs

https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Z... Page URL
https://info.appdome.com/events/public/v1/encoded/track/tc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7... HTTP 307
https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?u... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

240
Requests

86 %
HTTPS

34 %
IPv6

85
Domains

123
Subdomains

93
IPs

9
Countries

3886 kB
Transfer

13090 kB
Size

147
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/amerbanker
Title: twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/AmericanBanker
Title: facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/american-banker/
Title: linkedin

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed&text=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%0D%0A
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed&mini=true&title=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%0D%0A&summary=EventBot%20is%20a%20particularly%20frightening%20development%20since%20it%20hides%20in%20an%20altered%20version%20of%20an%20app%20that%20seems%20legitimate%20and%20steals%20unprotected%20information%20in%20banking%2C%20wallet%2C%20payment%20and%20cryptocurrency%20mobile%20apps%2C%20says%20Appdome%27s%20Tom%20Tovar.%20%0D%0A&source=American%20Banker
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.forbes.com/sites/johnkoetsier/2020/04/15/report-35-85-fintech-growth-on-mobile-thanks-to-coronavirus-after-1-trillion-app-opens-in-2019/#39db1cb7759a
Title: reports a 35%-80% increase

Search URL Search Domain Scan URL

URL: https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf
Title: According to the Verizon Mobile Security Index 2020

Search URL Search Domain Scan URL

URL: https://documents.trendmicro.com/assets/white_papers/wp-PSD2-The-Risks-of-Open-Banking.pdf
Title: Trend Micro found 50 major financial institutions plus scads of fintech startups

Search URL Search Domain Scan URL

URL: https://info.wrightsmedia.com/arizent-licensing-and-reprints
Title: Reprint

Search URL Search Domain Scan URL

URL: https://news.google.com/publications/CAAiEHM5mkGRpz_D4FnrJRAmDuIqFAgKIhBzOZpBkac_w-BZ6yUQJg7i?oc=3&ceid=US:en
Title: googlenews

Search URL Search Domain Scan URL

URL: https://news.apple.com/TJ5D7XbBzSDGlfh0N7DWvTw
Title: applenews

Search URL Search Domain Scan URL

URL: https://www.arizent.com/privacypolicy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.arizent.com/news/arizent-subscription-agreement
Title: Subscription Agreement

Search URL Search Domain Scan URL

URL: https://www.arizent.com/media-kit
Title: Advertising/Marketing Services

Search URL Search Domain Scan URL

URL: https://www.arizent.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1 Page URL
https://info.appdome.com/events/public/v1/encoded/track/tc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1?_ud=1b69deb8-15e1-4d7a-8ab5-e26fe0a1ca98&_ch=p&_pr2=p&_pl=3&_lg=en-US,en&_dr=p&_ts=p HTTP 307
https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://a2.adform.net/serving/scripts/trackpoint/async/ HTTP 301
https://s2.adform.net/banners/scripts/st/trackpoint-async.js

Request Chain 34

https://cdn.keywee.co/dist/analytics.min.js HTTP 301
https://cdn.keywee.co/dist/analytics-1.5.12.min.js

Request Chain 41

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3F_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_content%3D182937943%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D182937943 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D674964%26time%3D1647485686684%26url%3Dhttps%253A%252F%252Fwww.americanbanker.com%252Fpayments%252Fopinion%252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%253F_hsenc%253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%2526utm_campaign%253D2021%252520Nov%252520Outreach%252520APJ%252520banking%2526utm_content%253D182937943%2526utm_source%253Dhs_email%2526utm_medium%253Demail%2526_hsmi%253D182937943%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3F_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_content%3D182937943%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D182937943&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3F_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_content%3D182937943%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D182937943&liSync=true&e_ipv6=AQKVzNbTUOlhlgAAAX-VzJVQFBTILE4g_BOL6c2Wh96Er5au3rLVd_2htLB5wb4TzfevUJIYZyY3eHdV5cXu1I0hmyFtYQ

Request Chain 47

https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D342%26pixelIndex%3D0%26r%3D784535%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fwww.americanbanker.com%252Fpayments%252Fopinion%252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%253Futm_campaign%253D2021%252520Nov%252520Outreach%252520APJ%252520banking%2526utm_medium%253Demail%2526_hsmi%253D182937943%2526_hsenc%253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%2526utm_content%253D182937943%2526utm_source%253Dhs_email&_=1647485686766 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D342%2526pixelIndex%253D0%2526r%253D784535%2526tzOffset%253D0%2526url%253Dhttps%25253A%25252F%25252Fwww.americanbanker.com%25252Fpayments%25252Fopinion%25252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%25253Futm_campaign%25253D2021%25252520Nov%25252520Outreach%25252520APJ%25252520banking%252526utm_medium%25253Demail%252526_hsmi%25253D182937943%252526_hsenc%25253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%252526utm_content%25253D182937943%252526utm_source%25253Dhs_email%26_%3D1647485686766 HTTP 302
https://a.dpmsrv.com/dpmpxl/index.php?id=1358138099726111045&q=xImp&v=1.x&cl=342&pixelIndex=0&r=784535&tzOffset=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&_=1647485686766

Request Chain 53

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&auid=1528546403.1647485687&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=9qIyYpmxI83c7_UP1fKTmAY&sscte=1&crd=&eitems=ChAI8JXGkQYQj83orbXQj7McEh0AMXZuo246FedLis4plXZcxgW7dbjvzMbJX0qwYA HTTP 302
https://www.google.com/pagead/1p-conversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&auid=1528546403.1647485687&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9qIyYpmxI83c7_UP1fKTmAY&cid=CAQSKQCNIrLMmpvzeBWhaQzzV95d_K8TyPMqrnhbcgm9jR8WZPX2Gama60G1&eitems=ChAI8JXGkQYQj83orbXQj7McEh0AMXZuo9pj_8rONFr2KRqbzNTOnhHYNGMBeM2lqg&random=2486470442&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&auid=1528546403.1647485687&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9qIyYpmxI83c7_UP1fKTmAY&cid=CAQSKQCNIrLMmpvzeBWhaQzzV95d_K8TyPMqrnhbcgm9jR8WZPX2Gama60G1&eitems=ChAI8JXGkQYQj83orbXQj7McEh0AMXZuo9pj_8rONFr2KRqbzNTOnhHYNGMBeM2lqg&random=2486470442&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Request Chain 94

https://a2.adform.net/Serving/TrackPoint/?pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&loc=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-e HTTP 302
https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&loc=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-e

Request Chain 110

https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=1358138099726111045&pixelIndex=0&_=1647485686767 HTTP 302
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1358138099726111045&pixelIndex=0&_=1647485686767&google_gid=CAESEF2pTgrCRnNzuPMqowwn3Ec&google_cver=1

Request Chain 128

https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=8263666895936391270&Expiration=1648695287 HTTP 302
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=8263666895936391270&Expiration=1648695287

Request Chain 131

https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=8263666895936391270&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__ HTTP 302
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=8263666895936391270&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__&nut&uu=791566c0a74641bdbc3968ee4fae9364 HTTP 307
https://c1.adform.net/serving/cookie/match?party=9&uid=53d557fa7943d9fdeccf2c04fa88411ec297001bf4c1f3fb3a9e0f63e5dceed7

Request Chain 133

https://pixel.advertising.com/ups/55944/sync?uid=8263666895936391270&_origin=1 HTTP 302
https://pixel.advertising.com/ups/55944/sync?uid=8263666895936391270&_origin=1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/55944/sync?uid=8263666895936391270&_origin=1&apid=UP9b6b6d79-a59d-11ec-a432-06bfa37d4102 HTTP 302
https://ups.analytics.yahoo.com/ups/55944/sync?uid=8263666895936391270&_origin=1&apid=UP9b6b6d79-a59d-11ec-a432-06bfa37d4102&verify=true

Request Chain 135

https://x.bidswitch.net/sync?dsp_id=70&user_id=8263666895936391270 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=70&user_id=8263666895936391270 HTTP 302
https://eb2.3lift.com/xuid?mid=2409&xuid=d81120b2-13b5-491e-8547-1f50aae82e54&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=2409&xuid=d81120b2-13b5-491e-8547-1f50aae82e54&dongle=d3d3&gdpr=0&cmp_cs=&us_privacy=

Request Chain 136

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=8263666895936391270&expiration=1648695287 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=8263666895936391270&expiration=1648695287&C=1

Request Chain 137

https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=8263666895936391270&sInitiator=external HTTP 302
https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=8263666895936391270&sInitiator=external HTTP 302
https://pixel.mathtag.com/sync/img?mt_exid=10041&gdpr=&gdpr_consent=&redir=https%3A%2F%2Fuipglob.semasio.net%2Fmediamath%2F1%2Finfo%3FsType%3Dsync%26sExtCookieId%3D[MM_UUID]%26sInitiator%3Dinternal HTTP 302
https://uipglob.semasio.net/mediamath/1/info?sType=sync&sExtCookieId=8e3d6232-a2f7-4100-8ac7-ffa37a5ad201&sInitiator=internal&gdpr=&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=&gdpr_consent= HTTP 302
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=1&gdpr_consent=&sInitiator=internal&sExtCookieId=f892a337-c834-4d10-863c-48e109458ab5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=NTExQThCRkI1MEE4QkJBOQ&gdpr=1&gdpr_consent=

Request Chain 139

https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=8263666895936391270 HTTP 302
https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=8263666895936391270&xl8blockcheck=1 HTTP 302
https://load77.exelator.com/pixel.gif

Request Chain 141

https://sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=8263666895936391270 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=8263666895936391270

Request Chain 144

https://api.adrtx.net/thirdparty/click?p=adfo HTTP 302
https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif

Request Chain 145

https://pixel.onaudience.com/?mapped=8263666895936391270&partner=68 HTTP 302
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/gdpr=0/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D HTTP 302
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=a0f5869ceb8c6a2de291c3bed95c6040&gdpr=0 HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0 HTTP 302
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=743e8ed2c7e50d3a0c2e15fe0410ecb9&gdpr=0 HTTP 302
https://spl.zeotap.com/?zdid=1332&zcluid=d535434c9aeaad56 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3292bba1-3c4c-4053-5889-9c8f51c8073a&reqId=a39ee4b8-6d08-45ef-7b42-ff7993bb1ae5&zcluid=d535434c9aeaad56&zdid=1332 HTTP 302
https://mwzeom.zeotap.com/mw?google_gid=CAESEH7kOlQEZgZq-HNCoN2CmIY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3292bba1-3c4c-4053-5889-9c8f51c8073a&reqId=a39ee4b8-6d08-45ef-7b42-ff7993bb1ae5&zcluid=d535434c9aeaad56&zdid=1332

Request Chain 146

https://cm.adsafety.net/?_cmsrc=adformx&idt=100&did=8263666895936391270 HTTP 302
https://tags.adsafety.net/v1/cm?cm_uid=CM1202203170223ecf03fe663dcdde99&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dct%26_chainsrc%3Dcommon%26idt%3D%5B%25IDT%25%5D%26did%3D%5B%25DID%25%5D HTTP 302
https://cm.adsafety.net/?_cmsrc=ct&_chainsrc=common&idt=100&did=9423fc829f1b9222c2fa0ae50061de55 HTTP 302
https://ads.smartstream.tv/cm/?cmsrc=cm&cm_uid=CM1202203170223ecf03fe663dcdde99&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dstv%26_chainsrc%3Dcommon&gdpr_consent= HTTP 302
https://cm.adsafety.net/?_cmsrc=stv&_chainsrc=common&idt=100&did=9423fc829f1b9222c2fa0ae50061de55&idt_did_status=added&gdpr_consent=&gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dataxtrade_dmp&google_cm&google_hm=Q00xMjAyMjAzMTcwMjIzZWNmMDNmZTY2M2RjZGRlOTk HTTP 302
https://cm.adsafety.net/?_cmsrc=dbmx&midt=100&mdid=CAESEBrBEH5coPK0oX2mY2oQ6g0&google_cver=1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=28&cid=CM1202203170223ecf03fe663dcdde99 HTTP 302
https://cm.adsafety.net/?_cmsrc=adform&idt=100&did=8263666895936391270 HTTP 302
https://dsp.adfarm1.adition.com/cookie/?ssp=6 HTTP 302
https://cm.smartstream.tv/?_cmsrc=activeagent_cm&idt=100&did=7075897150589302932 HTTP 302
https://cm.adsafety.net/?_cmsrc=activeagent_cm&idt=100&did=7075897150589302932

Request Chain 148

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=ODI2MzY2Njg5NTkzNjM5MTI3MA HTTP 302
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDqt1O3doqGrX1D34Pd7SoM&google_cver=1&google_ula=1641347,0

Request Chain 149

https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=3&id=1358138099726111045&redirect=1 HTTP 302
https://secure.adnxs.com/setuid?entity=91&code=8263666895936391270

Request Chain 153

https://a.audrte.com/a?adform_uid=8263666895936391270 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent=&google_gid=CAESEA6ve-S4VaLcBPd9aCT6CmI&google_cver=1 HTTP 302
https://ps.eyeota.net/match?bid=kh51m51&uid=27l9EkzNUvXRjmRk-1-ZvqjPw&gdpr=0&gdpr_consent=

Request Chain 154

https://dpm.demdex.net/ibs:dpid=1586&dpuuid=8263666895936391270&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1586&dpuuid=8263666895936391270&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1 HTTP 302
https://c1.adform.net/serving/cookie/match?party=1007&cid=54959948143446757721325264659840586056&noredirect=1

Request Chain 155

https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=8263666895936391270 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1014&cid=164950604093000019384

Request Chain 156

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7075897150589302932

Request Chain 158

https://pixel.mathtag.com/sync/img?redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1066%26cid%3D%5BMM_UUID%5D HTTP 302
https://c1.adform.net/serving/cookie/match?party=1066&cid=8e3d6232-a2f7-4100-8ac7-ffa37a5ad201

Request Chain 159

https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_ HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_ HTTP 302
https://c1.adform.net/serving/cookie/match?party=1084&cid=SSH1wFH41NuGhO5

Request Chain 160

https://match.adsrvr.org/track/cmf/generic?ttd_pid=71ei9rr&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=71ei9rr&ttd_tpi=1 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=f892a337-c834-4d10-863c-48e109458ab5

Request Chain 163

https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D HTTP 302
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D&bounce=1&random=2010049449 HTTP 302
https://dmp.adform.net/serving/cookie/match/?party=1145&cid=KIvJOo5a1C.4eHa4ms6COu

Request Chain 165

https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=8263666895936391270 HTTP 302
https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=8263666895936391270&cs=1

Request Chain 167

https://pixel.tapad.com/idsync/ex/receive?partner_id=2032&partner_device_id=8263666895936391270&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2032&partner_device_id=8263666895936391270&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://c1.adform.net/serving/cookie/match?party=2007&cid=515e4e45-d9d6-4760-8528-99044cd62fa2

Request Chain 218

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

240 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6...
info.appdome.com/e3t/Btc/ZN+113/c24Km04/ 10 KB
3 KB 220ms
150ms Document
text/html 2606:2c40::c73c:67e1
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:2c40::c73c:67e1 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 17 Mar 2022 02:54:44 GMT
content-type: text/html;charset=utf-8
cf-ray: 6ed27217f9249c0c-FRA
last-modified: Thu, 17 Mar 2022 02:54:44 GMT
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
x-hubspot-correlation-id: ef28a336-47c7-483c-8af4-7ddcf9bb7ecf
x-robots-tag: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XvMvAAGUMEyPA%2BhNHrK9YuWdNpgQPAkktCxSpQ0RVLWPOsYZWhJJDlt5UM1gK5CNe35hD58FUFUDBidTIBGzbQ2H5p5CGbwHMlFJFjwZ8znSyTkYEhdNXwDVmvnaIo4gY9gd0OqmhuFdgTRoVxo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br

GET
H/1.1

200
OK

Primary Request new-bot-malware-leaves-financial-apps-dangerously-exposed Show response
www.americanbanker.com/payments/opinion/
Redirect Chain

https://info.appdome.com/events/public/v1/encoded/track/tc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kD...
https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=...

301 KB
76 KB

413ms
316ms

Document
text/html

18.66.122.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-124.fra60.r.cloudfront.net
Software: N/A / Brightspot
Resource Hash: fd63bb8c67fd70ea5f059b291a714c63aacd6893b8928a1bd65228b79db9f1b9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1

Response headers

Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=120
Content-Encoding: gzip
Date: Thu, 17 Mar 2022 02:54:44 GMT
Server: N/A
X-Powered-By: Brightspot
X-Robots-Tag: nofollow
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 109c7a7f1cf897851e09b16d3030a948.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
X-Amz-Cf-Id: urVuCI6I2TPOx0tA18L_GAV5BG-ZvvifdGBeIdjWZr4AOEv4lWHJeg==

Redirect headers

date: Thu, 17 Mar 2022 02:54:44 GMT
location: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
cf-ray: 6ed272191a3d9c0c-FRA
link: <https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email>; rel="canonical"
vary: Accept-Encoding
cf-cache-status: MISS
access-control-allow-credentials: false
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: no-referrer
x-hubspot-correlation-id: 6f991d2e-f938-4cad-9003-b30f5bdd7300
x-robots-tag: none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sh8n5aQe%2FjgVvqYU6n0ynZYTjiq6gUQWC7VEUREGIllSWLfe6avEYOpV3dL0zV%2Fzjo2W%2B7GJ5wHbZUm%2FJ9npG2ExKMPbijvTMKilkMURtKlih86d3W1Iz%2FqIw8flqAbj6AS684%2FbIgvJXhcYDAA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare

GET
H/1.1 200
OK All.min.96c4aa53482f97f80a1ca5e79590efbe.gz.css
arizent.brightspotcdn.com/resource/00000174-26a2-d19a-ad7c-2eebcf9a0000/styleguide/ 624 KB
82 KB 52ms
10ms Stylesheet
text/css 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://arizent.brightspotcdn.com/resource/00000174-26a2-d19a-ad7c-2eebcf9a0000/styleguide/All.min.96c4aa53482f97f80a1ca5e79590efbe.gz.css
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7640e8d43665a07616ae1b3671ed16186ce3239c56776a5409673ceb955cb1b9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 15 Mar 2022 15:19:58 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Tue, 15 Mar 2022 15:13:21 GMT
Server: AmazonS3
Age: 128088
ETag: "57d39ed562535422c17fe196dba44649"
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Cache-Control: public, max-age=31536000
X-Amz-Cf-Pop: DUS51-P1
Accept-Ranges: bytes
Content-Length: 83107
X-Amz-Cf-Id: TGRTY8M9iwK1uPHymsgTamF0ft2qFuAQuIIWimDh92SZSDrR2LdAJg==

GET
H2 200 runtime.js Show response
unpkg.com/regenerator-runtime@0.13.1/ 23 KB
7 KB 35ms
17ms Script
application/javascript 2606:4700::6810:7eaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/regenerator-runtime@0.13.1/runtime.js

Requested by

Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f792fe255fbfcd352fe4b2f759c95980e57d8d297939e12262d9be1e87f48c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:45 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1442962
fly-request-id: 01FWZWQ3KFKKCAK2Y2QJMNMJC1-fra
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"5b05-y9GmlKf9QAx3EInfgjTVmKGWlRQ"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6ed2721cfb119a33-FRA

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 101 B
580 B 787ms
260ms Script
text/javascript 2a04:4e42:200::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?features=Document%2CPromise%2CPromise.prototype.finally%2CObject.getOwnPropertyNames%2CObject.getOwnPropertySymbols%2Ces6%2Ces2015%2Ces2016%2Ces2017%2Ces2018%2Ces2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b4c9b940ff725bf2c2c73932c44d43b5ca6aa4302cd2e0ee6648d80ffa52c3ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 272775
detected-user-agent: Chrome/99.0.4844
server-timing: HIT, fastly;desc="Edge time";dur=0, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 94
referrer-policy: origin-when-cross-origin
last-modified: Sun, 13 Mar 2022 23:08:10 GMT
date: Thu, 17 Mar 2022 02:54:45 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/99.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK All.min.9ee52f2a14e803cdaa3cf3585b91c5df.gz.js Show response
arizent.brightspotcdn.com/resource/00000174-26a2-d19a-ad7c-2eebcf9a0000/styleguide/ 2 MB
546 KB 10ms
10ms Script
text/javascript 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://arizent.brightspotcdn.com/resource/00000174-26a2-d19a-ad7c-2eebcf9a0000/styleguide/All.min.9ee52f2a14e803cdaa3cf3585b91c5df.gz.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc439afff8beca06ec6cb95d2eb8721fc124eb6767662de5b3f0724bdd4ad8cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Tue, 22 Feb 2022 18:42:15 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Tue, 22 Feb 2022 18:11:46 GMT
Server: AmazonS3
Age: 1930351
ETag: "bbc826b283fe97a51c8800218a38d16b"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Cache-Control: public, max-age=31536000
X-Amz-Cf-Pop: DUS51-P1
Accept-Ranges: bytes
Content-Length: 558840
X-Amz-Cf-Id: fNYMUP9BP75OZ6YWQM6C1TXFS-FO8s6-Fl6p9K5kEX4h8tkUVofIfg==

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 81 KB
28 KB 39ms
16ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

113e77e4e7763582965aebeb7f66945f0a7af85429d5bebe831ee7dfa03d3750

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27831
x-xss-protection: 0
server: sffe
etag: "1160 / 671 of 1000 / last-modified: 1647468510"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 17 Mar 2022 02:54:45 GMT

GET
H/1.1 200
OK iasPET.1.js Show response
cdn.adsafeprotected.com/ 22 KB
7 KB 55ms
7ms Script
application/javascript 52.222.214.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adsafeprotected.com/iasPET.1.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-67.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2afcabe2eb6314148dfd9dfdec1333b973d97d0780cc08fddab8501afbb013e9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 13:01:32 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Wed, 02 Jun 2021 17:38:57 GMT
Server: AmazonS3
Age: 395594
ETag: W/"51636de3ce868a2172f9e6996c2934e0"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 920a6dce56a0ee957dbaa3bf4429f8fe.cloudfront.net (CloudFront)
Cache-Control: max-age=604800
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA56-P3
X-Amz-Cf-Id: VRLla_zVt6y-Xtk5SHU9WgsI8t1uJ0lVRl8TehAj5u7ZXxYUojhqhw==

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ 86 KB
31 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 11 Mar 2022 10:12:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 492108
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Mar 2023 10:12:57 GMT

GET
H/1.1 200
OK brand-american-banker-black.svg
arizent.brightspotcdn.com/16/d8/797fc38443bb83caf649880b26cd/ 4 KB
5 KB 10ms
10ms Image
image/svg+xml 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://arizent.brightspotcdn.com/16/d8/797fc38443bb83caf649880b26cd/brand-american-banker-black.svg
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 56b9d2d2849305918fe661cce7bdb8dcdbc83bb18c170884e625d2b2dd417210

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 20 Oct 2021 15:12:01 GMT
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Connection: keep-alive
Last-Modified: Thu, 30 Jul 2020 22:13:05 GMT
Server: AmazonS3
Age: 12742965
ETag: "63fa0ed0a7fecbb154f75e59955f7528"
X-Cache: Hit from cloudfront
Content-Type: image/svg+xml
Cache-Control: public, max-age=31536000
X-Amz-Cf-Pop: DUS51-P1
Accept-Ranges: bytes
Content-Length: 4520
X-Amz-Cf-Id: GnV7XTttBhT7Eo-bHH8JQmYjcEbAO5KMNo1V9_CbonVK2MIiZKCmWA==

GET
H/1.1 200
OK /
arizent.brightspotcdn.com/dims4/default/89f393a/2147483647/strip/true/crop/1000x165+0+0/resize/727x120!/quality/90/ 12 KB
12 KB 10ms
10ms Image
image/png 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://arizent.brightspotcdn.com/dims4/default/89f393a/2147483647/strip/true/crop/1000x165+0+0/resize/727x120!/quality/90/?url=https%3A%2F%2Fsource-media-brightspot.s3.amazonaws.com%2F01%2F05%2F6f8ad49b408398d634628e2d653f%2Farizent-logo.png
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: Apache /
Resource Hash: 6b377a566b9e8e639823a036e09dc56ec5b21a967ec6cdfd8cf1cd6758975e00

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 05 Feb 2022 03:18:47 GMT
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Connection: keep-alive
Server: Apache
Age: 3454558
ETag: e1afff1a21c8b5289e1f92ff04f9f84c
X-Cache: Hit from cloudfront
Content-Type: image/png
Edge-Control: downstream-ttl=31536000
Cache-Control: max-age=31536000, public
X-Amz-Cf-Pop: DUS51-P1
X-Robots-Tag: nofollow
Content-Length: 12233
X-Amz-Cf-Id: w4NFDk46F9G2kDTPU7IS6XuR1YrjRAXb9KyQ6VayfKUNWKb8tC3nvg==
Expires: Sun, 05 Feb 2023 03:18:47 GMT

GET
H/1.1 200
OK jshint_2.13.0.279c236b75a5da43567e97cec91dd6db.gz.js Show response
arizent.brightspotcdn.com/resource/00000174-26a2-d19a-ad7c-2eebcf9a0000/styleguide/jshint/ 1 MB
307 KB 11ms
10ms Script
text/javascript 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://arizent.brightspotcdn.com/resource/00000174-26a2-d19a-ad7c-2eebcf9a0000/styleguide/jshint/jshint_2.13.0.279c236b75a5da43567e97cec91dd6db.gz.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2d5f7ed178594d09e25e87cba0e328167a6e48d2508b4a4898ee7f05c21c0a69

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 05 Feb 2022 03:07:07 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Wed, 14 Jul 2021 19:09:21 GMT
Server: AmazonS3
Age: 3455260
ETag: "b76103b4c850ad47f75d962f6a4ce99a"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Cache-Control: public, max-age=31536000
X-Amz-Cf-Pop: DUS51-P1
Accept-Ranges: bytes
Content-Length: 313784
X-Amz-Cf-Id: _1RMNZicF2f2h_nrESs9J81-eBaFy6DAFTDOfZQP7kgUPAdGXPtHxQ==

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 56ms
18ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

441e0467656e99238bd0547e5bdaac626664183d1f53903117e83dbfb2a45a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.americanbanker.com/
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Mar 2022 01:16:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Mar 2022 02:54:46 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 480 KB
100 KB 56ms
21ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5DXTZXR

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dcda12d07c87e05830c2583e40a6357f21d3a9e5725018e02700455b47bd07c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102269
x-xss-protection: 0
last-modified: Thu, 17 Mar 2022 00:11:15 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H2 200 advertising.js Show response
www.npttech.com/ 7 KB
3 KB 47ms
14ms Script
application/javascript 2606:4700:3030::6815:5476
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.npttech.com/advertising.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:5476 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7538e8f23fac8278c6027d8865bd1240514a3ff64b2c0af3b8ed3583e8ecce6b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4154
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: W21G5BEW7RCCHDT7
x-amz-id-2: Zu6ILWClLDymSszCekw1FgRgMXhY9/GZQ0NEsF2aH+IaAnsD6k2rY0pXHao7xZEqORbyGvE2I48=
last-modified: Wed, 19 Jun 2019 08:25:01 GMT
server: cloudflare
etag: W/"3d6f80c860866175f58a84bbbc9217c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O0uMZ2oBqfTuejw0wMHrbLCBJQdLhlc8fbRz64Fd%2By1%2FV9OZwDU6MMaIrd0%2FHWAP1NeY2dVmI%2FfbJwYWKrcdrfhymquunmhIuW90y7%2Bmw5dxs9XiqQnkkDE6x63ocN1TADFaEV222DvLUK%2BUyrI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=28800
x-amz-version-id: hXQWgdpwSBM26VgKOeTSlm.4VT89.h9w
cf-ray: 6ed272222ba89954-FRA

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/sourcemedia-prod/ 77 KB
25 KB 91ms
19ms Script
application/javascript 13.224.195.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/sourcemedia-prod/p13n.min.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.195.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-195-112.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9117852bb64ba272123bad5259c90fe34447a8faf1eec13c115774b449c86022

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: 7Dm_fpR9wsOvU7WuUl2NlDq0q7rxZ7Aa
Content-Encoding: gzip
ETag: W/"602f77062a5a5bc93d686afc4ca4f11e"
Age: 1836
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Thu, 10 Mar 2022 06:35:42 GMT
Server: AmazonS3
Date: Thu, 17 Mar 2022 02:24:58 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 96283be49fd5bce30b3a0e9559bd2d9e.cloudfront.net (CloudFront)
Cache-Control: public, max-age=3600
X-Amz-Cf-Pop: FRA2-C1
X-Amz-Cf-Id: HvGtMuBzo1EKvu7memlICJfy0he25B-Eo3lnU1amyT4gnPNtzar-AQ==

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 31ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7f2229ee55e618b13fbb84d73eb6c30c2c52511a43b5f14399befeb7df26964e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: wp85s3WO/kg9axjmKbcrfA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
expires: Thu, 17 Mar 2022 03:10:03 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1688
x-fb-rlafr: 0
x-fb-debug: 9qgPg3EjcMwoq06rsuUb9JG6WSDX6VOXBGisS6eirrPEMB5n8LMpbHwEy93As9msZq2yIv6mVaQP+yoyYfraiw==
x-fb-trip-id: 686109401
x-fb-content-md5: efa84ce76aaca1ff0e4409cf073bf6bc
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 17 Mar 2022 02:54:46 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "bf5ee425c806ee6d588af88827706056"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 pubads_impl_2022031401.js Show response
securepubads.g.doubleclick.net/gpt/ 364 KB
124 KB 30ms
6ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

sffe /

Resource Hash

4d44b03d4e4d1df9a852bf35460f5584c94b37c52d08742682a1a03d20d2f6d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:05:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28182
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126502
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 08:34:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 16 Mar 2023 19:05:04 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 106 B
726 B 37ms
16ms XHR
application/json 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.americanbanker.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

79baec8122da15d50dadf74e665e73e22592990e0241f5ebcc6e1210f468597f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90
x-xss-protection: 0
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v22/ 23 KB
23 KB 42ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:31 GMT
x-content-type-options: nosniff
age: 26655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23040
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:21:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:31 GMT

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 load Show response
experience.tinypass.com/xbuilder/experience/ 5 KB
2 KB 46ms
19ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://experience.tinypass.com/xbuilder/experience/load?aid=XUnXNMUrFF

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

27e93d58299bbec64669d53c70f172936cb995c8ef3f168847e2636614db4ccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: br
vary: accept-encoding
cf-cache-status: HIT
age: 457
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Clqbv8rzCY2
wn: prod-exp-10-0-143-47
last-modified: Thu, 17 Mar 2022 02:47:09 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=1800
cf-ray: 6ed272235ac85b8c-FRA
expires: Thu, 17 Mar 2022 03:24:46 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 285 KB
81 KB 16ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=b646b6324988151b95147e24c3cfcaf4

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bc33f45630834dda56c1077e99f591f439acf2792a8c9c1dd578ab3ea64e06d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.americanbanker.com/
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: ynY6qYUCMmvq6CzEOYAhvA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 82905
x-fb-rlafr: 0
x-fb-debug: Q0wlv5PxUkA6RTiK3n9366zCY281dYvf/D6XtsVwq/+Smt8wpbL07L2bQVpT1qpLCrJW0kbqLdUfYKuHDvdXKA==
x-fb-content-md5: 1b5ab4226b6018481a9d864ac4c68b26
x-frame-options: DENY
date: Thu, 17 Mar 2022 02:54:46 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "80f7dfdb520c317ed1dd31e5a8a9859b"
timing-allow-origin: *
priority: u=3,i
expires: Fri, 17 Mar 2023 02:01:16 GMT

GET
H2 200 S6u9w4BMUTPHh50XSwiPGQ.woff2
fonts.gstatic.com/s/lato/v22/ 22 KB
22 KB 32ms
20ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6u9w4BMUTPHh50XSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08664859baab5ed98f0bf818ed77e38464ff1826dc6406d5ecbd651409afbd92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:30 GMT
x-content-type-options: nosniff
age: 26656
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22504
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:12:50 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:30 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ 23 KB
23 KB 25ms
13ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:30 GMT
x-content-type-options: nosniff
age: 26656
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:14:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:30 GMT

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 150 B
465 B 411ms
107ms XHR
application/json 54.159.47.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6e319&site_id=sourcemedia-prod
Requested by: Host: cdn.boomtrain.com
URL: https://cdn.boomtrain.com/p13n/sourcemedia-prod/p13n.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.47.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-47-124.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b7e65d41fb5860735c80ab7bcb1166b69fda442081426fc660cb678d04984205

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:46 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 150

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 39ms
17ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DXTZXR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14889
x-xss-protection: 0
server: cafe
etag: 11178597599353190569
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 32ms
8ms Script
application/x-javascript 2a02:26f0:6c00::210:ba0a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DXTZXR
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba0a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: c567d0068aa9d314d13047cf6af171cce476501aac5e5521bd2b2233b16fbce5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:46 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Mar 2022 20:16:02 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=79945
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3073

GET
H2

200

trackpoint-async.js Show response
s2.adform.net/banners/scripts/st/
Redirect Chain

https://a2.adform.net/serving/scripts/trackpoint/async/
https://s2.adform.net/banners/scripts/st/trackpoint-async.js

81 KB
29 KB

140ms
17ms

Script
application/x-javascript

37.157.5.72
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Server: 37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: ee94251fea8b03da5d0dc6f8489a529c1a2d2a031d874b0ec61866784e3c73c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 14:10:54 GMT
server: nginx
etag: W/"61f1566e-14282"
x-cache-status: HIT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

Redirect headers

location: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
date: Thu, 17 Mar 2022 02:54:46 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 31 KB
13 KB 138ms
29ms Script
application/javascript 34.252.195.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?172
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.195.101 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-195-101.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: cd5489dc88fd8e9e9ea9cacf8077f8b20446d10fab97186491fe62079051a10d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:46 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=86400
transfer-encoding: chunked
Connection: keep-alive

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 17ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e18d0e3dd548e9745884578e3cd9f0a492ddbb6f3b797db364b45bb16cadfb3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26320
x-xss-protection: 0
pragma: public
x-fb-debug: y+fEG7/q0kXeo2AZeMC0jtrPgYDwsWtsOdKh8ihCXjMFIJAaXUGdiNm1XJP88DgZT//BS0MkZcZswZLzwg+wOA==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 17 Mar 2022 02:54:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/ 930 B
1 KB 44ms
7ms Script
application/javascript 52.222.250.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.250.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-250-115.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 62f586be8571b23584eb4a60a45a3157ff7c8388b1b1e3b4e8890e243b3e47de

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 03:34:00 GMT
Via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront)
Age: 84046
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 930
Pragma: public
Last-Modified: Wed, 06 May 2020 20:19:48 GMT
Server: nginx
ETag: "5eb31be4-3a2"
Content-Type: application/javascript
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA60-P3
Accept-Ranges: bytes
X-Amz-Cf-Id: jqRvapPXqPHb9-wYHxNKDaoprlyMycm9qyOk27ahJalHcRE4fSw-Tw==
Expires: Thu, 17 Mar 2022 03:34:00 GMT

GET
H2 200 video.js Show response
vjs.zencdn.net/7.6.5/ 2 MB
395 KB 768ms
253ms Script
application/javascript 2a04:4e42:200::729
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vjs.zencdn.net/7.6.5/video.js
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:200::729 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 59a717e69bec72ad009181785a1a65b674d1c01e77e04bdc718deb02a9b97671

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
last-modified: Fri, 04 Oct 2019 14:08:10 GMT
etag: "6ad9f2485086f3f4265513b2a6599cf1"
x-served-by: cache-icn1450048-ICN
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
timing-allow-origin: *
content-length: 404443
x-cache-hits: 1

GET
H/1.1 200
OK dpm_c415505dca69be631ca5d391b3ccd2b44b52d017.min.js Show response
s.dpmsrv.com/ 112 KB
38 KB 65ms
8ms Script
application/x-javascript 13.32.99.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.dpmsrv.com/dpm_c415505dca69be631ca5d391b3ccd2b44b52d017.min.js
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-47.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d5e1876373576f4110b6ad82c25041aa2e9762cc4a417939eeb20e654818a818

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:48:39 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 May 2020 20:46:58 GMT
Server: AmazonS3
Age: 369
ETag: "b10698ccacbd3420aaa5389feaa6b0f5"
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 efb4ddf9650598b987ef5db782c5b530.cloudfront.net (CloudFront)
Connection: keep-alive
X-Amz-Cf-Pop: FRA60-P3
Accept-Ranges: bytes
Content-Length: 38693
X-Amz-Cf-Id: Nsw-1kZgxvwG_PCsB0N2tJJ19SzR4yBuxtbI-ab9Urk-otwvapOYgQ==

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 51ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 23:54:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 58DAF42FA50240AA9C05C11888CC7798 Ref B: FRA31EDGE0210 Ref C: 2022-03-17T02:54:46Z
etag: "806a236c101ed81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11333

GET
H2

200

analytics-1.5.12.min.js Show response
cdn.keywee.co/dist/
Redirect Chain

https://cdn.keywee.co/dist/analytics.min.js
https://cdn.keywee.co/dist/analytics-1.5.12.min.js

22 KB
8 KB

15ms
15ms

Script
application/javascript

2600:9000:225f:7800:e:ec66:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.keywee.co/dist/analytics-1.5.12.min.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Server: 2600:9000:225f:7800:e:ec66:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d29d84e698eb10452f97d8a6f249b73496beb844cef58e920e3832bd321d64a2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 14:59:56 GMT
content-encoding: gzip
last-modified: Mon, 28 Dec 2020 09:55:56 GMT
server: AmazonS3
age: 129290
etag: W/"13a05c433850fad0455e2ee1a1707eb0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 56d45ca72c110eb4c3736727b5f5040a.cloudfront.net (CloudFront)
cache-control: max-age=259200,public
x-amz-cf-pop: TXL50-P2
x-amz-cf-id: JzHRSMhACYyyc-tdJBrZ-URxmrCTk5Z30YVsuCUbKCHF33JY2Oc9sA==

Redirect headers

date: Thu, 17 Mar 2022 02:54:26 GMT
via: 1.1 56d45ca72c110eb4c3736727b5f5040a.cloudfront.net (CloudFront)
server: AmazonS3
age: 21
x-cache: Hit from cloudfront
location: /dist/analytics-1.5.12.min.js
x-amz-cf-pop: TXL50-P2
content-length: 0
x-amz-cf-id: -HCTVEzRwhA2Eirlr1hatc5Tu8f27iAQfJNi34BNhGneuqKKGCIEtA==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5DXTZXR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4796
date: Thu, 17 Mar 2022 01:34:50 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 17 Mar 2022 03:34:50 GMT

GET
H2 200 tinypass.min.js Show response
cdn.tinypass.com/api/ 275 KB
80 KB 30ms
21ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.tinypass.com/api/tinypass.min.js

Requested by

Host: experience.tinypass.com
URL: https://experience.tinypass.com/xbuilder/experience/load?aid=XUnXNMUrFF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e17ef345a3598b3656b160ca57a1a44dab4365894b10c407f4257bb248504e94

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 72010
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 76JSTV7GTZ24YYH0
x-amz-id-2: EA6aANI1/vNET/xla8cu11o7Xs3nSMOUja8KpKK3HuTteYAt/H7E2qAbiMmEAywpRdYtIVfG0Ws=
last-modified: Mon, 28 Feb 2022 15:07:54 GMT
server: cloudflare
etag: W/"d766e4371da10c3c8ec5fecc88497ef7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 6ed27224db875b8c-FRA
expires: Thu, 17 Mar 2022 06:54:46 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1011464113/ 3 KB
2 KB 46ms
23ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1011464113/?random=1647485686659&cv=9&fst=1647485686659&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2554e8949e7f36deaf93460f5cb9d6d43e817cf066fe0356dfc351a7e91f6a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1292
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/1011464113/ 2 KB
1 KB 37ms
20ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1011464113/?random=1647485686661&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&auid=1528546403.1647485687&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

cafe /

Resource Hash

f0a36dc47096520228c4be03535d47c1deb217b539d6257287daefe739361a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1497
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 p.js Show response
cdn.parsely.com/keys/americanbanker.com/ 72 KB
26 KB 49ms
10ms Script
application/javascript 18.66.245.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/americanbanker.com/p.js
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.245.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-245-59.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: a66176229882908d4a804b804674b9fcfc534927ffc16fcd75a091f8019723d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: public
date: Wed, 16 Mar 2022 05:57:35 GMT
content-encoding: gzip
last-modified: Tue, 19 Oct 2021 21:52:02 GMT
server: nginx
age: 75431
etag: W/"616f3e02-12086"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 809c299e67c4ffca3db95351c7287bd8.cloudfront.net (CloudFront)
cache-control: max-age=86400, public
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: UC_wDbVhOZmcGTfKxIzHOC5asXd6vnprvReYl0_8R3QcgtIvZOmzTw==
expires: Thu, 17 Mar 2022 05:57:35 GMT

GET
H3 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
884 B 22ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:15:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2376
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 17 Mar 2022 03:15:10 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-expose...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D674964%26time%3D1647485686684%26url%3Dhttps%253A%252F%252Fwww.americanbanker.com%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-expose...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-expos...

0
263 B

208ms
183ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3F_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_content%3D182937943%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D182937943&liSync=true&e_ipv6=AQKVzNbTUOlhlgAAAX-VzJVQFBTILE4g_BOL6c2Wh96Er5au3rLVd_2htLB5wb4TzfevUJIYZyY3eHdV5cXu1I0hmyFtYQ
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: CB9EA1819CC8409DB400F2787367D271 Ref B: FRAEDGE1110 Ref C: 2022-03-17T02:54:47Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXaYScqtIsQr3dTQYw8IA==
x-li-fabric: prod-lor1

Redirect headers

date: Thu, 17 Mar 2022 02:54:46 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: F4DA124DA8BE45E1A0E134C5058D1354 Ref B: FRAEDGE0910 Ref C: 2022-03-17T02:54:47Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=674964&time=1647485686684&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3F_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_content%3D182937943%26utm_source%3Dhs_email%26utm_medium%3Demail%26_hsmi%3D182937943&liSync=true&e_ipv6=AQKVzNbTUOlhlgAAAX-VzJVQFBTILE4g_BOL6c2Wh96Er5au3rLVd_2htLB5wb4TzfevUJIYZyY3eHdV5cXu1I0hmyFtYQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXaYScnFN7q9jVhOpeWkQ==

GET
H3 200 1859681287603644 Show response
connect.facebook.net/signals/config/ 308 KB
87 KB 9ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1859681287603644?v=2.9.57&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7234816209f5ffff423a5ff520c6144d69a2443439607f7ace4ac68b32c65f60

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 89425
x-xss-protection: 0
pragma: public
x-fb-debug: u4AcoYpEB/oySs/VhsQETVT8efjpw1L3ku6J1shS5j/TR/KcSBQ0F2gSbX0J6S2ybRAgcAcTtyXWtCO0VD16XA==
x-frame-options: DENY
date: Thu, 17 Mar 2022 02:54:46 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 17523647.js Show response
bat.bing.com/p/action/ 0
112 B 152ms
152ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/17523647.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Mar 2022 02:54:46 GMT
cache-control: private,max-age=1800
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CB50053ACC6B4554A6BC5F6088FC6008 Ref B: FRA31EDGE0210 Ref C: 2022-03-17T02:54:46Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
151 B 31ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=17523647&Ver=2&mid=7e0f3a81-f9f4-427e-a8c4-dc2cbad6d5f5&sid=9ac96fd0a59d11ec9a2c9f378ab7c623&vid=9ac99540a59d11ec912b57dfb6d31843&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&kw=Payment%20fraud,Malware,Security%20risk,Payment%20processing,Mobile%20payments,PSO%20content&p=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&r=&lt=1697&evt=pageLoad&msclkid=N&sv=1&rn=627627
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BE13803AC1BC4006AC7154442578AC5E Ref B: FRA31EDGE0210 Ref C: 2022-03-17T02:54:46Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get.js Show response
buy.tinypass.com/api/v3/anon/captcha/ 153 B
312 B 29ms
20ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/api/v3/anon/captcha/get.js?callback=jsonpCallback&aid=XUnXNMUrFF

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ae7d16f87ca137f509bbab628546e72f09920ad639f4253a2286edc6086f1cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 33
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Cd2cv8reYCm
pragma
wn: prod-dash-10-0-112-160
last-modified: Thu, 17 Mar 2022 02:54:13 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript
server-time: 0.002
cache-control: public, max-age=1200
cf-ray: 6ed272256bd25b8c-FRA
expires: Thu, 17 Mar 2022 03:14:46 GMT

GET
H/1.1 200
OK cx.cce.js Show response
cdn.cxense.com/ 22 KB
6 KB 34ms
10ms Script
application/x-javascript 2a02:26f0:6c00:2bf::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/cx.cce.js
Requested by: Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2bf::268b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 53223cc800efd65753dec3ab9c1099a86c6eb0f37a044c45e64b4cd8469a5181

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:46 GMT
Content-Encoding: gzip
Last-Modified: Thu, 10 Feb 2022 15:01:18 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5939
Expires: Thu, 17 Mar 2022 03:54:46 GMT

GET
H/1.1

200
OK

index.php Show response
a.dpmsrv.com/dpmpxl/
Redirect Chain

https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D342%26pixelIndex%3D0%26r%3D784535%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fwww.americanbanker.c...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D342%2526pixelIndex%253D0%2526r%253D784535%2526tzOffset%25...
https://a.dpmsrv.com/dpmpxl/index.php?id=1358138099726111045&q=xImp&v=1.x&cl=342&pixelIndex=0&r=784535&tzOffset=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-lea...

257 B
1003 B

417ms
93ms

Script
text/javascript

35.172.177.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?id=1358138099726111045&q=xImp&v=1.x&cl=342&pixelIndex=0&r=784535&tzOffset=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&_=1647485686766
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Server: 35.172.177.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-177-82.compute-1.amazonaws.com
Software: /
Resource Hash: a865467f5bd0d9de0b206450d8b7acff6da5081d9c08cb7ed567a201aafe988c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
content-encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 224
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:46 GMT
X-Proxy-Origin: 138.199.38.133; 138.199.38.133; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8b35c782-4183-4479-b428-a80cbf1f956f
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://a.dpmsrv.com/dpmpxl/index.php?id=1358138099726111045&q=xImp&v=1.x&cl=342&pixelIndex=0&r=784535&tzOffset=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&_=1647485686766
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
447 B 284ms
17ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-219761-28&cid=807543790.1647485687&jid=1742700647&gjid=569373508&_gid=95126325.1647485687&_u=aGBAiEAjBAAAAE~&z=80536966

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 17 Mar 2022 02:54:46 GMT
content-type: text/plain
access-control-allow-origin: https://www.americanbanker.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 279ms
17ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-219761-100&cid=807543790.1647485687&jid=685872458&gjid=1357722850&_gid=95126325.1647485687&_u=aGDAiEAjBAAAAE~&z=288314066

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 17 Mar 2022 02:54:46 GMT
content-type: text/plain
access-control-allow-origin: https://www.americanbanker.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1507751896&t=pageview&_s=1&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&dp=%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed&ul=en-us&de=UTF-8&dt=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAiEAjB~&jid=1742700647&gjid=569373508&cid=807543790.1647485687&tid=UA-219761-28&_gid=95126325.1647485687&gtm=2wg3e05DXTZXR&cd1=Tom%20Tovar&cd2=Amazon%20CloudFront&cd5=Free&cd8=22&cd9=20200804&cd10=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&cd12=Payment%20fraud&cd14=483&cd15=OpinionArticle&cd17=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&z=1450732189

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Mar 2022 04:04:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 82201
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1507751896&t=pageview&_s=1&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&dp=%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed&ul=en-us&de=UTF-8&dt=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAiEAjBAAAAE~&jid=685872458&gjid=1357722850&cid=807543790.1647485687&tid=UA-219761-100&_gid=95126325.1647485687&gtm=2wg3e05DXTZXR&cd1=Tom%20Tovar&cd2=Amazon%20CloudFront&cd5=Free&cd8=22&cd9=20200804&cd10=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&cd12=Payment%20fraud&cd14=483&cd15=OpinionArticle&cd17=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&z=1807793233

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Mar 2022 04:04:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 82201
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 verify Show response
id.tinypass.com/id/api/v1/identity/token/ 174 B
966 B 135ms
126ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://id.tinypass.com/id/api/v1/identity/token/verify?callback=jsonp4588&client_id=XUnXNMUrFF&site=https%3A%2F%2Fwww.americanbanker.com

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00ecf4c43e50bff8f100ba0572c369f96771b38cd9317edd5c29f257cf0aad68

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
p3p: CP="ALL ADM DEV PSAi COM OUR OTRo STP IND ONL", CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Ca3cv8rHlZc
pragma: no-cache
wn: prod-id-10-0-81-213
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-cache="set-cookie"
access-control-allow-credentials: true
server-time: 0.004
cf-ray: 6ed27225dc0b5b8c-FRA
access-control-allow-headers: origin, content-type, accept, authorization
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/1011464113/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&re...
https://www.google.com/pagead/1p-conversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u...
https://www.google.de/pagead/1p-conversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_...

42 B
64 B

37ms
27ms

Image
image/gif

2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&auid=1528546403.1647485687&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9qIyYpmxI83c7_UP1fKTmAY&cid=CAQSKQCNIrLMmpvzeBWhaQzzV95d_K8TyPMqrnhbcgm9jR8WZPX2Gama60G1&eitems=ChAI8JXGkQYQj83orbXQj7McEh0AMXZuo9pj_8rONFr2KRqbzNTOnhHYNGMBeM2lqg&random=2486470442&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Requested by

Protocol

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/1011464113/?random=1913871560&cv=9&fst=1647485686661&num=1&value=0&currency_code=USD&label=_rLSCKPYmOoCELHvpuID&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&auid=1528546403.1647485687&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=9qIyYpmxI83c7_UP1fKTmAY&cid=CAQSKQCNIrLMmpvzeBWhaQzzV95d_K8TyPMqrnhbcgm9jR8WZPX2Gama60G1&eitems=ChAI8JXGkQYQj83orbXQj7McEh0AMXZuo9pj_8rONFr2KRqbzNTOnhHYNGMBeM2lqg&random=2486470442&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1011464113/ 42 B
548 B 281ms
24ms Image
image/gif 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1011464113/?random=1647485686659&cv=9&fst=1647482400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&async=1&fmt=3&is_vtc=1&random=1927810226&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1011464113/ 42 B
548 B 276ms
19ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1011464113/?random=1647485686659&cv=9&fst=1647482400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&frm=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&tiba=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&async=1&fmt=3&is_vtc=1&random=1927810226&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 193.js Show response
cdn.keywee.co/config/ 233 B
572 B 41ms
40ms Script
application/javascript 2600:9000:225f:7800:e:ec66:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.keywee.co/config/193.js
Requested by: Host: cdn.keywee.co
URL: https://cdn.keywee.co/dist/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:7800:e:ec66:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: af049cb9878153af170de62d07701370f22c95c9b652fe4f9fa078ea6d7034d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 01:11:01 GMT
via: 1.1 56d45ca72c110eb4c3736727b5f5040a.cloudfront.net (CloudFront)
last-modified: Tue, 28 Sep 2021 13:57:54 GMT
server: AmazonS3
age: 6226
etag: "784cfac3d1e922fd9607eac88a0ff59c"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-pop: TXL50-P2
content-length: 233
x-amz-cf-id: uTS4wvRrX1ItZOMl78IC2SiwpKcz2WTwDO51YuRBzbc0KAPZ7spQDw==

GET
H/1.1 200
OK /
p1.parsely.com/plogger/ 43 B
259 B 420ms
93ms Image
image/gif 52.205.167.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/plogger/?rand=1647485686808&plid=86902465&idsite=americanbanker.com&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22plan%22%3A%22undefined%22%7D&sid=1&surl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&sref=&sts=1647485686802&slts=0&title=New+bot+malware+leaves+financial+apps+dangerously+exposed+%7C+PaymentsSource+%7C+American+Banker&date=Thu+Mar+17+2022+02%3A54%3A46+GMT%2B0000+(GMT)&action=pageview&pvid=34288542&u=pid%3Dcfa8874fd39fd8acfc32f83f37c2b8f3
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.167.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-167-202.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:47 GMT
Cache-Control: no-cache
Last-Modified: Thursday, 17-Mar-2022 02:54:47 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 225ms
7ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1859681287603644&ev=PageView&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&rl=&if=false&ts=1647485686829&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&par[0]=%7B%22extractorID%22%3A%22541029256690117%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22USD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%22806187966482914%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1647485686828.1657690458&it=1647485686692&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 225ms
7ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?ev=1859681287603644&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&rl=&if=false&ts=1647485686830&sw=1600&sh=1200&v=2.9.57&r=stable&o=28&it=1647485686692&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 62 B
572 B 30ms
30ms Script
application/javascript 34.252.195.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50113&ct=js&pi=&fp=undefined&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&pv=1647485686832_at841sdtv&bl=en-us&cb=3906799&return=&ht=&d=&dc=&si=1647485686832_at841sdtv&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?172
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.195.101 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-195-101.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:46 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 147
Expires: 0

GET
H/1.1 200
OK cx.js Show response
cdn.cxense.com/ 64 KB
22 KB 11ms
11ms Script
application/x-javascript 2a02:26f0:6c00:2bf::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/cx.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.cce.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2bf::268b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 36aa85b5d97f76a381de07cdcc8f2bdecf7462384f8207f8a54d6aae1a40e4f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:46 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Feb 2022 13:47:07 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21887
Expires: Thu, 17 Mar 2022 03:54:46 GMT

GET
H/1.1 200
OK /
arizent.brightspotcdn.com/dims4/default/7d2dff0/2147483647/strip/true/crop/1400x788+0+6/resize/460x259!/quality/90/ 41 KB
42 KB 10ms
10ms Image
image/jpeg 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://arizent.brightspotcdn.com/dims4/default/7d2dff0/2147483647/strip/true/crop/1400x788+0+6/resize/460x259!/quality/90/?url=https%3A%2F%2Fsource-media-brightspot.s3.amazonaws.com%2F02%2F8a%2F74550c724e089d5ed1b283455868%2Fm-a-cardshow-collage.jpg
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: Apache /
Resource Hash: a735032007963319f839c1c7e6ef2d5ee5de6b8f222ee5f8f6b2d13e51bb71dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 01:07:10 GMT
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Connection: keep-alive
Server: Apache
Age: 6456
ETag: 91788942b9a16309919ef9e0d0d9838b
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Edge-Control: downstream-ttl=31536000
Cache-Control: max-age=31536000, public
X-Amz-Cf-Pop: DUS51-P1
X-Robots-Tag: nofollow
Content-Length: 42287
X-Amz-Cf-Id: WJsNofVGlx7YAw57HGbBk35_78WGECe-lyGX_UiTE09nuBHDCCxHfg==
Expires: Fri, 17 Mar 2023 01:07:10 GMT

GET
H/1.1 200
OK /
arizent.brightspotcdn.com/dims4/default/6cd20e6/2147483647/strip/true/crop/3018x1699+0+313/resize/460x259!/quality/90/ 13 KB
14 KB 10ms
10ms Image
image/jpeg 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://arizent.brightspotcdn.com/dims4/default/6cd20e6/2147483647/strip/true/crop/3018x1699+0+313/resize/460x259!/quality/90/?url=https%3A%2F%2Fsource-media-brightspot.s3.amazonaws.com%2F75%2Fef%2F65cd6c23400d80e1f04d6d25bffc%2F384027686.jpg
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: Apache /
Resource Hash: f2b761c524e3490154a26a97d6e8dcf7708749df5f96cdb696c19386be8d78c9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 01:09:25 GMT
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Connection: keep-alive
Server: Apache
Age: 6321
ETag: 17059c7c1c8c5367be69654b7fe7c710
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Edge-Control: downstream-ttl=31536000
Cache-Control: max-age=31536000, public
X-Amz-Cf-Pop: DUS51-P1
X-Robots-Tag: nofollow
Content-Length: 13332
X-Amz-Cf-Id: kjKdZK-raYmo1fr9OlVnf_0eTdIRjmQH-M3sXwXm0O77WYKZh9eO-Q==
Expires: Fri, 17 Mar 2023 01:09:25 GMT

GET
H/1.1 200
OK segments Show response
api.zetaglobal.net/people/F5XBP7GkuLCe%2B3OA8NX5AbZvl%2Bj0V%2BIV%2B1wnvOmpJid1Ett9ifLwWDU7HQdbQ%2FpPSEOhPckTQmy3isj%2B5728qg%3D%3D/ 2 B
939 B 399ms
186ms XHR
application/json 54.88.65.136
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.zetaglobal.net/people/F5XBP7GkuLCe%2B3OA8NX5AbZvl%2Bj0V%2BIV%2B1wnvOmpJid1Ett9ifLwWDU7HQdbQ%2FpPSEOhPckTQmy3isj%2B5728qg%3D%3D/segments?site_id=sourcemedia-prod

Requested by

Host: cdn.boomtrain.com
URL: https://cdn.boomtrain.com/p13n/sourcemedia-prod/p13n.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.88.65.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-88-65-136.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Request-Id: 98cf898f-e321-43bd-bb83-5143d040a9e3
X-Runtime: 0.091319
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
ETag: W/"511805c6f1b5465153082b30864cad62"
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains, max-age=31536000;
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Request-Methods: GET
Access-Control-Allow-Headers: origin, x-requested-with, content-type, accept, authorization, x-prototype-version

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
248 B 325ms
114ms XHR
text/plain 3.234.21.226
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: cdn.boomtrain.com
URL: https://cdn.boomtrain.com/p13n/sourcemedia-prod/p13n.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.234.21.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-21-226.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
allow: GET, HEAD, OPTIONS, POST
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2

POST
H2 200 execute Show response
c2.piano.io/xbuilder/experience/ 61 KB
10 KB 173ms
148ms XHR
application/json 2606:4700::6810:2a41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c2.piano.io/xbuilder/experience/execute?aid=XUnXNMUrFF

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:2a41 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a79633578e877916dc850d090a6cbbb5c3d3001c10f869239e49aa102cedafa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept: application/json
Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
vary: Accept-Encoding, Origin
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: l2hykjjsly
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
cf-ray: 6ed27227abba908e-FRA

GET
H2 200 sp-2.9.1.js Show response
cdn.keywee.co/dist/ 75 KB
26 KB 17ms
17ms Script
application/x-javascript 2600:9000:225f:7800:e:ec66:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.keywee.co/dist/sp-2.9.1.js
Requested by: Host: cdn.keywee.co
URL: https://cdn.keywee.co/dist/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:7800:e:ec66:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8ae5b95f24ba3bf0fa5b9b21ffca4ef8a683558ae0a4985abf835f7b71ad0579

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 01:15:37 GMT
content-encoding: gzip
last-modified: Sun, 14 Oct 2018 12:37:03 GMT
server: AmazonS3
age: 4930750
etag: W/"e0e6c30dc2f18c8cee12448a4cbb07eb"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 56d45ca72c110eb4c3736727b5f5040a.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: TXL50-P2
x-amz-cf-id: EqZLhaDgnqBJRpARfKKm0kFGj3Eo1rJ5JcZvpjS2FoclJj7gJADcXg==

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 17ms
8ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1859681287603644&ev=KWCEPV&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&rl=&if=false&ts=1647485687072&cd[noad30]=1&cd[noadcm]=1&cd[nokart]=0&cd[pvps]=1&cd[slensec]=0&cd[ar30d]=1&cd[arcm]=1&cd[kar30d]=0&cd[karcm]=0&cd[ts30d]=0&cd[tscm]=0&cd[kru]=0&sw=1600&sh=1200&v=2.9.57&r=stable&ec=1&o=30&fbp=fb.1.1647485686828.1657690458&it=1647485686692&coo=false&dpo=LDU&dpoco=0&dpost=0&tm=2&exp=p0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 17ms
8ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1859681287603644&ev=PageView&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&rl=&if=false&ts=1647485687074&sw=1600&sh=1200&v=2.9.57&r=stable&ec=2&o=30&par[0]=%7B%22extractorID%22%3A%22541029256690117%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22USD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%22806187966482914%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1647485686828.1657690458&it=1647485686692&coo=false&dpo=LDU&dpoco=0&dpost=0&tm=1&exp=p0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 17 Mar 2022 02:54:46 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 40ms
22ms Image
image/gif 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-219761-28&cid=807543790.1647485687&jid=1742700647&_u=aGBAiEAjBAAAAE~&z=156172889

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 39ms
21ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-219761-28&cid=807543790.1647485687&jid=1742700647&_u=aGBAiEAjBAAAAE~&z=156172889

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 40ms
23ms Image
image/gif 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-219761-100&cid=807543790.1647485687&jid=685872458&_u=aGDAiEAjBAAAAE~&z=301073824

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 44ms
27ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-219761-100&cid=807543790.1647485687&jid=685872458&_u=aGDAiEAjBAAAAE~&z=301073824

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 i
pixel.keywee.co/ 43 B
295 B 305ms
95ms Image
image/gif 54.80.32.197
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.keywee.co/i?stm=1647485687102&e=pv&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&page=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&tv=js-2.9.1&tna=cf&aid=193&p=web&tz=UTC&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&res=1600x1200&cd=24&cookie=1&f_passive=1&f_wheel=wheel&eid=328f4c83-91a6-4215-bfaa-65ac744b7881&dtm=1647485687100&vp=1600x1200&ds=1600x3215&vid=1&sid=ab285774-d97c-47eb-9783-ddfff539c645&duid=a23ee341-5445-4cea-9eab-019a893a9b1e&fp=540708920

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.80.32.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-32-197.compute-1.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

status: 200 OK
date: Thu, 17 Mar 2022 02:54:47 GMT
x-content-type-options: nosniff
server: nginx/1.21.3
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

GET
H/1.1 200
OK /
arizent.brightspotcdn.com/dims4/default/960317e/2147483647/strip/true/crop/5000x2815+0+258/resize/460x259!/quality/90/ 25 KB
26 KB 11ms
10ms Image
image/jpeg 18.66.248.66
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://arizent.brightspotcdn.com/dims4/default/960317e/2147483647/strip/true/crop/5000x2815+0+258/resize/460x259!/quality/90/?url=https%3A%2F%2Fsource-media-brightspot.s3.amazonaws.com%2F36%2F71%2F9923e889471fb51efd3c0c7e6d3d%2F379759717-1.jpg
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.66 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-66.dus51.r.cloudfront.net
Software: Apache /
Resource Hash: 172d9fd9a11849f24d3f95bdeed1cc4e8939fe29d4d2cd3c89185b974645e282

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 21:51:58 GMT
Via: 1.1 eca56eada7885f8195ee4db13cd72cc2.cloudfront.net (CloudFront)
Connection: keep-alive
Server: Apache
Age: 18169
ETag: 6821355f517645d2ea4a926589d681e3
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Edge-Control: downstream-ttl=31536000
Cache-Control: max-age=31536000, public
X-Amz-Cf-Pop: DUS51-P1
X-Robots-Tag: nofollow
Content-Length: 25706
X-Amz-Cf-Id: 291aAcEQji8UOLmLjOLVmsReNO_a74n-PGdPO2aprQBBKBhfliqnug==
Expires: Thu, 16 Mar 2023 21:51:58 GMT

GET
H2 200 tag Show response
a.teads.tv/page/71453/ 2 KB
1015 B 103ms
36ms Script
application/javascript 184.30.21.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/71453/tag
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-51.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1af5a3983fc18ecbd557e0840c2a3c25ae6ce1c37dfadffd4ec19a6224c4a9e2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, must-revalidate, max-age=3600
access-control-allow-credentials: true
content-length: 815
expires: Thu, 17 Mar 2022 03:54:47 GMT

POST
H3 200 loadTemplateContext Show response
buy.tinypass.com/api/v3/anon/template/ 588 B
811 B 172ms
153ms XHR
application/json 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/api/v3/anon/template/loadTemplateContext?aid=XUnXNMUrFF

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f95b2435a7b89e307f32fa5fcaa96fed294075356f6187b604221ddc950dcbe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept: application/json
Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Cb3cv8rfj0H
pragma: no-cache
wn: prod-dash-10-0-89-195
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
server-time: 0.006
cf-ray: 6ed27228ed999bf2-FRA
expires: 0

GET
H3 200 cacheableShow Show response
buy.tinypass.com/checkout/template/ Frame 17E0 12 KB
5 KB 443ms
419ms Document
text/html 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe96e94ac39b56bb5bd99766bc5d38d1c929e6da6c1013fe8c870a5044b6a324

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-type: text/html;charset=UTF-8
access-control-allow-methods: *
access-control-allow-origin: https://dashboard.piano.io
cache-control: public, max-age=10800
expires: Thu, 17 Mar 2022 05:54:47 GMT
p3p: CP="NON DSP COR OUR IND"
pragma
server-time: 0.015
strict-transport-security: max-age=86400; includeSubDomains
vary: accept-encoding
wn: prod-dash-10-0-90-56
x-forwarded-https: on
x-request-id: Cb3cv8rIHCV
x-xss-protection: 0
cf-cache-status: MISS
last-modified: Thu, 17 Mar 2022 02:54:47 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ed27228f9a49b52-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 loadTemplateContext Show response
buy.tinypass.com/api/v3/anon/template/ 588 B
845 B 147ms
146ms XHR
application/json 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/api/v3/anon/template/loadTemplateContext?aid=XUnXNMUrFF

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55b19948cff3942746a3871c137e7fc89a71d815d4a6e824b128f50d7da6a38b

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept: application/json
Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Cb3cv8rfZ9P
pragma: no-cache
wn: prod-dash-10-0-90-56
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
server-time: 0.006
cf-ray: 6ed27228ed9f9bf2-FRA
expires: 0

GET
H3 200 cacheableShow Show response
buy.tinypass.com/checkout/template/ Frame E6F8 10 KB
4 KB 38ms
31ms Document
text/html 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com

Requested by

Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91d6318841019326507fbe32112cf14d8dacf94d835fd53c9add806c49efd5c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-type: text/html;charset=UTF-8
access-control-allow-methods: *
access-control-allow-origin: https://dashboard.piano.io
cache-control: public, max-age=5135
expires: Thu, 17 Mar 2022 04:20:22 GMT
p3p: CP="NON DSP COR OUR IND"
pragma
server-time: 0.013
strict-transport-security: max-age=86400; includeSubDomains
vary: accept-encoding
wn: prod-dash-10-0-132-157
x-forwarded-https: on
x-request-id: Cyp7v8rds6h
x-xss-protection: 0
cf-cache-status: HIT
age: 5665
last-modified: Thu, 17 Mar 2022 01:20:22 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6ed27228f9a59b52-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ 5 KB
3 KB 55ms
9ms Script
application/javascript 108.156.253.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: info.appdome.com
URL: https://info.appdome.com/e3t/Btc/ZN+113/c24Km04/VX8v6R2BfgJvW2G4-1t8RzHQXW7Y8zfc4zWrjzN7TcW1h5nCTJV3Zsc37CgWDPVfkRxC1lrQtRW7N4ch13XD1thW77b2--8xkQxJW5WHd3y7JYzfqW71Bvkf8kDX_QN25072B1MPT2W2Nf_z421v-znN3dDNKzYrwPZW8DHLg22PRg_MN6-V2QKbYRkNN5jDvm_G6KLRV48L5D4W4bcXN5ScHYrMKxLcW92sph73lllwwW41NbxF8LNwYdW2DzKn_5Sh_2BW5HrFKH3GxlH9W4z7rN67jLy0bW1NS8yq3TXbG9W3gyQXp9cNk7bVGPQS75T5g9fW7zLK4h7FH4dmW1Z2jSn5dCB6DW7KzlgB1C5SC_W18Nq2g94MD7kVJsrGv7pxzm0W1h95qr63cyBxW4CJKG23l7MgbW12ztL02173jCW8Jlcdp8TbY8kN6cn8yrv1plLW2ZL76K64fhYs3gPj1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.253.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-253-115.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:14:35 GMT
content-encoding: gzip
last-modified: Tue, 01 Mar 2022 22:59:53 GMT
server: AmazonS3
age: 2413
etag: W/"eb0a40c00c97d9640177205882172295"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 68ce2f06efd4c9639aadce9f9d7fb096.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: DUS51-P2
x-amz-cf-id: iGe1X1IcU2aYzaLbZEKv-KCJXh4yncDvqDEWzi7CERadORcRus9UHw==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 11ms
11ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1507751896&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&dp=%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed&ul=en-us&de=UTF-8&dt=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=ContentGate&ea=meter&el=10&_u=aGDAiEAjBAAAAE~&jid=&gjid=&cid=807543790.1647485687&tid=UA-219761-28&_gid=95126325.1647485687&gtm=2wg3e05DXTZXR&cd1=Tom%20Tovar&cd2=Amazon%20CloudFront&cd5=Free&cd8=22&cd9=20200804&cd10=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&cd12=Payment%20fraud&cd14=483&cd15=OpinionArticle&cd17=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&z=582925756

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Mar 2022 04:04:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 82202
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 12ms
12ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1507751896&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&dp=%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed&ul=en-us&de=UTF-8&dt=New%20bot%20malware%20leaves%20financial%20apps%20dangerously%20exposed%20%7C%20PaymentsSource%20%7C%20American%20Banker&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=ContentGate&ea=meter&el=10&_u=aGDAiEAjBAAAAE~&jid=&gjid=&cid=807543790.1647485687&tid=UA-219761-100&_gid=95126325.1647485687&gtm=2wg3e05DXTZXR&cd1=Tom%20Tovar&cd2=Amazon%20CloudFront&cd5=Free&cd8=22&cd9=20200804&cd10=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&cd12=Payment%20fraud&cd14=483&cd15=OpinionArticle&cd17=Payment%20fraud%2CMalware%2CSecurity%20risk%2CPayment%20processing%2CMobile%20payments%2CPSO%20content&z=1323434823

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 16 Mar 2022 04:04:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 82202
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 323 B
560 B 145ms
35ms XHR
application/json 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=11046&slot=%7Bid:googleAd6e2e22d3-e4f3-4357-b88c-15ffea3acd5a,ss:%5B970.91,970.90,970.250,728.90,320.50,300.250%5D,p:/16059533/AmericanBanker/Payments/Opinion,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=669e5485-0036-f894-f52f-4b8d7825b5b8&url=https%253A%252F%252Fwww.americanbanker.com%252Fpayments%252Fopinion%252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%253Futm_campaign%253D2021%252520Nov%252520Outreach%252520APJ%252520banking%2526utm_medium%253Demail%2526_hsmi%253D182937943%2526_hsenc%253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%2526utm_content%253D182937943%2526utm_source%253Dhs_email
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 8cd82b9ac21645fbf6d67a30ff6461227664ea71b83108d3c37a382aae02721c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
x-server-name: app10.ie.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 323 B
562 B 138ms
34ms XHR
application/json 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=11046&slot=%7Bid:googleAd311b2a04-4df2-4e1a-8366-3abfd60ce68f,ss:%5B1.1%5D,p:/16059533/AmericanBanker/Payments/Opinion,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=669e5485-0036-f894-f52f-4b8d7825b5b8&url=https%253A%252F%252Fwww.americanbanker.com%252Fpayments%252Fopinion%252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%253Futm_campaign%253D2021%252520Nov%252520Outreach%252520APJ%252520banking%2526utm_medium%253Demail%2526_hsmi%253D182937943%2526_hsenc%253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%2526utm_content%253D182937943%2526utm_source%253Dhs_email
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0afbf3e3889e23615b945ecd1920c1725f6f61d8563799f866f3ba2d1738c56a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
x-server-name: app06.ie.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H/1.1 200
OK sp1.html Show response
cdn.cxense.com/ Frame 3B6C 684 B
749 B 10ms
10ms Document
text/html 2a02:26f0:6c00:2bf::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/sp1.html
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2bf::268b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 535be4b8bedf82433d210152dfb19dd4eaf5796c4e61c2be1c2ed356827b5580

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

Accept-Ranges: bytes
Last-Modified: Tue, 11 Jan 2022 07:21:04 GMT
Server: AkamaiNetStorage
Content-Length: 379
Cache-Control: max-age=864000
Expires: Sun, 27 Mar 2022 02:54:47 GMT
Date: Thu, 17 Mar 2022 02:54:47 GMT
Connection: keep-alive
Content-Type: text/html
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Vary: Accept-Encoding

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 996B 0
15 B 9ms
8ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://www.americanbanker.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.americanbanker.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=0
date: Thu, 17 Mar 2022 02:54:47 GMT

GET
H3 200 template.bundle.1.0.css
buy.tinypass.com/widget/dist/template/css/ Frame E6F8 33 KB
6 KB 23ms
22ms Stylesheet
text/css 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/widget/dist/template/css/template.bundle.1.0.css

Requested by

Host: buy.tinypass.com
URL: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

734421d9e2fa5fe78c7bbd157c8de6a60bd1e0752c8abfcd2ca27f4a477ff2e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: accept-encoding
cf-cache-status: HIT
age: 0
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
wn: prod-dash-10-0-113-163
last-modified: Tue, 15 Mar 2022 13:11:20 GMT
server: cloudflare
etag: W/"33843-1647349880000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: text/css
server-time: 0.001
cache-control: public, max-age=7200
cf-ray: 6ed272298a2d9b52-FRA
expires: Thu, 17 Mar 2022 04:54:47 GMT

GET
H3 200 loadTranslationMap Show response
buy.tinypass.com/showtemplate/general/ Frame E6F8 34 KB
7 KB 369ms
368ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/showtemplate/general/loadTranslationMap?aid=XUnXNMUrFF&version=1619704701000&language=en_US

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec70cfb1ce0aed65c10ebc00451fef58c830dbe4c02db1ba4115e7e3442c3c80

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: accept-encoding
cf-cache-status: DYNAMIC
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Cb3cv8rnV3t
pragma
wn: prod-dash-10-0-128-151
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript;charset=UTF-8
server-time: 0.001
cache-control: public, max-age=86400, s-maxage=86400
cf-ray: 6ed272298a2e9b52-FRA
expires: Thu, 17 Mar 2022 22:54:47 EDT

GET
H3 200 platform-translation-map_en_US.js Show response
buy.tinypass.com/ng/common/i18n/ Frame E6F8 60 KB
12 KB 26ms
25ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/ng/common/i18n/platform-translation-map_en_US.js?version=14.105.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ad17f3e4887e34b70f3ce18b89ab672b2f4d5db65237e58d704055fdc80d54c

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 72009
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
wn: prod-dash-10-0-132-157
last-modified: Tue, 15 Mar 2022 13:11:20 GMT
server: cloudflare
etag: W/"61519-1647349880000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript;charset=UTF-8
server-time: 0.000
cache-control: public, max-age=86400
cf-ray: 6ed272298a329b52-FRA
expires: Fri, 18 Mar 2022 02:54:47 GMT

GET
H3 200 H4sIAAAAAAAAAD3IwQ6AIAgA0B9KmJ76m4bJHI6oBa7f7-bt7eEnrXNgEw8Mvh6lYBy-DHVaU95QpTqS9an0pgwFSkHJu63T-yTlgy1Nh-E_BjVxNVoAAAA Show response
buy.tinypass.com/_sam/ Frame E6F8 520 KB
156 KB 37ms
36ms Script
text/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/_sam/H4sIAAAAAAAAAD3IwQ6AIAgA0B9KmJ76m4bJHI6oBa7f7-bt7eEnrXNgEw8Mvh6lYBy-DHVaU95QpTqS9an0pgwFSkHJu63T-yTlgy1Nh-E_BjVxNVoAAAA?compressed=true&v=14.105.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

978533e747c483e61d642a67d62c1319a217d2ce8ec65a68f193f9ccfa801a61

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 3591
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
wn: prod-dash-10-200-15-42
last-modified: Tue, 15 Mar 2022 13:11:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: text/javascript
server-time: 0.006
cache-control: public, max-age=601209
x-optimized-by: _sam
cf-ray: 6ed272298a339b52-FRA
expires: Thu, 24 Mar 2022 01:54:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame E6F8 5 KB
532 B 35ms
20ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

441e0467656e99238bd0547e5bdaac626664183d1f53903117e83dbfb2a45a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Mar 2022 02:00:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Mar 2022 02:54:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Mar 2022 02:54:47 GMT

GET
H2 200 americanbanker3x.png
images.newsletters.arizent.com/nudges/content/d688c78356fc42cc21b6aa7da6be4a8d/8859f8ce/images/ Frame E6F8 8 KB
9 KB 173ms
7ms Image
image/png 2600:9000:2250:1000:8:2b19:8600:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.newsletters.arizent.com/nudges/content/d688c78356fc42cc21b6aa7da6be4a8d/8859f8ce/images/americanbanker3x.png
Requested by: Host: buy.tinypass.com
URL: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTMYWL61R4SU&offerId=fakeOfferId&experienceId=EX1EAFJ3ZC4Z&iframeId=offer_9d888d9cc21fae34cad6-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:1000:8:2b19:8600:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1f2b6c5613e703f11e27309ad9e7115cabb98e70acb07b7417a3e68b6e083e24

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sun, 13 Mar 2022 09:16:01 GMT
via: 1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront)
last-modified: Mon, 03 Jun 2019 20:35:59 GMT
server: AmazonS3
age: 322727
etag: "19d4923e2aa582a437a134b96bfaf2e3"
x-cache: Hit from cloudfront
x-amz-version-id: null
cache-control: max-age=1296000
x-amz-cf-pop: FRA60-P2
accept-ranges: bytes
content-type: image/png
content-length: 8610
x-amz-cf-id: T49iSMPxSSprwS7kP_j7VvuemjEaYPNygpBTdA2zLBAoyPX1UkPMjA==

GET
H2

200

/ Show response
a2.adform.net/Serving/TrackPoint/
Redirect Chain

https://a2.adform.net/Serving/TrackPoint/?pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6IlJFVk...
https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6I...

2 KB
2 KB

89ms
89ms

Script
text/javascript

185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&loc=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-e

Requested by

Protocol

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

db46c5afd69f15b4408681f3f03ce5c4a3971d880f23b6b900b672430c7cb93b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 1573
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
location: https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&loc=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-e
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: text/html; charset=utf-8
expires: -1

GET
H/1.1 200
OK cx.js Show response
cdn.cxense.com/ Frame 3B6C 64 KB
22 KB 11ms
11ms Script
application/x-javascript 2a02:26f0:6c00:2bf::268b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.cxense.com/cx.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2bf::268b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 36aa85b5d97f76a381de07cdcc8f2bdecf7462384f8207f8a54d6aae1a40e4f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.cxense.com/sp1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:47 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Feb 2022 13:47:07 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21887
Expires: Thu, 17 Mar 2022 03:54:47 GMT

GET
H2 200 / Show response
settings.luckyorange.net/ 3 KB
2 KB 170ms
132ms Fetch
application/json 104.26.11.16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://settings.luckyorange.net/?u=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&s=80018

Requested by

Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.11.16 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c88d578e25dbe2172403b1059bce6e5c80a308409f6446b433acc32505451c9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://www.americanbanker.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e8u0gxuJ0%2B7y6ohyAGTaq%2FFDH3H0x02lSlrJI%2FfHU3Z%2BSlOYtvzV8myufvCJdHpIysyf8PRuy6araS%2BZP0IAnaCSx0pS7DRkNTAvV3QyzYjpQsm5zi5RDcG3hJlgk%2BkcWcfB3vsgza1Hsw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 6ed27229cfd19bbc-FRA
access-control-allow-headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,X-Requested-With,If-Modified-Since

GET
H2 200 teads-format.min.js Show response
a.teads.tv/media/format/v3/ 600 KB
132 KB 8ms
8ms Script
text/javascript 184.30.21.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/page/71453/tag
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-51.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2b6a7289f2e184fc952db4d52a3e4167ae036b45296c178dbc139d0fa03cd32b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
last-modified: Wed, 16 Mar 2022 15:06:10 GMT
x-amz-request-id: G7D20W4P05EHKGH8
etag: "526cb8f3b5ee4872b77b009264950e46"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: private, must-revalidate, max-age=1800, no-transform
x-bucket: 4
accept-ranges: bytes
content-length: 134138
x-amz-id-2: Jp+Nx597hAi7mF6vA6H/eXhPYH3rBLml739SInGeqQ5tr6T4xe2EOVvVdI1VGnFDi/2Lkc1SChk=
expires: Thu, 17 Mar 2022 03:24:47 GMT

GET
H/1.1 200
OK p1.js Show response
p1cluster.cxense.com/ Frame 3B6C 47 B
638 B 61ms
13ms Script
text/javascript 147.75.83.64
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://p1cluster.cxense.com/p1.js
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.75.83.64 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: Jetty(9.4.28.v20200408) /
Resource Hash: 56662b5f7b2eec1a8a93958ecf81ad47fe8003e4b124525e038724d30033a62d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.cxense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
last-modified: Fri, 17 Sep 2021 02:54:47 GMT
server: Jetty(9.4.28.v20200408)
etag: 1ll1929vjw5r41fu79nvbx1pin
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: private, proxy-revalidate
content-type: text/javascript;charset=utf-8
content-length: 47
expires: Fri, 17 Mar 2023 02:54:47 GMT

GET
H2 200 track
t.teads.tv/ 23 B
113 B 79ms
36ms Image
image/gif 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=placementCall&env=js-web&auctid=09ae3d58-26b1-c41d-50d6-f36d1131ebf8&pageId=71453&pid=77226&debug_metadata=pVx0R7P048&fv=1015&ts=1647485687505&f=1&referer=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
cache-control: private, max-age=3666
content-length: 23
content-type: image/gif

GET
H2 200 track
t.teads.tv/ 23 B
143 B 81ms
38ms Image
image/gif 2.18.232.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=slotAvailable&env=js-web&auctid=09ae3d58-26b1-c41d-50d6-f36d1131ebf8&pageId=71453&pid=77226&slot=native&fv=1015&ts=1647485687515&f=1&referer=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.7 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 23
content-type: image/gif

GET
H2 200 ad Show response
a.teads.tv/page/71453/ 538 B
576 B 42ms
41ms XHR
application/json 184.30.21.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/71453/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&page=%7B%22id%22%3A71453%2C%22placements%22%3A%5B%7B%22id%22%3A77226%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A740%2C%22height%22%3A416%7D%2C%22slotType%22%3A%22native%22%7D%5D%2C%22gdpr_iab%22%3A%7B%22reason%22%3A220%2C%22status%22%3A22%2C%22consent%22%3A%22%22%2C%22apiVersion%22%3Anull%2C%22cmpId%22%3Anull%7D%2C%22segments%22%3A%7B%22permutive%22%3Anull%7D%2C%22first_party_data%22%3A%7B%22firstPartyCookieTeadsId%22%3Anull%2C%22sharedIds%22%3Anull%7D%7D&auctid=09ae3d58-26b1-c41d-50d6-f36d1131ebf8&formatVersion=1015&env=js-web&netBw=9.5&ttfb=316
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-51.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f9c321ffecd862a4a612a0077f84684747caefc667833f8e46e49ec71e5ba27e

Request headers

Accept: application/json; charset=UTF-8
Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.americanbanker.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 364
expires: Thu, 17 Mar 2022 02:54:47 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 40ms
16ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.americanbanker.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 41ms
16ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.americanbanker.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 428 B
262 B 70ms
55ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4471228820821541&correlator=2687979048421211&eid=31064905%2C31065631%2C31065652%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031401&ptt=17&impl=fif&sc=1&iu_parts=16059533%2CAmericanBanker%2CPayments%2COpinion&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=1&adks=3789931964&sfv=1-0-38&ecs=20220317&fsapi=false&prev_scp=pos%3Dnative-in-article1%26id%3D9b2cb672-a59d-11ec-b132-0a55872b6571%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70&eri=1&cust_params=topics%3Dpayment-methods%252Ccrime-and-misconduct%252Crisk%252Cpayment-fraud%252Cmobile-payments%252Cfraud%252Cpayments%252Cmalware%252Ccyber-attacks%252Cpayment-processing%252Csecurity-risk%252Claw-and-regulation%26storyID%3D00000173-a657-db46-af77-e6f7ce850001%26PID%3Dnull%26ZetaSegments%3Dnull%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow%26ias-kw%3D&cookie_enabled=1&abxe=1&dt=1647485687546&lmt=1647485687&dlt=1647485685340&idt=1289&biw=1600&bih=1200&adxs=293&adys=961&oid=2&ucis=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&frm=20&vis=1&scr_x=0&scr_y=0&psz=730x0&msz=730x0&fws=4&ohw=1600&ga_vid=807543790.1647485687&ga_sid=1647485688&ga_hid=1507751896&ga_fc=true&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

e3a56eb3953b87a7a04bc2930a7439066fc3130c5e3f9235125cd589efc11366

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 233
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7996 6 KB
4 KB 91ms
21ms Document
text/html 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 17 Mar 2022 02:54:47 GMT
expires: Fri, 17 Mar 2023 02:54:47 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
12 KB 756ms
756ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4471228820821541&correlator=2687979048421211&eid=31064905%2C31065631%2C31065652%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031401&ptt=17&impl=fif&sc=1&iu_parts=16059533%2CAmericanBanker%2CPayments%2COpinion&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x250%7C970x90%7C970x91&ifi=2&adks=2661004028&sfv=1-0-38&ecs=20220317&fsapi=false&prev_scp=pos%3Dcollapsed_header1%26id%3D9b2cde55-a59d-11ec-a029-0231bf2059f1%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70&eri=1&cust_params=topics%3Dpayment-methods%252Ccrime-and-misconduct%252Crisk%252Cpayment-fraud%252Cmobile-payments%252Cfraud%252Cpayments%252Cmalware%252Ccyber-attacks%252Cpayment-processing%252Csecurity-risk%252Claw-and-regulation%26storyID%3D00000173-a657-db46-af77-e6f7ce850001%26PID%3Dnull%26ZetaSegments%3Dnull%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow%26ias-kw%3D&cookie_enabled=1&abxe=1&dt=1647485687577&lmt=1647485687&dlt=1647485685340&idt=1289&biw=1600&bih=1200&adxs=436&adys=143&oid=2&ucis=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x80&msz=728x40&fws=4&ohw=1600&ga_vid=807543790.1647485687&ga_sid=1647485688&ga_hid=1507751896&ga_fc=true&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

740c2605af4c5bd694afeadf6d4477011db75ee6685135505e9715482659376c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12604
x-xss-protection: 0
google-lineitem-id: 5878184535
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138383166747
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 323 B
561 B 35ms
35ms XHR
application/json 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=11046&slot=%7Bid:googleAd2e0e4e6b-ed21-4dad-b7ac-2132e7e83ae9,ss:%5B300.250,300.600,300.1050%5D,p:/16059533/AmericanBanker/Payments/Opinion,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=669e5485-0036-f894-f52f-4b8d7825b5b8&url=https%253A%252F%252Fwww.americanbanker.com%252Fpayments%252Fopinion%252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%253Futm_campaign%253D2021%252520Nov%252520Outreach%252520APJ%252520banking%2526utm_medium%253Demail%2526_hsmi%253D182937943%2526_hsenc%253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%2526utm_content%253D182937943%2526utm_source%253Dhs_email
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1b1a289c9e167bd1732c08fc6fdb8b6a169e6fad92f5bbcb44aea5c40fc4f93f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
x-server-name: app04.ie.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 323 B
561 B 34ms
34ms XHR
application/json 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=11046&slot=%7Bid:googleAdff977787-dc9a-44bb-9601-05b3ba59fe68,ss:%5B300.250,300.600%5D,p:/16059533/AmericanBanker/Payments/Opinion,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=669e5485-0036-f894-f52f-4b8d7825b5b8&url=https%253A%252F%252Fwww.americanbanker.com%252Fpayments%252Fopinion%252Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%253Futm_campaign%253D2021%252520Nov%252520Outreach%252520APJ%252520banking%2526utm_medium%253Demail%2526_hsmi%253D182937943%2526_hsenc%253Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%2526utm_content%253D182937943%2526utm_source%253Dhs_email
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5d5c53dad11c0e74196616d7e2afe2ade42ff6e4084cae1a977b4e741359e6b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
x-server-name: app07.ie.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H/1.1 200
OK rep.gif
comcluster.cxense.com/Repo/ Frame 3B6C 43 B
468 B 43ms
16ms Image
image/gif 147.75.83.64
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://comcluster.cxense.com/Repo/rep.gif?ver=2.3.1&typ=pgv&rnd=l0uefvlpvpkkoph8&sid=1141965811121236457&loc=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&new=1&arf=0&ltm=1647485687080&ref=&tzo=0&wsz=1600x1200&res=1600x1200&dpr=1&col=24&bln=en-US&chs=UTF-8&cks=l0uefw2zyaoq89dj&ckp=l0uefvll11ndl4ck&glb=&amo=1596513725.529&cp_userState=anon&cst=1ll1929vjw5r41fu79nvbx1pin
Requested by: Host: cdn.cxense.com
URL: https://cdn.cxense.com/sp1.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 147.75.83.64 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: Jetty(9.4.28.v20200408) /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.cxense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: Jetty(9.4.28.v20200408)
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

index.php Show response
a.dpmsrv.com/dpmpxl/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=1358138099726111045&pixelIndex=0&_=1647485686767
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1358138099726111045&pixelIndex=0&_=1647485686767&google_gid=CAESEF2pTgrCRnNzuPMqowwn3Ec&google_cver=1

0
598 B

94ms
93ms

Script
text/javascript

35.172.177.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1358138099726111045&pixelIndex=0&_=1647485686767&google_gid=CAESEF2pTgrCRnNzuPMqowwn3Ec&google_cver=1
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Server: 35.172.177.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-177-82.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 0
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=1358138099726111045&pixelIndex=0&_=1647485686767&google_gid=CAESEF2pTgrCRnNzuPMqowwn3Ec&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 368
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 423396.gif
idsync.rlcdn.com/ 0
66 B 39ms
15ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/423396.gif?partner_uid=1358138099726111045
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 44 KB
11 KB 1352ms
1351ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4471228820821541&correlator=2687979048421211&eid=31064905%2C31065631%2C31065652%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031401&ptt=17&impl=fif&sc=1&iu_parts=16059533%2CAmericanBanker%2CPayments%2COpinion&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250%7C300x600%7C300x1050&ifi=3&adks=756787797&sfv=1-0-38&ecs=20220317&fsapi=false&prev_scp=pos%3Dbigbox1%26id%3D9b445d31-a59d-11ec-8ffa-061b2abdf756%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70&eri=1&cust_params=topics%3Dpayment-methods%252Ccrime-and-misconduct%252Crisk%252Cpayment-fraud%252Cmobile-payments%252Cfraud%252Cpayments%252Cmalware%252Ccyber-attacks%252Cpayment-processing%252Csecurity-risk%252Claw-and-regulation%26storyID%3D00000173-a657-db46-af77-e6f7ce850001%26PID%3Dnull%26ZetaSegments%3Dnull%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow%26ias-kw%3D&cookie=ID%3Ddf47ba069fe8b824%3AT%3D1647485687%3AS%3DALNI_MZD63HrSvVAXjl0yZWjQ_bRkEt2-A&abxe=1&dt=1647485687653&lmt=1647485687&dlt=1647485685340&idt=1289&biw=1600&bih=1200&adxs=1070&adys=224&oid=2&ucis=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&frm=20&vis=1&scr_x=0&scr_y=0&psz=301x1169&msz=301x290&fws=516&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=807543790.1647485687&ga_sid=1647485688&ga_hid=1507751896&ga_fc=true&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

ab171d3ce3f3d4deaab4717fddd7b5472ea04d8aefa77bc5934e71e7c39cd28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11124
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
12 KB 1455ms
1455ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4471228820821541&correlator=2687979048421211&eid=31064905%2C31065631%2C31065652%2C31063246&output=ldjh&gdfp_req=1&vrg=2022031401&ptt=17&impl=fif&sc=1&iu_parts=16059533%2CAmericanBanker%2CPayments%2COpinion&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250%7C300x600&ifi=4&adks=1072162708&sfv=1-0-38&ecs=20220317&fsapi=false&prev_scp=pos%3Dbigbox2%26id%3D9b44abdd-a59d-11ec-8155-02caf40e7d43%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70&eri=1&cust_params=topics%3Dpayment-methods%252Ccrime-and-misconduct%252Crisk%252Cpayment-fraud%252Cmobile-payments%252Cfraud%252Cpayments%252Cmalware%252Ccyber-attacks%252Cpayment-processing%252Csecurity-risk%252Claw-and-regulation%26storyID%3D00000173-a657-db46-af77-e6f7ce850001%26PID%3Dnull%26ZetaSegments%3Dnull%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow%26ias-kw%3D&cookie=ID%3Ddf47ba069fe8b824%3AT%3D1647485687%3AS%3DALNI_MZD63HrSvVAXjl0yZWjQ_bRkEt2-A&abxe=1&dt=1647485687664&lmt=1647485687&dlt=1647485685340&idt=1289&biw=1600&bih=1200&adxs=1070&adys=514&oid=2&ucis=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&frm=20&vis=1&scr_x=0&scr_y=0&psz=301x1419&msz=301x290&fws=516&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=807543790.1647485687&ga_sid=1647485688&ga_hid=1507751896&ga_fc=true&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

91faea346778821b9c435f9fbb67d14e8de887cc3e34fbe2e0d8e028ff946c21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12535
x-xss-protection: 0
google-lineitem-id: 4790764721
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138328581479
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.americanbanker.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lo.js Show response
d20519brkbo4nz.cloudfront.net/core/ 11 KB
5 KB 38ms
13ms Script
application/javascript 2600:9000:2490:8200:18:6c16:27c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d20519brkbo4nz.cloudfront.net/core/lo.js
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:8200:18:6c16:27c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b0dd2994a679ea0b4cfdb57f490a602ceaed5d9ccc9d440e19f03392eff06bd5

Request headers

Referer: https://www.americanbanker.com/
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
age: 2037
x-cache: Hit from cloudfront
content-length: 4235
access-control-allow-origin: *
last-modified: Mon, 14 Mar 2022 17:53:06 GMT
server: AmazonS3
etag: "1e2d9e872323cc09f9b4bb9909b21712"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: application/javascript
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA56-P6
accept-ranges: bytes
x-amz-cf-id: fwYeokn1NZZFo3VbzHLubpYqczVCDvTTG32auWLTfP3CVb7ekkDrzw==

GET
H2 200 clickstream.js Show response
d10lpsik1i8c69.cloudfront.net/js/ Frame 18ED 287 KB
93 KB 31ms
10ms Script
application/javascript 108.156.253.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/js/clickstream.js?v=ce8f9a1
Requested by: Host: d10lpsik1i8c69.cloudfront.net
URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.253.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-253-115.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8

Request headers

Referer
Origin: https://www.americanbanker.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 01 Mar 2022 23:02:40 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 1309928
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 01 Mar 2022 22:59:52 GMT
server: AmazonS3
etag: W/"16e967413dfa0346be281513c77581b9"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-P2
x-amz-cf-id: TOZBi4xwtzB9p0iMOV44oBl2K1HvBXC2_P3KGO6Xrn35R_7bvykXcA==

GET
H/1.1 200
OK id Show response
id.cxense.com/public/user/ 117 B
690 B 46ms
17ms Script
text/javascript 147.75.83.64
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://id.cxense.com/public/user/id?json=%7B%22identities%22%3A%5B%7B%22type%22%3A%22ckp%22%2C%22id%22%3A%22l0uefvll11ndl4ck%22%7D%2C%7B%22type%22%3A%22lst%22%2C%22id%22%3A%221ll1929vjw5r41fu79nvbx1pin%22%7D%2C%7B%22type%22%3A%22cst%22%2C%22id%22%3A%221ll1929vjw5r41fu79nvbx1pin%22%7D%5D%2C%22siteId%22%3A%221141965811121236457%22%2C%22location%22%3A%22https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email%22%7D&callback=cXJsonpCBl0uefwcd3s94igm5

Requested by

Host: cdn.cxense.com
URL: https://cdn.cxense.com/cx.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

147.75.83.64 Schiphol, Netherlands, ASN54825 (PACKET, US),

Reverse DNS

Software

Jetty(9.4.28.v20200408) /

Resource Hash

e4f9a623a34f667704e0ab94a2ccdaa2d7dc53459f9b0eece212e1b4304ac4f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
x-content-type-options: nosniff
server: Jetty(9.4.28.v20200408)
p3p: policyref="http://www.cxense.com/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-store, no-cache, must-revalidate
content-type: text/javascript;charset=utf-8
content-length: 117
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 / Show response
a2.adform.net/serving/container/ Frame C6D2 2 KB
1 KB 90ms
87ms Document
text/html 185.167.164.39
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a2.adform.net/serving/container/?pm=1662401&lid=56730269&ctype=0&media=0&PageName=American_Banker+Universal+Tag&orderid=UNIQUE_ORDER_ID&sysvars=%7corderid%3dUNIQUE_ORDER_ID%7c%7c%7c%40%40%7cpid%3dOFFER_ID%7cpnm%3dProductRatePlanName%7c&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&rnd=1860967004&cpref=&loc=https%3a%2f%2fwww.americanbanker.com%2fpayments%2fopinion%2fnew-bot-malware-leaves-financial-apps-dangerously-e

Requested by

Host: a2.adform.net
URL: https://a2.adform.net/serving/scripts/trackpoint/async/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.39 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e00cc6be2a728baaffc1e716b1cfceb1d42c88a76d2a655cf99267983f2794de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

server: nginx
date: Thu, 17 Mar 2022 02:54:47 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
content-encoding: gzip
expires: -1
vary: Accept-Encoding
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pixels Show response
c1.adform.net/imatch/ Frame 940E 5 KB
2 KB 69ms
19ms Document
text/html 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Requested by

Host: a2.adform.net
URL: https://a2.adform.net/Serving/TrackPoint/?pm=1662401&ADFPageName=American_Banker%20Universal%20Tag&ADFdivider=%7C&ord=239019510562&Set1=en-US%7Cen-US%7C1600x1200%7C24&ADFtpmode=2&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&loc=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

87237e67bda762f962161472cb82dda223c80fd8d4a8231d1eb0dde2c099591e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

server: nginx
date: Thu, 17 Mar 2022 02:54:47 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2 200 /
a1.seadform.net/serving/cookie/sync/ 35 B
344 B 95ms
16ms Image
image/gif 37.157.3.29
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a1.seadform.net/serving/cookie/sync/?uid=8263666895936391270&stamp=sc2_9UZDXtIDvP-67D9Y4w2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.3.29 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Mar 2022 02:54:47 GMT
cache-control: private
server: nginx
content-type: image/gif
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"

GET
H3 200 80018 Show response
settings.luckyorange.com/ 165 B
181 B 125ms
116ms Fetch
application/json 34.107.203.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://settings.luckyorange.com/80018
Requested by: Host: d20519brkbo4nz.cloudfront.net
URL: https://d20519brkbo4nz.cloudfront.net/core/lo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.203.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.203.107.34.bc.googleusercontent.com
Software: /
Resource Hash: 548cadb46f2b92d88090b94a52ee774cb37ac9be4e169afc7cb8a34b4cb047b5

Request headers

Referer: https://www.americanbanker.com/
Accept-Language: de-DE,de;q=0.9
x-lucky-uid: undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.americanbanker.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 165

OPTIONS
H2 200 80018
settings.luckyorange.com/ Frame 0
0 141ms
116ms Preflight 34.107.203.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://settings.luckyorange.com/80018
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.203.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.203.107.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-lucky-uid
Origin: https://www.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://www.americanbanker.com
access-control-allow-credentials: true
access-control-allow-methods: POST,GET,PUT,PATCH,DELETE,OPTIONS
access-control-allow-headers: Access-Control-Allow-Origin,Authorization,Content-Type,X-Lucky-Uid,X-Lucky-Site-Id,X-Lucky-Impersonate,X-Lucky-Session-Id
access-control-max-age: 86400
date: Thu, 17 Mar 2022 02:54:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 template.bundle.1.0.css
buy.tinypass.com/widget/dist/template/css/ Frame 17E0 33 KB
6 KB 26ms
25ms Stylesheet
text/css 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/widget/dist/template/css/template.bundle.1.0.css

Requested by

Host: buy.tinypass.com
URL: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

734421d9e2fa5fe78c7bbd157c8de6a60bd1e0752c8abfcd2ca27f4a477ff2e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: accept-encoding
cf-cache-status: HIT
age: 0
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
wn: prod-dash-10-0-113-163
last-modified: Tue, 15 Mar 2022 13:11:20 GMT
server: cloudflare
etag: W/"33843-1647349880000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: text/css
server-time: 0.001
cache-control: public, max-age=7200
cf-ray: 6ed2722bac499b52-FRA
expires: Thu, 17 Mar 2022 04:54:47 GMT

GET
H3 200 loadTranslationMap Show response
buy.tinypass.com/showtemplate/general/ Frame 17E0 34 KB
7 KB 427ms
427ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/showtemplate/general/loadTranslationMap?aid=XUnXNMUrFF&version=1619704701000&language=en_US

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec70cfb1ce0aed65c10ebc00451fef58c830dbe4c02db1ba4115e7e3442c3c80

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
content-encoding: br
vary: accept-encoding
cf-cache-status: DYNAMIC
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: Cb3cv8roOGg
pragma
wn: prod-dash-10-0-128-151
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript;charset=UTF-8
server-time: 0.002
cache-control: public, max-age=86400, s-maxage=86400
cf-ray: 6ed2722bac4a9b52-FRA
expires: Thu, 17 Mar 2022 22:54:47 EDT

GET
H3 200 platform-translation-map_en_US.js Show response
buy.tinypass.com/ng/common/i18n/ Frame 17E0 60 KB
12 KB 22ms
21ms Script
application/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/ng/common/i18n/platform-translation-map_en_US.js?version=14.105.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ad17f3e4887e34b70f3ce18b89ab672b2f4d5db65237e58d704055fdc80d54c

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 72009
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
wn: prod-dash-10-0-132-157
last-modified: Tue, 15 Mar 2022 13:11:20 GMT
server: cloudflare
etag: W/"61519-1647349880000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: application/javascript;charset=UTF-8
server-time: 0.000
cache-control: public, max-age=86400
cf-ray: 6ed2722bac4b9b52-FRA
expires: Fri, 18 Mar 2022 02:54:47 GMT

GET
H3 200 H4sIAAAAAAAAAD3IwQ6AIAgA0B9KmJ76m4bJHI6oBa7f7-bt7eEnrXNgEw8Mvh6lYBy-DHVaU95QpTqS9an0pgwFSkHJu63T-yTlgy1Nh-E_BjVxNVoAAAA Show response
buy.tinypass.com/_sam/ Frame 17E0 520 KB
156 KB 34ms
34ms Script
text/javascript 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://buy.tinypass.com/_sam/H4sIAAAAAAAAAD3IwQ6AIAgA0B9KmJ76m4bJHI6oBa7f7-bt7eEnrXNgEw8Mvh6lYBy-DHVaU95QpTqS9an0pgwFSkHJu63T-yTlgy1Nh-E_BjVxNVoAAAA?compressed=true&v=14.105.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

978533e747c483e61d642a67d62c1319a217d2ce8ec65a68f193f9ccfa801a61

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/checkout/template/cacheableShow?aid=XUnXNMUrFF&templateId=OTM0U4BIB1JD&offerId=fakeOfferId&experienceId=EX9WXA052CE3&iframeId=offer_227430ab9451740ca479-0&displayMode=inline&pianoIdUrl=https%3A%2F%2Fid.tinypass.com%2Fid%2F&widget=template&url=https%3A%2F%2Fwww.americanbanker.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 3591
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
wn: prod-dash-10-200-15-42
last-modified: Tue, 15 Mar 2022 13:11:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: text/javascript
server-time: 0.006
cache-control: public, max-age=601209
x-optimized-by: _sam
cf-ray: 6ed2722bac4c9b52-FRA
expires: Thu, 24 Mar 2022 01:54:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 17E0 5 KB
532 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

441e0467656e99238bd0547e5bdaac626664183d1f53903117e83dbfb2a45a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 17 Mar 2022 02:54:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 17 Mar 2022 02:54:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 17 Mar 2022 02:54:47 GMT

GET
H2 200 plf
c1.adform.net/imatch/ Frame 940E 0
261 B 20ms
19ms Image
text/plain 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plff

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 940E
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=42&external_user_id=8263666895936391270&Expiration=1648695287
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=8263666895936391270&Expiration=1648695287

43 B
424 B

31ms
31ms

Image
image/gif

54.76.102.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=8263666895936391270&Expiration=1648695287
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Server: 54.76.102.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-102-147.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 17 Mar 2022 02:54:47 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=42&external_user_id=8263666895936391270&Expiration=1648695287
date: Thu, 17 Mar 2022 02:54:47 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 204
No Content m
ad.yieldlab.net/ Frame 940E 0
522 B 55ms
16ms Image
text/plain 104.111.218.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.yieldlab.net/m?dt_id=4879&ext_id=8263666895936391270

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.218.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-218-85.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
x-content-type-options: nosniff
x-frame-options: DENY
Cache-Control: no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection: keep-alive
x-xss-protection: 1; mode=block
x-application-context: application
Expires: Wed, 16 Mar 2022 02:54:47 GMT

GET
H/1.1 204
No Content token
token.rubiconproject.com/ Frame 940E 0
214 B 42ms
7ms Image
text/plain 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=5253&puid=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 940E
Redirect Chain

https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=8263666895936391270&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__
https://ih.adscale.de/adscale-ih/tpui?tpid=42&tpuid=8263666895936391270&cburl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d9%26uid%3D__ADSCALE_USER_ID__&nut&uu=791566c0a74641bdb...
https://c1.adform.net/serving/cookie/match?party=9&uid=53d557fa7943d9fdeccf2c04fa88411ec297001bf4c1f3fb3a9e0f63e5dceed7

35 B
468 B

20ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=9&uid=53d557fa7943d9fdeccf2c04fa88411ec297001bf4c1f3fb3a9e0f63e5dceed7

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

location: https://c1.adform.net/serving/cookie/match?party=9&uid=53d557fa7943d9fdeccf2c04fa88411ec297001bf4c1f3fb3a9e0f63e5dceed7
date: Thu, 17 Mar 2022 02:54:47 GMT
content-length: 0
p3p: CP=NOI PSA OUR

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 940E 43 B
163 B 71ms
16ms Image
image/gif 185.86.137.110
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=22&partneruserid=8263666895936391270&redirurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d10%26cid%3DSMART_USER_ID
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.110 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2

204

sync
ups.analytics.yahoo.com/ups/55944/ Frame 940E
Redirect Chain

https://pixel.advertising.com/ups/55944/sync?uid=8263666895936391270&_origin=1
https://pixel.advertising.com/ups/55944/sync?uid=8263666895936391270&_origin=1&verify=true
https://ups.analytics.yahoo.com/ups/55944/sync?uid=8263666895936391270&_origin=1&apid=UP9b6b6d79-a59d-11ec-a432-06bfa37d4102
https://ups.analytics.yahoo.com/ups/55944/sync?uid=8263666895936391270&_origin=1&apid=UP9b6b6d79-a59d-11ec-a432-06bfa37d4102&verify=true

0
122 B

11ms
11ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55944/sync?uid=8263666895936391270&_origin=1&apid=UP9b6b6d79-a59d-11ec-a432-06bfa37d4102&verify=true

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.0.33 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/55944/sync?uid=8263666895936391270&_origin=1&apid=UP9b6b6d79-a59d-11ec-a432-06bfa37d4102&verify=true
date: Thu, 17 Mar 2022 02:54:47 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK user-registering
ads.stickyadstv.com/ Frame 940E 43 B
713 B 124ms
16ms Image
image/gif 2.21.142.210
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=189&userId=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.142.210 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-142-210.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
Server: nginx
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
x-sticky-vk: 1647485687408034-576
Expires: Thu, 17 Mar 2022 02:54:47 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 940E
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=70&user_id=8263666895936391270
https://x.bidswitch.net/ul_cb/sync?dsp_id=70&user_id=8263666895936391270
https://eb2.3lift.com/xuid?mid=2409&xuid=d81120b2-13b5-491e-8547-1f50aae82e54&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
https://eb2.3lift.com/xuid?ld=1&mid=2409&xuid=d81120b2-13b5-491e-8547-1f50aae82e54&dongle=d3d3&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

9ms
9ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2409&xuid=d81120b2-13b5-491e-8547-1f50aae82e54&dongle=d3d3&gdpr=0&cmp_cs=&us_privacy=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2409&xuid=d81120b2-13b5-491e-8547-1f50aae82e54&dongle=d3d3&gdpr=0&cmp_cs=&us_privacy=
date: Thu, 17 Mar 2022 02:54:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 940E
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=8263666895936391270&expiration=1648695287
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=8263666895936391270&expiration=1648695287&C=1

43 B
1006 B

16ms
16ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=8263666895936391270&expiration=1648695287&C=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 17 Mar 2022 02:54:47 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=111&external_user_id=8263666895936391270&expiration=1648695287&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 309
Expires: Thu, 17 Mar 2022 02:54:47 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 940E
Redirect Chain

https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=8263666895936391270&sInitiator=external
https://uipglob.semasio.net/adform/1/info2?sType=sync&sExtCookieId=8263666895936391270&sInitiator=external
https://pixel.mathtag.com/sync/img?mt_exid=10041&gdpr=&gdpr_consent=&redir=https%3A%2F%2Fuipglob.semasio.net%2Fmediamath%2F1%2Finfo%3FsType%3Dsync%26sExtCookieId%3D[MM_UUID]%26sInitiator%3Dinternal
https://uipglob.semasio.net/mediamath/1/info?sType=sync&sExtCookieId=8e3d6232-a2f7-4100-8ac7-ffa37a5ad201&sInitiator=internal&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=1&gdpr_consent=&sInitiator=internal&sExtCookieId=f892a337-c834-4d10-863c-48e109458ab5
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=NTExQThCRkI1MEE4QkJBOQ&gdpr=1&gdpr_consent=

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=NTExQThCRkI1MEE4QkJBOQ&gdpr=1&gdpr_consent=

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
frontend-id: 5
location: https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=NTExQThCRkI1MEE4QkJBOQ&gdpr=1&gdpr_consent=
p3p: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin: *
uip-response-status: Ok
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
routing-server-id: -1
expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H/1.1 200
OK match
ps.eyeota.net/ Frame 940E 0
344 B 39ms
7ms Image
text/plain 18.184.216.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=8263666895936391270&bid=9gdtmu1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.184.216.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-216-10.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:47 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2

200

pixel.gif
load77.exelator.com/ Frame 940E
Redirect Chain

https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=8263666895936391270
https://loadm.exelator.com/load/?p=204&g=710&j=0&buid=8263666895936391270&xl8blockcheck=1
https://load77.exelator.com/pixel.gif

43 B
332 B

42ms
6ms

Image
image/gif

2a02:6ea0:c700::4
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://load77.exelator.com/pixel.gif
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Server: 2a02:6ea0:c700::4 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-77-nzt: AcO1rzUZpz7/HO8JAA
x-accel-expires: @1647871451
date: Thu, 17 Mar 2022 02:54:47 GMT
etag: "59f0c3fc-2b"
last-modified: Wed, 25 Oct 2017 17:03:56 GMT
server: CDN77-Turbo
x-77-nzt-ray: Q3pXxaaBiDU
x-77-cache: HIT
content-type: image/gif
access-control-allow-origin: *
x-cache: HIT
x-age: 651036
accept-ranges: bytes
x-77-pop: frankfurtDE
content-length: 43

Redirect headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://load77.exelator.com/pixel.gif
cache-control: no-cache
access-control-allow-credentials: true
content-type: image/gif
content-length: 0

GET
H2 400 398366.gif
idsync.rlcdn.com/ Frame 940E 0
0 24ms
18ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/398366.gif?partner_uid=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2

200

tpid=8263666895936391270
sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/ Frame 940E
Redirect Chain

https://sync.crwdcntrl.net/map/c=6466/tp=ADFM/tpid=8263666895936391270
https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=8263666895936391270

49 B
542 B

47ms
47ms

Image
image/gif

52.208.103.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Server: 52.208.103.128 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-208-103-128.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.9.19
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://sync.crwdcntrl.net/map/ct=y/c=6466/tp=ADFM/tpid=8263666895936391270
cache-control: no-cache
x-server: 10.45.21.200
content-length: 0
expires: 0

GET
H/1.1 200
OK 29729
tags.bluekai.com/site/ Frame 940E 62 B
304 B 224ms
174ms Image
image/gif 104.89.42.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/29729?id=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.42.102 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-42-102.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:48 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

GET
H2 200 sd
eu-u.openx.net/w/1.0/ Frame 940E 43 B
274 B 52ms
16ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.2.1 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
via: 1.1 google
server: OXGW/17.2.1
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

pixel.gif
s3-eu-west-1.amazonaws.com/adality-cdn-content/ Frame 940E
Redirect Chain

https://api.adrtx.net/thirdparty/click?p=adfo
https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif

35 B
390 B

142ms
39ms

Image
image/gif

52.218.108.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Server: 52.218.108.67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:49 GMT
Last-Modified: Thu, 29 Oct 2015 16:41:57 GMT
Server: AmazonS3
x-amz-request-id: HDY4B5ET9YRQYYVQ
ETag: "c2196de8ba412c60c22ab491af7b1409"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 35
x-amz-id-2: b5RIX0u/aYWNRhKRsvkmjn0QWI6LHbcO5+BkJ450Yni2LqydyMR3K70w5TriqyEELMW7XIjR2PM=

Redirect headers

X-Error-Reason: Missing UserId
Date: Thu, 17 Mar 2022 02:54:47 GMT
Server: akka-http/10.2.9
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://s3-eu-west-1.amazonaws.com/adality-cdn-content/pixel.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 137

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 940E
Redirect Chain

https://pixel.onaudience.com/?mapped=8263666895936391270&partner=68
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/gdpr=0/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=a0f5869ceb8c6a2de291c3bed95c6040&gdpr=0
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=743e8ed2c7e50d3a0c2e15fe0410ecb9&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=d535434c9aeaad56
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3292bba1-3c4c-4053-5889-9c8f51c8073a&reqId=a39ee4b8-6d08-45ef-7b42-ff7993bb1ae5&zclui...
https://mwzeom.zeotap.com/mw?google_gid=CAESEH7kOlQEZgZq-HNCoN2CmIY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3292bba1-3c4c-4053-5889-9c8f51c8073a&reqId=a39ee4b8-6d08-45ef-7b42-ff7...

95 B
164 B

34ms
24ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?google_gid=CAESEH7kOlQEZgZq-HNCoN2CmIY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3292bba1-3c4c-4053-5889-9c8f51c8073a&reqId=a39ee4b8-6d08-45ef-7b42-ff7993bb1ae5&zcluid=d535434c9aeaad56&zdid=1332
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://c1.adform.net
access-control-allow-credentials: true
cf-ray: 6ed2722ee89491d5-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://mwzeom.zeotap.com/mw?google_gid=CAESEH7kOlQEZgZq-HNCoN2CmIY&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=3292bba1-3c4c-4053-5889-9c8f51c8073a&reqId=a39ee4b8-6d08-45ef-7b42-ff7993bb1ae5&zcluid=d535434c9aeaad56&zdid=1332
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 469
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

/
cm.adsafety.net/ Frame 940E
Redirect Chain

https://cm.adsafety.net/?_cmsrc=adformx&idt=100&did=8263666895936391270
https://tags.adsafety.net/v1/cm?cm_uid=CM1202203170223ecf03fe663dcdde99&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dct%26_chainsrc%3Dcommon%26idt%3D%5B%25IDT%25%5D%26did%3D%5B%25DID%25%5D
https://cm.adsafety.net/?_cmsrc=ct&_chainsrc=common&idt=100&did=9423fc829f1b9222c2fa0ae50061de55
https://ads.smartstream.tv/cm/?cmsrc=cm&cm_uid=CM1202203170223ecf03fe663dcdde99&redirect=https%3A%2F%2Fcm.adsafety.net%2F%3F_cmsrc%3Dstv%26_chainsrc%3Dcommon&gdpr_consent=
https://cm.adsafety.net/?_cmsrc=stv&_chainsrc=common&idt=100&did=9423fc829f1b9222c2fa0ae50061de55&idt_did_status=added&gdpr_consent=&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=dataxtrade_dmp&google_cm&google_hm=Q00xMjAyMjAzMTcwMjIzZWNmMDNmZTY2M2RjZGRlOTk
https://cm.adsafety.net/?_cmsrc=dbmx&midt=100&mdid=CAESEBrBEH5coPK0oX2mY2oQ6g0&google_cver=1
https://c1.adform.net/serving/cookie/match?party=28&cid=CM1202203170223ecf03fe663dcdde99
https://cm.adsafety.net/?_cmsrc=adform&idt=100&did=8263666895936391270
https://dsp.adfarm1.adition.com/cookie/?ssp=6
https://cm.smartstream.tv/?_cmsrc=activeagent_cm&idt=100&did=7075897150589302932
https://cm.adsafety.net/?_cmsrc=activeagent_cm&idt=100&did=7075897150589302932

43 B
2 KB

17ms
17ms

Image
image/gif

139.162.146.37
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adsafety.net/?_cmsrc=activeagent_cm&idt=100&did=7075897150589302932
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Server: 139.162.146.37 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: li1413-37.members.linode.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
Last-Modified: Thu, 17 Mar 2022 02:54:48 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
Connection: keep-alive
Expires: Mon, 28 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://cm.adsafety.net/?_cmsrc=activeagent_cm&idt=100&did=7075897150589302932
Date: Thu, 17 Mar 2022 02:54:48 GMT
Server: nginx
Connection: keep-alive
X-Powered-By: PHP/5.5.9-1ubuntu4.26
Transfer-Encoding: chunked
Content-Type: text/html

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 940E 0
338 B 118ms
30ms Image
text/plain 54.171.37.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=adform&partner_uid=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.37.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-37-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
cache-control: private, no-cache, no-store
x-request-time: D=38 t=1647485687
x-served-by: beacon-n015-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
c1.adform.net/serving/cookie/match/ Frame 940E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_cm&google_ula=1641347&party=1&google_hm=ODI2MzY2Njg5NTkzNjM5MTI3MA
https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDqt1O3doqGrX1D34Pd7SoM&google_cver=1&google_ula=1641347,0

35 B
468 B

19ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDqt1O3doqGrX1D34Pd7SoM&google_cver=1&google_ula=1641347,0

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDqt1O3doqGrX1D34Pd7SoM&google_cver=1&google_ula=1641347,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
secure.adnxs.com/ Frame 940E
Redirect Chain

https://secure.adnxs.com/getuid?https://c1.adform.net/serving/cookie/match?party=3&id=$UID&redirect=1
https://c1.adform.net/serving/cookie/match?party=3&id=1358138099726111045&redirect=1
https://secure.adnxs.com/setuid?entity=91&code=8263666895936391270

43 B
996 B

14ms
14ms

Image
image/gif

185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/setuid?entity=91&code=8263666895936391270

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

HTTP/1.1

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
X-Proxy-Origin: 138.199.38.133; 138.199.38.133; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ddd19c3c-98bc-4e24-9acf-0c6cc7bbd4c4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
location: https://secure.adnxs.com/setuid?entity=91&code=8263666895936391270
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 plf
c1.adform.net/imatch/ Frame 940E 0
261 B 23ms
20ms Image
text/plain 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plfm

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 940E 42 B
545 B 402ms
15ms Image
image/gif 185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
cache-control: no-store, no-cache, private
x-lat: amspug007:0:1077
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK cs
pdw-adf.userreport.com/ Frame 940E 43 B
444 B 77ms
15ms Image
image/gif 18.64.115.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pdw-adf.userreport.com/cs
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.115.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-115-91.txl50.r.cloudfront.net
Software: nginx/1.18.0 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Wed, 16 Mar 2022 09:47:51 GMT
Via: 1.1 f457b4e0db5ab2b66536f068ee4589c0.cloudfront.net (CloudFront)
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx/1.18.0
Age: 61617
X-Cache: Hit from cloudfront
Content-Type: image/gif
Connection: keep-alive
X-Amz-Cf-Pop: TXL50-P4
Content-Length: 43
X-Amz-Cf-Id: __70laUrb50caP_OSOj4H5nqrP57Tiop2TdVr4a0MUQ_KbeyoQb59g==

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame 940E
Redirect Chain

https://a.audrte.com/a?adform_uid=8263666895936391270
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_cm&red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/g?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiZXllb3RhIn1dfQ%3D%3D&gdpr=0&gdpr_consent=&google_gid=CAESEA6ve-S4VaLcBPd9aCT6CmI&google_cver=1
https://ps.eyeota.net/match?bid=kh51m51&uid=27l9EkzNUvXRjmRk-1-ZvqjPw&gdpr=0&gdpr_consent=

0
344 B

8ms
8ms

Image
text/plain

18.184.216.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=kh51m51&uid=27l9EkzNUvXRjmRk-1-ZvqjPw&gdpr=0&gdpr_consent=
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Server: 18.184.216.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-216-10.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:48 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Date: Thu, 17 Mar 2022 02:54:48 GMT
Server: nginx/1.18.0
Access-Control-Allow-Origin: *
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Location: https://ps.eyeota.net/match?bid=kh51m51&uid=27l9EkzNUvXRjmRk-1-ZvqjPw&gdpr=0&gdpr_consent=
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 940E
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1586&dpuuid=8263666895936391270&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredirect%3D1
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1586&dpuuid=8263666895936391270&redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1007%26cid%3D%24%7BDD_UUID%7D%26noredire...
https://c1.adform.net/serving/cookie/match?party=1007&cid=54959948143446757721325264659840586056&noredirect=1

35 B
468 B

21ms
21ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1007&cid=54959948143446757721325264659840586056&noredirect=1

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

DCS: dcs-prod-irl1-2-v030-0e55f8179.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 8sDBOtbPSgc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://c1.adform.net/serving/cookie/match?party=1007&cid=54959948143446757721325264659840586056&noredirect=1
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 940E
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212269628&_puid=8263666895936391270
https://dmp.adform.net/serving/cookie/match/?party=1014&cid=164950604093000019384

35 B
468 B

42ms
21ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1014&cid=164950604093000019384

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://dmp.adform.net/serving/cookie/match/?party=1014&cid=164950604093000019384
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 940E
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1049%26cid%3D%25%25COOKIE%25%25
https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7075897150589302932

35 B
468 B

35ms
20ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7075897150589302932

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Location: https://dmp.adform.net/serving/cookie/match/?party=1049&cid=7075897150589302932
Date: Thu, 17 Mar 2022 02:54:48 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1 200
OK 33302
tags.bluekai.com/site/ Frame 940E 62 B
587 B 152ms
151ms Image
image/gif 104.89.42.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/33302?id=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.42.102 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-42-102.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:48 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
Content-Type: image/gif

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 940E
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1066%26cid%3D%5BMM_UUID%5D
https://c1.adform.net/serving/cookie/match?party=1066&cid=8e3d6232-a2f7-4100-8ac7-ffa37a5ad201

35 B
468 B

19ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1066&cid=8e3d6232-a2f7-4100-8ac7-ffa37a5ad201

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Date: Thu, 17 Mar 2022 02:54:48 GMT
Server: MT3 4256 109297d master cdg-pixel-x28 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://c1.adform.net/serving/cookie/match?party=1066&cid=8e3d6232-a2f7-4100-8ac7-ffa37a5ad201
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Thu, 17 Mar 2022 02:54:47 GMT

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 940E
Redirect Chain

https://pm.w55c.net/ping_match.gif?st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
https://pm.w55c.net/ping_match.gif?scc=1&st=adform&rurl=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1084%26cid%3D_wfivefivec_
https://c1.adform.net/serving/cookie/match?party=1084&cid=SSH1wFH41NuGhO5

35 B
468 B

19ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=1084&cid=SSH1wFH41NuGhO5

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
Server: PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-04fd973f611872bb0@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://c1.adform.net/serving/cookie/match?party=1084&cid=SSH1wFH41NuGhO5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 940E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=71ei9rr&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=71ei9rr&ttd_tpi=1
https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=f892a337-c834-4d10-863c-48e109458ab5

35 B
468 B

19ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=f892a337-c834-4d10-863c-48e109458ab5

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dmp.adform.net/serving/cookie/match/?party=1144&tdid=f892a337-c834-4d10-863c-48e109458ab5
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 225

GET image.sbmx
global.ib-ibi.com/ Frame 940E 0
0

GET
H/1.1 200 0.gif
id5-sync.com/s/10/ Frame 940E 43 B
1009 B 46ms
9ms Image
image/gif 54.36.109.46
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/s/10/0.gif?puid=8263666895936391270

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.36.109.46 , France, ASN16276 (OVH, FR),

Reverse DNS

p01.id5-sync.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 17 Mar 2022 02:54:48 GMT
Transfer-Encoding: chunked
Content-Type: image/gif;charset=UTF-8
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
P3P: CP="CAO PSA OUR"

GET
H2

200

/
dmp.adform.net/serving/cookie/match/ Frame 940E
Redirect Chain

https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D
https://redirect.frontend.weborama.fr/redirect/standard?url=https%3A%2F%2Fdmp.adform.net%2Fserving%2Fcookie%2Fmatch%2F%3Fparty%3D1145%26cid%3D%7BWEBO_CID%7D&bounce=1&random=2010049449
https://dmp.adform.net/serving/cookie/match/?party=1145&cid=KIvJOo5a1C.4eHa4ms6COu

35 B
468 B

19ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1145&cid=KIvJOo5a1C.4eHa4ms6COu

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
via: 1.1 google
last-modified: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx/1.18.0
location: https://dmp.adform.net/serving/cookie/match/?party=1145&cid=KIvJOo5a1C.4eHa4ms6COu
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 940E 23 B
172 B 99ms
37ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=119&uid=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 17 Mar 2022 02:54:48 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2

200

pixel.gif
sync.1dmp.io/ Frame 940E
Redirect Chain

https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=8263666895936391270
https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=8263666895936391270&cs=1

35 B
376 B

12ms
12ms

Image
image/gif

136.243.148.229
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.1dmp.io/pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=8263666895936391270&cs=1
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Server: 136.243.148.229 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.229.148.243.136.clients.your-server.de
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
cache-control: private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate
server: nginx
content-type: image/gif
content-length: 35
expires: 0

Redirect headers

location: /pixel.gif?cid=672a497c-d086-4380-a381-292df6008b87&brid=db693857-60a6-4685-a042-c2286c2ca02d&pid=w&uid=8263666895936391270&cs=1
date: Thu, 17 Mar 2022 02:54:48 GMT
cache-control: private, no-cache, no-store, no-cache=Set-Cookie, proxy-revalidate
server: nginx
content-length: 0
expires: 0

GET
H2 204 /
s.ad.smaato.net/c/ Frame 940E 0
241 B 43ms
7ms Image
text/plain 2600:9000:223f:1a00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001213&dspCookie=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:1a00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
via: 1.1 f7d063966b06905209f8790f5fd607e2.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: AEIPErPTjmEF8CwV4gilVfqW0fY6HjkIBufk2pDEx_UJKikFJ6FDoA==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H2

200

match
c1.adform.net/serving/cookie/ Frame 940E
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2032&partner_device_id=8263666895936391270&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2032&partner_device_id=8263666895936391270&partner_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d2007%26cid%3D%24%7...
https://c1.adform.net/serving/cookie/match?party=2007&cid=515e4e45-d9d6-4760-8528-99044cd62fa2

35 B
468 B

19ms
19ms

Image
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=2007&cid=515e4e45-d9d6-4760-8528-99044cd62fa2

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

Redirect headers

location: https://c1.adform.net/serving/cookie/match?party=2007&cid=515e4e45-d9d6-4760-8528-99044cd62fa2
date: Thu, 17 Mar 2022 02:54:48 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 200 8263666895936391270
match.contentexchange.me/adform/ Frame 940E 0
49 B 87ms
25ms Image
text/plain 46.19.11.36
SIEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.contentexchange.me/adform/8263666895936391270?redirect_url=https%3a%2f%2fc1.adform.net%2fserving%2fcookie%2fmatch%3fparty%3d1219
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.19.11.36 , Slovenia, ASN51790 (SIEL, SI),
Reverse DNS: ilog.vsn.si
Software: nginx/1.16.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
content-length: 0
server: nginx/1.16.1

GET
H2 200 xuid
eb2.3lift.com/ Frame 940E 37 B
354 B 10ms
10ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7354&xuid=8263666895936391270&dongle=AD20
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 put
e1.emxdgt.com/ Frame 940E 0
59 B 76ms
20ms Image
text/html 18.195.155.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e1.emxdgt.com/put?d=d52&uid=8263666895936391270
Requested by: Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
content-length: 0
content-type: text/html

GET
H2 200 plf
c1.adform.net/imatch/ Frame 940E 0
261 B 21ms
20ms Image
text/plain 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/imatch/plf?name=plfl

Requested by

Host: c1.adform.net
URL: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c1.adform.net/imatch/pixels?uid=8263666895936391270&agencyId=2364&advertiserId=2036267&src=tp&rnd=122508
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H/1.1 200
OK px
secure.adnxs.com/ Frame C6D2 43 B
951 B 62ms
30ms Image
image/gif 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/px?id=1472086&t=2

Requested by

Host: a2.adform.net
URL: https://a2.adform.net/serving/container/?pm=1662401&lid=56730269&ctype=0&media=0&PageName=American_Banker+Universal+Tag&orderid=UNIQUE_ORDER_ID&sysvars=%7corderid%3dUNIQUE_ORDER_ID%7c%7c%7c%40%40%7cpid%3dOFFER_ID%7cpnm%3dProductRatePlanName%7c&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&rnd=1860967004&cpref=&loc=https%3a%2f%2fwww.americanbanker.com%2fpayments%2fopinion%2fnew-bot-malware-leaves-financial-apps-dangerously-e

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a2.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
X-Proxy-Origin: 138.199.38.133; 138.199.38.133; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 156425b6-3b45-40f8-95ed-e51d6aa6959d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK seg
ib.adnxs.com/ Frame C6D2 43 B
1 KB 15ms
13ms Image
image/gif 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/seg?add=26609450

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a2.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:47 GMT
X-Proxy-Origin: 138.199.38.133; 138.199.38.133; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e4321879-b651-4d8c-a15e-49bc490870dd
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 fail-icon.png
buy.tinypass.com/widget/dist/template/css/img/ Frame E6F8 2 KB
3 KB 21ms
21ms Image
image/png 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://buy.tinypass.com/widget/dist/template/css/img/fail-icon.png

Requested by

Host: buy.tinypass.com
URL: https://buy.tinypass.com/widget/dist/template/css/template.bundle.1.0.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be36cf242d7b206d66842ab5b36af859b780372bba70cb5d72acda2626ffe52e

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/widget/dist/template/css/template.bundle.1.0.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
cf-cache-status: HIT
age: 7200
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
strict-transport-security: max-age=86400; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2177
wn: prod-dash-10-0-91-77
last-modified: Tue, 15 Mar 2022 13:25:12 GMT
server: cloudflare
etag: W/"2177-1647350712000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
server-time: 0.000
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6ed2722c8d389b52-FRA
expires: Thu, 17 Mar 2022 04:54:47 GMT

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v22/ Frame E6F8 23 KB
23 KB 25ms
9ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://buy.tinypass.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:31 GMT
x-content-type-options: nosniff
age: 26656
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23040
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:21:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:31 GMT

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ Frame E6F8 23 KB
23 KB 22ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://buy.tinypass.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:30 GMT
x-content-type-options: nosniff
age: 26657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:14:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:30 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ Frame C6D2 24 KB
10 KB 34ms
8ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: a2.adform.net
URL: https://a2.adform.net/serving/container/?pm=1662401&lid=56730269&ctype=0&media=0&PageName=American_Banker+Universal+Tag&orderid=UNIQUE_ORDER_ID&sysvars=%7corderid%3dUNIQUE_ORDER_ID%7c%7c%7c%40%40%7cpid%3dOFFER_ID%7cpnm%3dProductRatePlanName%7c&itm=eyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0&rnd=1860967004&cpref=&loc=https%3a%2f%2fwww.americanbanker.com%2fpayments%2fopinion%2fnew-bot-malware-leaves-financial-apps-dangerously-e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a2.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
content-encoding: gzip
etag: "u2JtyZzqnTXwzBUswy2r+w=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Thu, 24 Mar 2022 02:54:47 GMT

GET
H2 200 rules-p-59TDtw8Xc0wSM.js Show response
rules.quantcount.com/ Frame C6D2 784 B
1 KB 47ms
8ms Script
application/javascript 2600:9000:2156:5c00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-59TDtw8Xc0wSM.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:5c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 713fc9f8abe79cb80fc0207cbd722d60746e79796a09a208942691386394473a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a2.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:47 GMT
via: 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
age: 1071
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 784
last-modified: Mon, 19 Jul 2021 19:53:53 GMT
server: AmazonS3
etag: "f375410bb18e492a5621549c766bae93"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: Qi44N1GB2viKFaYi7yv19cO-W1fNJcIZTIKM8GoYWQUVkI1ERAR34Q==

GET
H2 200 pixel;r=2063416087;labels=_fp.event.American%20Banker%20Easy%20Tag;event=refresh;rf=0;a=p-59TDtw8Xc0wSM;url=https%3A%2F%2Fa2.adform.net%2Fserving%2Fcontainer%2F%3Fpm%3D1662401%26lid%3D56730269%26ct...
pixel.quantserve.com/ Frame C6D2 35 B
472 B 25ms
11ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2063416087;labels=_fp.event.American%20Banker%20Easy%20Tag;event=refresh;rf=0;a=p-59TDtw8Xc0wSM;url=https%3A%2F%2Fa2.adform.net%2Fserving%2Fcontainer%2F%3Fpm%3D1662401%26lid%3D56730269%26ctype%3D0%26media%3D0%26PageName%3DAmerican_Banker%2BUniversal%2BTag%26orderid%3DUNIQUE_ORDER_ID%26sysvars%3D%257corderid%253dUNIQUE_ORDER_ID%257c%257c%257c%2540%2540%257cpid%253dOFFER_ID%257cpnm%253dProductRatePlanName%257c%26itm%3DeyJzbCI6IlJFVkVOVUUiLCJpZCI6IlVOSVFVRV9PUkRFUl9JRCIsInN2MSI6Ii9wYXltZW50cy9vcGluaW9uL25ldy1ib3QtbWFsd2FyZS1sZWF2ZXMtZmluYW5jaWFsLWFwcHMtZGFuZ2Vyb3VzbHktZXhwb3NlZCIsIml0bXMiOlt7InBpZCI6Ik9GRkVSX0lEIiwicG5tIjoiUHJvZHVjdFJhdGVQbGFuTmFtZSJ9XX0%26rnd%3D1860967004%26cpref%3D%26loc%3Dhttps%253a%252f%252fwww.americanbanker.com%252fpayments%252fopinion%252fnew-bot-malware-leaves-financial-apps-dangerously-e;ref=https%3A%2F%2Fwww.americanbanker.com%2F;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-1142311689-1647485687999;pbc=;ns=1;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;d=a2.adform.net;je=0;sr=1600x1200x24;dst=0;et=1647485687999;tzo=0;ogl=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a2.adform.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:47 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK index.php Show response
a.dpmsrv.com/dpmpxl/ 5 B
1 KB 93ms
93ms Script
text/javascript 35.172.177.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.dpmsrv.com/dpmpxl/index.php?q=xSeg&v=1.x&ep%5Bids%5D=7568712%2C6451507%2C6745137&cl=342&pixelIndex=0&r=21668&tzOffset=0&url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&id=1358138099726111045&_=1647485686768
Requested by: Host: s.dpmsrv.com
URL: https://s.dpmsrv.com/dpm_c415505dca69be631ca5d391b3ccd2b44b52d017.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.177.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-177-82.compute-1.amazonaws.com
Software: /
Resource Hash: fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
content-encoding: gzip
Access-Control-Max-Age: 10
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/javascript
Access-Control-Allow-Headers: content-type, accept
Content-Length: 31
Expires: 0

GET
H/1.1 200
OK seg
ib.adnxs.com/ 43 B
1 KB 15ms
14ms Image
image/gif 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/seg?member=827&add=7568712,6451507,6745137

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
X-Proxy-Origin: 138.199.38.133; 138.199.38.133; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ddf9cf41-56fb-4a5e-b689-f477d6892779
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK px
secure.adnxs.com/ 43 B
996 B 15ms
14ms Image
image/gif 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/px?id=803560&t=2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
X-Proxy-Origin: 138.199.38.133; 138.199.38.133; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: aab50ecc-9192-4e73-8032-57b1e087ac1f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 fail-icon.png
buy.tinypass.com/widget/dist/template/css/img/ Frame 17E0 2 KB
3 KB 133ms
133ms Image
image/png 2606:4700::6811:b6b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://buy.tinypass.com/widget/dist/template/css/img/fail-icon.png

Requested by

Host: buy.tinypass.com
URL: https://buy.tinypass.com/widget/dist/template/css/template.bundle.1.0.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be36cf242d7b206d66842ab5b36af859b780372bba70cb5d72acda2626ffe52e

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://buy.tinypass.com/widget/dist/template/css/template.bundle.1.0.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
p3p: CP="NON DSP COR OUR IND"
x-forwarded-https: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2177
wn: prod-dash-10-0-91-77
last-modified: Tue, 15 Mar 2022 13:25:12 GMT
server: cloudflare
etag: W/"2177-1647350712000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=86400; includeSubDomains
content-type: image/png
server-time: 0.000
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6ed2722e9f539b52-FRA
expires: Thu, 17 Mar 2022 04:54:48 GMT

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v22/ Frame 17E0 23 KB
23 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://buy.tinypass.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:31 GMT
x-content-type-options: nosniff
age: 26657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23040
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:21:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:31 GMT

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ Frame 17E0 23 KB
23 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:300,300i,400,400i,700,700i,900,900i

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://buy.tinypass.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 19:30:30 GMT
x-content-type-options: nosniff
age: 26658
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:14:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 16 Mar 2023 19:30:30 GMT

GET
BLOB 200
OK afdc0af4-6761-4996-bf24-093f1f2d4278
https://www.americanbanker.com/ 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.americanbanker.com/afdc0af4-6761-4996-bf24-093f1f2d4278
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 56AE 0
0 33ms
32ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstF6BXzDr2g3iWkoNQBQkaXLOBTSvjM-6BHtyVjagrDJcel2sRNgkDSX7fvdn84eiV4npXnDs5EM8OKQ00yR2koFsDoH6DZ4ye5ofHCyjO03HRaPPIpB_U535jVP6M7mdDORQklHKLbytT4UNg7SayMVOP1Uj_5FQfmDhe80zxRBVGuUl5USWsO4vPKcaWUdwtSnB1508saNwsWyQL8L5CJYYUgbfaZQF8rL_YTAK2d9oh_y8KiF74UReHSqYCHVERbTdfNQavfH45loyka5jLMArLt7oRgZ0Tr7N1ykNLV-7N-WmCqM0emOs4QDmu7uZRYYEOBmDiAHpLM4uEU_7SHEcL0Q8Ps&sig=Cg0ArKJSzPkNm57-RgZ7EAE&uach_m=[UACH]&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220315/r20110914/client/ Frame 56AE 2 KB
2 KB 36ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220315/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 22:37:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15427
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Mar 2022 22:37:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 56AE 117 KB
36 KB 33ms
18ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 17 Mar 2022 02:54:48 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 56AE 0
0 19ms
18ms Image
text/html 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTwJ0DAUaqmmRdcRmsDODjuYWlTWDDVU4Jne3W9Uz-vZfKlCnDeuvJg_EPBrX8F_uI_IK87
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 6694536768108906343
tpc.googlesyndication.com/simgad/ Frame 56AE 68 KB
69 KB 35ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6694536768108906343

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3db41d0eda0f9e8dc220a241eda61aa948e78be9f994d81c72f07a0a73b60913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 07:31:09 GMT
x-content-type-options: nosniff
age: 156219
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69821
x-xss-protection: 0
last-modified: Fri, 25 Feb 2022 20:40:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 15 Mar 2023 07:31:09 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 56AE 0
0 46ms
31ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv23bSzi4knFgd6XUzzUuJRt8VMsVyB6urK4a916rpgli-BLUHYGoPer7YJd-95yDcXyVPmjGbLJuVsAfRsfLRzllo0dOI0OVeP0-VQv7V3rp6D7za2kco8RCg1ZqilHzuRPSXcZWa7CrCodksQr32y0swWehMi0yVCKtJRmGgbjJnwyxKZaCnreodcPqfZZskGZ-p1gbqKfA4KQ2F1tnWGJRHjAMLrGDmgs1aEb-c_OuQEmixm1ayqbw3DK_jpTB0lzUv5nh1CzhM6K_npjPv4sMHxgekKycX-ANuBEbE5V2w8SQ3axQuIgCIrPs52a7n0Hra0z3XeenguawUnU9f-NcGoqWqotpo&sig=Cg0ArKJSzEQItAV_hiwIEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 17 Mar 2022 02:54:48 GMT

GET
DATA 200
OK truncated
/ Frame 56AE 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e67d5e7c6ed686d4b765d4cdc5a8798b15966e72d1775e67b182b5bc6cfb6ef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame AB95 47 KB
13 KB 94ms
32ms Script
application/javascript 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=11046&campId=728x90&pubId=4576190830&chanId=22464082146&placementId=5878184535&pubCreative=138383166747&pubOrder=2964105075&cb=1760119229&custom=collapsed_header1&adsafe_par&impId=9b2cde55-a59d-11ec-a029-0231bf2059f1&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 471fbb0dad3625f39ecaf428053d38d7b3bfcebe919e5e462248ec3ccd700c46

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 main.gr.19.8.299.js Show response
static.adsafeprotected.com/ Frame AB95 189 KB
60 KB 78ms
8ms Script
application/javascript 2600:9000:2156:3400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.299.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=11046&campId=728x90&pubId=4576190830&chanId=22464082146&placementId=5878184535&pubCreative=138383166747&pubOrder=2964105075&cb=1760119229&custom=collapsed_header1&adsafe_par&impId=9b2cde55-a59d-11ec-a029-0231bf2059f1&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86a676d25a23c478b5064a3f6d9275179f67de2bbebe1bfa842719f73658650a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 20:37:01 GMT
content-encoding: gzip
age: 800268
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 01 Mar 2022 19:11:01 GMT
server: AmazonS3
etag: W/"587738d3e44b43a2620f42eb51d89fbf"
vary: Accept-Encoding
x-amz-version-id: kp2GPcLunARmvxyYiu0RKpd0_UaoR.nW
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: _yftNdK6Jkw8NkNNbfCEi1vwoI6TcmNA9N6eVXpvXSPKa8yUEeEafA==

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 7604 80 KB
21 KB 8ms
8ms Script
application/javascript 2600:9000:2156:3400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 13:58:04 GMT
content-encoding: gzip
age: 2552205
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: GdTdfrNOoZRQZ_eLUM8fLTqGKQFE9lfoDA-CxafzwOcJgk3bGmiGzA==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
216 B 33ms
32ms Image
image/gif 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=11046&campId=728x90&pubId=4576190830&chanId=22464082146&placementId=5878184535&pubCreative=138383166747&pubOrder=2964105075&cb=1760119229&custom=collapsed_header1&adsafe_par&impId=9b2cde55-a59d-11ec-a029-0231bf2059f1&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email&adsafe_url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.americanbanker.com%2F&adsafe_type=f&adsafe_jsinfo=,id:62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c,c:75fqBL,sl:inView,em:true,fr:true,thd:1,mn:jsserver-primary-67cb66fbd5-xnvck,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,nbld:0,mtim:130,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181,idMap:18*,pl:,rmeas:1,rend:1,renddet:IMG.qs,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:152,oid:9bcd1595-a59d-11ec-9dca-b2ac617fee38,v:19.8.299,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:48 GMT
x-server-name: app04.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 279ms
88ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqC6,pingTime:0,time:173,type:pf,im:%7BpBlk:168%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:151%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:173,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B37~100%5D,as:%5B37~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
X-Server-Name: dt51.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 273ms
87ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqCc,pingTime:-2,time:179,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:125,beZ:127,mfA:256,cmA:258,inA:258,inZ:264,prA:264,prZ:270,si:278,poA:278,bl:294,poZ:294,cmZ:294,mfZ:294,loA:300,loZ:303,ltA:304,ltZ:304%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:151%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:179,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B43~100%5D,as:%5B43~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs,slid:%5Bgoogle_ads_iframe_/16059533/AmericanBanker/Payments/Opinion_0,google_ads_iframe_/16059533/AmericanBanker/Payments/Opinion_0__container__,googleAd6e2e22d3-e4f3-4357-b88c-15ffea3acd5a%5D,sinceFw:26,readyFired:true%7D&br=u
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
X-Server-Name: dt45.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 257ms
84ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqCL,time:214,type:e,im:%7BpWait:4%7D,env:%7Bar:self.0%7D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:214,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B78~100%5D,as:%5B78~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:48 GMT
X-Server-Name: dt51.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012202142035000/ Frame C131 220 KB
61 KB 58ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed7385b2ca535f7f90bb14266ddd68d64393f41d1559cbb4af01ece4dd36b8fb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 200587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61563
x-xss-protection: 0
server: sffe
date: Mon, 14 Mar 2022 19:11:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "74cdf3878bfbef53"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Mar 2023 19:11:41 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame C131 16 KB
6 KB 69ms
19ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b8fae56a7edbfe89e7f7fd22aa7df75546183f81660692c9cf03d3c8d914ba

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 200587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5733
x-xss-protection: 0
server: sffe
date: Mon, 14 Mar 2022 19:11:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "42a91727bcc93df1"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Mar 2023 19:11:41 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame C131 96 KB
29 KB 71ms
21ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e02189b6990b38c43207a8c0c206a2fda1833e7b7401fa42af72671e62f43a5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 200587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29577
x-xss-protection: 0
server: sffe
date: Mon, 14 Mar 2022 19:11:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "42f1ed997a28c2a2"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Mar 2023 19:11:41 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame C131 5 KB
2 KB 73ms
24ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3110966fa73dac64901ac2cec67656155bb9717286b7b0da0544cdd8ae7c888d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 200587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1873
x-xss-protection: 0
server: sffe
date: Mon, 14 Mar 2022 19:11:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "8e63b195883091b5"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Mar 2023 19:11:41 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012202142035000/v0/ Frame C131 42 KB
13 KB 74ms
25ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012202142035000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2a6bdf3640e1213ba9a0a900ea6864a0274b080ba3bcf05ff245bfabb5eba0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 200587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13633
x-xss-protection: 0
server: sffe
date: Mon, 14 Mar 2022 19:11:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d3c67c66f710e82a"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Mar 2023 19:11:41 GMT

GET
DATA 200
OK truncated
/ Frame C131 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e20f355c2087cd3cccd8bbbb7c149479e792a82b763353b0b0224f0aa1d09572

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 9901434137684010768
tpc.googlesyndication.com/simgad/ Frame C131 78 KB
78 KB 26ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9901434137684010768?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnDVXtPrelMKbhkt5om-JGUerfxcA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff5aac9870f1410129ad566213ad662fb603e1ac7bb284712142b38426cbe9a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 13 Mar 2022 00:11:56 GMT
x-content-type-options: nosniff
age: 355372
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 79823
x-xss-protection: 0
last-modified: Thu, 09 Sep 2021 16:38:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 13 Mar 2023 00:11:56 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame C131 2 KB
2 KB 24ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 09:41:38 GMT
x-content-type-options: nosniff
server: cafe
age: 61990
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 17 Mar 2022 09:41:38 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame C131 295 B
319 B 23ms
7ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 09:53:05 GMT
x-content-type-options: nosniff
server: cafe
age: 61303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Thu, 17 Mar 2022 09:53:05 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C131 0
0 19ms
18ms Image
text/html 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSUTj187YZ7mgMSd4KRrxffMbqKzjM7fAbTpV_Dybm6NmiLs7T4n4tyDQs2_neypOK9YccT
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C131 0
0 39ms
38ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CbEaS-KIyYo3qDNX83wPyorCgCr_ewvdo75LEruQPi-bp8fseEAEgq5uNHGCVypGCoAegAZKZq_wCyAEC4AIAqAMByAMIqgToA0_QxQjzS-q-IU-LQfFosO6d3MFFYv4Rf0TZJUrXk5MyfEaFwb0THiaqipNf_MlMlbRURnXqLe29n-aJdBKOhs7HsrET-_YOCcaMYx4fYlcwMvsc0SpuIDUTcjQm5kfchdk6ZXHZikdAtc8_UAKXpBbj1ywFN2WQREonVpX0t9SAhmzDdeGBWyFbOoeG-aWFyPqFx7MBx8eU2OWZ5USewOykGfwLToLFkbs_P-CEFnZZwL5-os4T7ZwPqG_z2W0AMebzV6xwouhiGytsbhRnMcg2nOJjpwDOTSfT0wMkOQ87eJXDk6u71m-2t67M2iyKDq5Sh2faA67tDaG7NlHL3qzZd-fHcGzt9nMBuDd2Oyqzn29YPEM62xBPjx03Ir_CDU6gZAeXPzm-RWyeHLafQdviVwf4Eojd67_sLch3wVosPPjBU_6xKT1vbDZaNaElFur2fR3qVpUzonC6Z4OCyA4elzcBXYVmrNgdD4bfKGsDwKpCT7iGVZMn3amJu94x99XL91j7GodpZoCqrR2Efct4MWV6X9MGAGStSaPhC6LHM8IkAP3gjyQh3_lgJXJtQQXeLdPm3MQKXaz7WZH9fJgOo0dxQDcVSa2ifHxdgg2-vW8_PaO8MIBKT6ZzZR3dRVOs-c4qiezVwATmhbfwsQPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH1ubUgwGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBRCI05gB0ggJCIDhgHAQARgdgAoDyAsB2BMN0BUBmBYBgBcBshceChwIABIUcHViLTYwNDYzNzg3NTUxMDQ5MzUY9dwP&sigh=JKX565_k4nU&uach_m=[UACH]
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 86ms
85ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqHN,pingTime:-10,time:526,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85OS4wLjQ4NDQuNTEgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1647485689082%7C%7C4b6fab8c158f0cded56eb8b14f76d3a6%7C%7C6b9a00393fb1607b0ada13520f814ab5%7C%7C3f6d49a3e7eb5561b3f3136e1f6c5c39%7C%7C12494e3259043c5d0ae5fd3500c7a686%7C%7Ca0ad7f9379b3678e05767f094daf0ec3%7C%7Cbc945a2be781a61b34391e45358fa991%7C%7C1035b0473979a49b630e0fe939e64711%7C%7C1629390669%7D
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:49 GMT
X-Server-Name: dt51.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7ACD 0
0 31ms
30ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvZVRk204CUda-yEkE0JHBJ3ljlVD1dR7GZHmG_wTtuuQ5FCXPUzEgut9AhXj-VnGnSHYhka28ZOfpDMUBCrKZv6d5UqJua2xZvNJqArNHnS37ChUPRZFe73T_wAmI-ATPi9SXMBUY_DsYjQrPDrvwhPBmqN_DP7A_OhYA6KisckkjwdwZ1f_lDUNk7c4qW_AhUQ9HcjOCesC86FSRaGBSAABS6V0LOxHeTMq_sEdTrkNnHdPngwEb2hqbkz6WrVTWMhDNe587rD5JV0p8HdC77vb54gGFDEsjD-S8lyBNK2eoAITwhIYDYUojuW4fdh4m_MzHyWg2EE2F5XtGx4RAJn_c&sig=Cg0ArKJSzAQoFAwxbroCEAE&uach_m=[UACH]&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220315/r20110914/client/ Frame 7ACD 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220315/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 16 Mar 2022 22:37:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15428
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Mar 2022 22:37:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7ACD 117 KB
36 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 17 Mar 2022 02:54:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7ACD 0
0 18ms
18ms Image
text/html 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQc6LNhkGvdsWOR9gFHsKq4fTldvMduhbt2nc9co4lWL9yEA6IrxNcbEAK2xekTCFy8RTiy
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 12284765097395335698
tpc.googlesyndication.com/simgad/ Frame 7ACD 79 KB
79 KB 9ms
8ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12284765097395335698

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03d04277224f8a8dc50f9d3e6ebc1379c33d788c8333d15aea5d63829a5bac12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 22:57:58 GMT
x-content-type-options: nosniff
age: 100611
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81128
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 14:33:48 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 15 Mar 2023 22:57:58 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame C131
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

38ms
38ms

Image
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H3
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Redirect headers

date: Thu, 17 Mar 2022 02:54:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7ACD 0
0 30ms
30ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvXcK8YYHDwcgtHlbzTXSY7hgOa7V9OyFSF7P6k45_nPhikrISWLJY6fjWedOqf89onVYDK214ElzxBNXrEzvVk-rDjtZjCaCGPtfXGOLApt4Da4pd-qSSLY7Q5IbbbHL9Ie4KaWXOpJlOnfS4cY_bFtwQgR7lVsqApmA0OjM8ZOD51XbEGsurIIY7wMnQclI0a7IhUAo3INKzcUM3xblaZy_FGpOjEzAfPe-TaKfAIIIg5iDy7lGBKo3-Tpqfj2uuD5l0k0YNtvmM7T8AWk24TcErM6lC7ResiHQx2LhcuyB8lrooS7ofUbJ8OW52dTNghqhiLLXP0BfW3UXhGtZgu_1jA-A&sig=Cg0ArKJSzPuDISeLjsHjEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 17 Mar 2022 02:54:49 GMT

GET
DATA 200
OK truncated
/ Frame 7ACD 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0392529834cda04a9e7663ce2ac147b952e40f4f9c22e54c251d3554229bcd51

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 11B1 47 KB
13 KB 33ms
33ms Script
application/javascript 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=11046&campId=300x250&pubId=19988173&chanId=22464082146&placementId=4790764721&pubCreative=138328581479&pubOrder=2385617724&cb=1427639636&custom=bigbox2&adsafe_par&impId=9b44abdd-a59d-11ec-8155-02caf40e7d43&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3f43e960e0976386a239312dc9c6ddfecf73a9fc55174aa0a0b0983d8c4913e9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:49 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 51ms
22ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022031401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d081cdb1f07c54651c0d81b3d01122d66529fe9002f71e76931d54c38285e8ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Mar 2022 02:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10504
x-xss-protection: 0

GET
H2 200 main.gr.19.8.299.js Show response
static.adsafeprotected.com/ Frame 11B1 189 KB
60 KB 8ms
8ms Script
application/javascript 2600:9000:2156:3400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.299.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=11046&campId=300x250&pubId=19988173&chanId=22464082146&placementId=4790764721&pubCreative=138328581479&pubOrder=2385617724&cb=1427639636&custom=bigbox2&adsafe_par&impId=9b44abdd-a59d-11ec-8155-02caf40e7d43&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86a676d25a23c478b5064a3f6d9275179f67de2bbebe1bfa842719f73658650a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 07 Mar 2022 20:37:01 GMT
content-encoding: gzip
age: 800269
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 01 Mar 2022 19:11:01 GMT
server: AmazonS3
etag: W/"587738d3e44b43a2620f42eb51d89fbf"
vary: Accept-Encoding
x-amz-version-id: kp2GPcLunARmvxyYiu0RKpd0_UaoR.nW
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: 05lZMIdUW5n2dsuYw87_VZvp8xHZMeEKb4ExvmklRhTfeGdvo4UBuA==

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 30C6 80 KB
21 KB 8ms
8ms Script
application/javascript 2600:9000:2156:3400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: www.americanbanker.com
URL: https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%20Nov%20Outreach%20APJ%20banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 13:58:04 GMT
content-encoding: gzip
age: 2552206
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 b44e2902bb3501d47514e51618f1bda4.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: KPc3rld_3xGQNgbFHI4i7E_ahxxMP0ekUVuWzM3ntp_TO5R_62TEvw==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
216 B 33ms
33ms Image
image/gif 52.18.8.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=11046&campId=300x250&pubId=19988173&chanId=22464082146&placementId=4790764721&pubCreative=138328581479&pubOrder=2385617724&cb=1427639636&custom=bigbox2&adsafe_par&impId=9b44abdd-a59d-11ec-8155-02caf40e7d43&custom2=2021%20Nov%20Outreach%20APJ%20banking&custom3=hs_email_email&adsafe_url=https%3A%2F%2Fwww.americanbanker.com%2Fpayments%2Fopinion%2Fnew-bot-malware-leaves-financial-apps-dangerously-exposed%3Futm_campaign%3D2021%2520Nov%2520Outreach%2520APJ%2520banking%26utm_medium%3Demail%26_hsmi%3D182937943%26_hsenc%3Dp2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q%26utm_content%3D182937943%26utm_source%3Dhs_email&adsafe_type=abdq&adsafe_url=https%3A%2F%2Fwww.americanbanker.com%2F&adsafe_type=f&adsafe_jsinfo=,id:6c66cc21-36e8-3035-c89b-8fce318a7b4e,c:75fqLI,sl:inView,em:true,fr:true,thd:1,mn:jsserver-primary-67cb66fbd5-g85b2,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:1070.954.300.250,am:i,cc:1070.954.300.250,piv:98,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,nbld:0,mtim:28,fm:t0iS3xg+111%7C121%7C13%7C14%7C15%7C16%7C17%7C181%7C182%7C19%7C1a*.11046%7C1a1,idMap:1a*,pl:,rmeas:1,rend:1,renddet:IMG.qs,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:37,oid:9c3f1188-a59d-11ec-a5ce-928aa1a58dad,v:19.8.299,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.8.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-8-201.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:49 GMT
x-server-name: app09.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js?cb=31065652

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 17 Mar 2022 02:54:49 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 85ms
85ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=6c66cc21-36e8-3035-c89b-8fce318a7b4e&tv=%7Bc:75fqLZ,pingTime:-2,time:53,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:51,beZ:53,mfA:79,cmA:79,inA:79,inZ:81,prA:81,prZ:83,si:88,poA:88,poZ:96,cmZ:96,mfZ:96,loA:101,loZ:102,ltA:104,ltZ:104%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false,ar:self.0%7D,clog:%5B%7Bpiv:98,vs:i,r:,w:300,h:250,t:36%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:53,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:36,wc:0.0.1600.1200,ac:1070.954.300.250,am:i,cc:1070.954.300.250,piv:98,obst:0,th:0,reas:,bkn:%7Bpiv:%5B24~75%5D,as:%5B24~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:t0iS3xg+111%7C121%7C13%7C14%7C15%7C16%7C17%7C181%7C182%7C19%7C1a*.11046%7C1a1,idMap:1a*,rmeas:1,rend:1,renddet:IMG.qs,slid:%5Bgoogle_ads_iframe_/16059533/AmericanBanker/Payments/Opinion_3,google_ads_iframe_/16059533/AmericanBanker/Payments/Opinion_3__container__,googleAdff977787-dc9a-44bb-9601-05b3ba59fe68,scrollContainer%5D,sinceFw:15,readyFired:true%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:49 GMT
X-Server-Name: dt51.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 46A6 13 KB
5 KB 7ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 16 Mar 2022 22:25:34 GMT
expires: Thu, 16 Mar 2023 22:25:34 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 16155
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame ADCD 783 B
536 B 23ms
23ms Document
text/html 2a00:1450:400e:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:811::2004 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3e5bda772d0f79994e4f3b90ef08425b1966e5ab7641554a992dd8d62577e899

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MClCVigXaJbW0Z0VKk8Y4w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 17 Mar 2022 02:54:49 GMT
date: Thu, 17 Mar 2022 02:54:49 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-MClCVigXaJbW0Z0VKk8Y4w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 c9SOW3fm-cIOlp3tvRsibzkEuEO1MqMyQpfRRVluBWQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 46A6 35 KB
14 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/c9SOW3fm-cIOlp3tvRsibzkEuEO1MqMyQpfRRVluBWQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73d48e5b77e6f9c20e969dedbd1b226f3904b843b532a3324297d145596e0564

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 22:11:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 189808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13819
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 22:11:21 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame ADCD 0
0 33ms
19ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022031401&jk=4471228820821541&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 56AE 42 B
64 B 47ms
17ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstELy3f23yA1ajwywO6nzRlL9tZU551iBcWIo9Bal1OamL59azrrQ4dXzwzy0LF98C8xPgXVe_glWo8sd9XSH6jUjwTnPNhvg0TW7Mc4GLl_cbZJxiv&sig=Cg0ArKJSzCSFbCyV1w6MEAE&id=lidar2&mcvt=1014&p=163,436,253,1164&mtos=1014,1014,1014,1014,1014&tos=1014,0,0,0,0&v=20220316&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=2661004028&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647485688345&rpt=80&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 46A6 0
9 B 7ms
7ms Image
text/plain 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7JXvpA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 02:54:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 87ms
85ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqSh,pingTime:1,time:1176,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:151%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1176,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1040~100%5D,as:%5B1040~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:119,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181%7C1a.11046,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:49 GMT
X-Server-Name: dt51.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 87ms
85ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqSi,pingTime:1,time:1177,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:151%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1177,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1041~100%5D,as:%5B1041~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:119,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181%7C1a.11046,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs,metricId:publ1,cmr:t%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:49 GMT
X-Server-Name: dt51.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 88ms
86ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75fqSj,pingTime:1,time:1178,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:151%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1178,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1042~100%5D,as:%5B1042~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:119,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181%7C1a.11046,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs,metricId:grpm1,cmr:t%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:49 GMT
X-Server-Name: dt45.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 18ms
18ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022031401&jk=4471228820821541&bg=!T0ylTAjNAAba2mK92to7ACkAdvg8WqeLI_MNbNrK9JLeJfyNcQFWZSOQMJr2BfdkuN2k5heQLUeGDwIAAABrUgAAAAVoAQeZAvsRp_3VR8efwHjzVhGqlggqP-v-GcXASgCcnUhcGjZ55lJXLbnoa7-c5WeUdUT8magIJ3RC75CIs2Kvfy9RXOnpQXcV_Q15LcljjVCtkCW982_ZUyKT8NW2WiqDU7DaTmy4PjrLR3LGed5FXajDnV_V-UE_TQnO4N3YUi1nRjEPaJCZtKiRimF7kPa5oy0zA2Kyo2hdGiiGGymiPlAsFzsmtgDyh1J7rWPf5A-c_uce2dHskSLb1DF6w50EWkL6fRcfBhXUXO37BKWszYkB1GN1uBkli5bb2f_yFlU8BjySaw6iL5J1J20zKhPy6e0qS8vG69JKy872TBMat82xtChyaHVFkGXen5wF_bkdfIvqvmi1xzmiS2rK4kkWfPLX_S0isNjjYguqiMbJ-ZitIi0my6FkskvgpWOUBjz4R2JmQ3tppoHTVqjGslVXPVaVxKbBnb08odNlS0E0WjzwB9AYtSEUibKNUIBp_g1wyb2DzoZEX8MsSFuZDnt-N3Boh8-BSxVC2Iyx20jK7I4F8t3CMtMaHpkM-CF6yYJR_0pbYHyPcGNwxBKpckDjiA55gFj77ZQ8G18jnLumShoWiptPr1BN8oGjuKBUbKmAzUyoF82krM4fPS-jC2Fa91cPG5ylIAmW1dnkcKFeg6jka3QKpn26RZEW0Clxz6_mEF86ptFPy7-UV9PiQi8KIfLscnsEtzpFg6lVWKdheHF_rTUywbTTeLR5HUXFghxWquzEauWfKMsVmhdwSbzW6g728SZF4t8EexY1C11xXOFofqekj2vBj-OhEf0i0iZh9t7_gfUA7xjTHurZ2eD3e9PyaAKje3HsavcOMuiFe8lQYj5l4xHx0VayzkpKlcm2geq9aM0dWN0LOi04XJxTHeunjAdKfM81L555ZrHDRA7XdqwIqVVBhEnekGwA3jKwargHuLwkctE3gy6u8AR_vk2bBsYQzpzNkzi3Jr4mtXycimCw6CpJKRgxIgTiokSlAYQKoz_f2TpoZ-B37glm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7ACD 42 B
64 B 18ms
18ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFoM6FeLDiNFMgvoh8F6I5sLFAbmo5LD_f0nPWaRqphYy5QJKQKuZxBRaZBin32eFRlJcCMk-u-RrH7PFv_9Vd-QwN9LEbBCr8CWsvIpkiGebz34dd&sig=Cg0ArKJSzDEjPPEariX0EAE&id=lidar2&mcvt=1000&p=954,1070,1204,1370&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220316&bin=7&avms=nio&bs=1600,1200&mc=0.98&vu=1&app=0&itpl=3&adk=1072162708&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647485689169&rpt=66&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C131 42 B
64 B 20ms
19ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssj755nWoAMBtXmY0q2KBj_YRJJK5tsJNf0iSjW5CkowRuzOa3ASSp7HmyPYCYcihqlEAwaLuVgZf9JoG6_VnnoPvEOYZmuFj33IX67se6-2nPnGRtOLw&sai=AMfl-YQ4S7FkiphkMJknAEXVIzSRlVa2M25XPLWdmPcRXP3VrDvgfUBX68BlyeZ6oFg0AaVCLP8SS6_5ZUEF6fLeRo9qZFH0WwjwPL7o_r4vFiJje9LkK09WJVBrgYmu&sig=Cg0ArKJSzCFo7CLIHjzFEAE&cid=CAASUORoRP06mmWa-41TPSb6l-rlgmq3a2CROEkdPmkqKFxlz455QV93HiOzTvk7Og5acShi_m9VaFY6rE2q2DtVDSn40p1g13h8pCwLHW-MqH9J&id=ampim&o=1070,314&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=228&tls=1228&g=100&h=100&tt=1228&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=756787797

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Mar 2022 02:54:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 87ms
87ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=6c66cc21-36e8-3035-c89b-8fce318a7b4e&tv=%7Bc:75fr24,pingTime:1,time:1050,type:p,clog:%5B%7Bpiv:98,vs:i,r:,w:300,h:250,t:36%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1050,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:36,wc:0.0.1600.1200,ac:1070.954.300.250,am:i,cc:1070.954.300.250,piv:98,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1021~75%5D,as:%5B1021~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:109,fm:t0iS3xg+111%7C121%7C13%7C14%7C15%7C16%7C17%7C181%7C182%7C19%7C1a*.11046%7C1a1,idMap:1a*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:50 GMT
X-Server-Name: dt45.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 86ms
85ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=6c66cc21-36e8-3035-c89b-8fce318a7b4e&tv=%7Bc:75frb7,pingTime:-10,time:1611,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85OS4wLjQ4NDQuNTEgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1647485689082%7C%7C4b6fab8c158f0cded56eb8b14f76d3a6%7C%7C6b9a00393fb1607b0ada13520f814ab5%7C%7C3f6d49a3e7eb5561b3f3136e1f6c5c39%7C%7C12494e3259043c5d0ae5fd3500c7a686%7C%7Ca0ad7f9379b3678e05767f094daf0ec3%7C%7Cbc945a2be781a61b34391e45358fa991%7C%7C1035b0473979a49b630e0fe939e64711%7C%7C1629390669,sca:%7Bspg:62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c%7D%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:50 GMT
X-Server-Name: dt45.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
301 B 86ms
86ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=11046&asId=62bd6c19-4c2a-47d3-a8f5-23cc9d26fb5c&tv=%7Bc:75frUL,pingTime:5,time:5174,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:728,h:90,t:151%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:5174,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:151,wc:0.0.1600.1200,ac:436.163.728.90,am:i,cc:436.163.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5038~100%5D,as:%5B5038~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:94,fm:t0iS3lr+111%7C121%7C13%7C14%7C15%7C16%7C17%7C18*.11046%7C181%7C1a.11046,idMap:18*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.americanbanker.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Mar 2022 02:54:53 GMT
X-Server-Name: dt45.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: global.ib-ibi.com
URL: https://global.ib-ibi.com/image.sbmx?go=302927&pid=567&xid=8263666895936391270

Verdicts & Comments Add Verdict or Comment

203 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

147 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.americanbanker.com/payments/opinion	1969-12-31 23:59:59	Name: hasLiveRampMatch Value: true
.info.appdome.com/	1969-12-31 23:59:59	Name: __cfruid Value: 3cb288cb436606a198911739d967228b88dda324-1647485684
www.americanbanker.com/	1970-01-20 03:47:41	Name: sm_utm_source Value: hs_email
www.americanbanker.com/	1970-01-20 03:47:41	Name: sm_utm_medium Value: email
www.americanbanker.com/	1970-01-20 03:47:41	Name: sm_utm_campaign Value: 2021 Nov Outreach APJ banking
www.americanbanker.com/	1970-01-20 03:47:41	Name: sm_utm_content Value: 182937943
.americanbanker.com/	1970-01-20 10:23:41	Name: btIdentify Value: 84e373ae-c0f8-4d42-9a0c-af12d0550b14
.americanbanker.com/	1970-01-20 01:38:09	Name: _bts Value: da1058d6-1646-4114-a4f7-06e426d47487
.americanbanker.com/	1970-01-20 03:47:41	Name: _gcl_au Value: 1.1.1528546403.1647485687
.bing.com/	1970-01-20 10:59:41	Name: MUID Value: 38F47B1390AC60E03D406A7991276117
.americanbanker.com/	1970-01-20 19:09:17	Name: _ga Value: GA1.2.807543790.1647485687
.americanbanker.com/	1970-01-20 01:39:32	Name: _gid Value: GA1.2.95126325.1647485687
.americanbanker.com/	1970-01-20 01:39:32	Name: _uetsid Value: 9ac96fd0a59d11ec9a2c9f378ab7c623
.americanbanker.com/	1970-01-20 10:59:41	Name: _uetvid Value: 9ac99540a59d11ec912b57dfb6d31843
www.americanbanker.com/	1970-01-20 01:38:05	Name: __adblocker Value: false
www.americanbanker.com/	1969-12-31 23:59:59	Name: dpm_url_count Value: 1
.americanbanker.com/	1970-01-20 01:38:05	Name: _dc_gtm_UA-219761-28 Value: 1
.americanbanker.com/	1970-01-20 01:38:05	Name: _dc_gtm_UA-219761-100 Value: 1
.americanbanker.com/	1970-01-20 01:38:07	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://www.americanbanker.com/payments/opinion/new-bot-malware-leaves-financial-apps-dangerously-exposed?utm_campaign=2021%2520Nov%2520Outreach%2520APJ%2520banking&utm_medium=email&_hsmi=182937943&_hsenc=p2ANqtz-8ifo2kdmDQYt_ijnRH_fKQTV0d_Z5ODb6lzJegeW8Cd2L35UwT-_o6lVcdwmU79R0KodLeCqmqPBhhA2-SfFgpAGSH-Q&utm_content=182937943&utm_source=hs_email%22%2C%22sref%22:%22%22%2C%22sts%22:1647485686802%2C%22slts%22:0}
.americanbanker.com/	1970-01-20 11:07:29	Name: _parsely_visitor Value: {%22id%22:%22pid=cfa8874fd39fd8acfc32f83f37c2b8f3%22%2C%22session_count%22:1%2C%22last_session_ts%22:1647485686802}
.americanbanker.com/	1970-01-20 03:47:41	Name: _fbp Value: fb.1.1647485686828.1657690458
.doubleclick.net/	1970-01-20 10:59:41	Name: IDE Value: AHWqTUnXrTYymj_hABouMBiB-bEMBfp0saRbl6asdhxBydH1fkAEbL8iwyRgL055
.americanbanker.com/	1970-01-20 10:23:41	Name: _bti Value: %7B%22app_id%22%3A%22sourcemedia-prod%22%2C%22bsin%22%3A%22F5XBP7GkuLCe%2B3OA8NX5AbZvl%2Bj0V%2BIV%2B1wnvOmpJid1Ett9ifLwWDU7HQdbQ%2FpPSEOhPckTQmy3isj%2B5728qg%3D%3D%22%2C%22is_identified%22%3Afalse%7D
.tinypass.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 7A0C38A5FE036A1F0F78A1FBC742F96F
id.tinypass.com/	1970-01-20 01:38:06	Name: AWSELBCORS Value: D54D83371CA73269B30D9CD8F7A2329AB776287862FFD8DC0100DB03DE8A35C66583798973195732CA6DB3B8711DCD975AF2AE86F3A8FE378AF489D65EDC04F7F19A8249B5
.linkedin.com/	1970-01-20 02:21:17	Name: UserMatchHistory Value: AQL15K3fU_5JwgAAAX-VzJPe2WtxZ1bitCBQnSx40q4bkpv_2ea6RE8kGX9VZruRnPVsp2MDBCGnUA
.linkedin.com/	1970-01-20 02:21:17	Name: AnalyticsSyncHistory Value: AQKquWh7IJYTZAAAAX-VzJPeQyhOEWUmA-3IDa0ZaN85OsRzf8yOL8f1sN2IZRXhEG-naeH5MaprR5gP6UEWKA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 19:09:59	Name: bcookie Value: "v=2&f1f16ecb-ac1a-4ddc-8ac8-08a400ee9367"
.linkedin.com/	1970-01-20 01:39:32	Name: lidc Value: "b=OGST00:s=O:r=O:a=O:p=O:g=2675:u=1:x=1:i=1647485686:t=1647572086:v=2:sig=AQFCAnZ61--z-c4oKi87rj_NRvOTPyVS"
.adnxs.com/	1970-01-20 03:47:41	Name: uuid2 Value: 1358138099726111045
www.americanbanker.com/	1970-01-20 03:47:41	Name: __pnahc Value: 0
.americanbanker.com/	1970-01-20 01:38:07	Name: kw.session_ts Value: 1647485687070
.americanbanker.com/	1970-01-20 01:39:32	Name: kw.pv_session Value: 1
.americanbanker.com/	1970-01-20 01:38:07	Name: _sp_ses.52ee Value: *
.americanbanker.com/	1970-01-20 10:59:41	Name: _sp_id.52ee Value: a23ee341-5445-4cea-9eab-019a893a9b1e.1647485687.1.1647485687.1647485687.ab285774-d97c-47eb-9783-ddfff539c645
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 19:09:59	Name: bscookie Value: "v=1&2022031702544674e6978b-e914-48d8-8a8b-73f7a93c2fa6AQHU_JwFw4gugeJXThtlU0f6bkq_c0pd"
.linkedin.com/	1970-01-20 18:58:40	Name: li_gc Value: MTswOzE2NDc0ODU2ODY7MjswMjFZl5ruTcgRFq1eJltUeuo+B1iPx2JcUqKj0tkwMoiY0w==
.piano.io/	1970-01-20 01:38:07	Name: __cf_bm Value: 1yhZUX70Pbapdr6Uk5QhfwsJsePE1p4LVHPZ61SuQ2g-1647485687-0-AXN8eEAuekUrx4c8O2Cm8Tl9wSXuFPVEkFXDqafYug1GaPtzZzD/3POhhC7Br+iVr70VYMAHb6dR9A5ly01b2O0=
.americanbanker.com/	1970-01-20 19:09:17	Name: __tbc Value: %7Bkpex%7DweomXZhpHwB1b20ff3Gl69XwNvKcbgJseDkP-2YZIOBIYC4C7spk7AHGSlQHPDnd
.americanbanker.com/	1970-01-20 19:09:17	Name: cX_P Value: l0uefvll11ndl4ck
.americanbanker.com/	1970-01-20 02:21:17	Name: __pat Value: -14400000
.americanbanker.com/	1970-01-20 01:39:32	Name: __pvi Value: %7B%22id%22%3A%22v-l0uefvlpsl0jw37t%22%2C%22domain%22%3A%22.americanbanker.com%22%2C%22time%22%3A1647485687243%7D
.americanbanker.com/	1970-01-20 19:09:17	Name: xbc Value: %7Bkpex%7D9-UBBzDYtnhBURn3SEyUTGuWevfiusTOJ9oMj0kavG4qN4VCy14z6Y85z0xbGxXGyp6f-4i2T9gVNfBqbuvkeE1ncfRqZ7MJKlRZDUj-lmMkzBII6cJA-aloWPI2cZb_tXaiYED2qpKq-WoD99uSA_XmZLABJw7qfb9ycy2poN9A0hQ_om_uBhfyNosTBD-mXOH4QVR7qu7Aag1sTs2fFfgYaEPKMySLPkEVOllLLKfLS7u6UmeBJRvReAqsCznHkHOdbSQpRWm6R6ExMy9hwxqR4NG_OsvC3sL51DWdyn2Y7ItAHTmIZYDCQ4sQnDpzHKzUOBRbToiy4cQ4DN8N29EkHc3lakkEDWKDvSqGDVgJxm6QLqKuPGGOA3ZvPDYeZROHn8C82Un-ecO-tDThg6V9JkXehvS7Nu1vJcdgllZE8KYJoRDW5FPLqEaN8xvpvtzNfNGBVSOw5kjPxzSsQv0CCY522smYGueCkRjWqftZOPlbj-eMrNOYER_MiljLrh7-RRy8-CkwNAVw-d_rRjXcTiYVenCz5zefXJsjkDdCFGEHcUnK-K5Ho9OvLWEmSpeX8lf-cmN1Y8JPTmZSkVpBWyhmXde9MHTwel0neDuI6ERs79wW9Rn-OS65_ozS7m-203tRw-JXJrv3XI6OKgBUL7bqCjR_3zSDdlKRZLM
www.americanbanker.com/	1969-12-31 23:59:59	Name: _pc_editors_pick_modal Value: true
www.americanbanker.com/	1970-01-20 01:39:32	Name: _pc_subscription_promo Value: true
.americanbanker.com/	1969-12-31 23:59:59	Name: cX_S Value: l0uefw2zyaoq89dj
.adform.net/	1970-01-20 02:22:40	Name: C Value: 1
.dpmsrv.com/	1970-04-11 02:04:45	Name: dpm_pxl Value: 33d595b23eef8470d0e46337979dcdef581453ec
.dpmsrv.com/	1970-04-11 02:04:45	Name: dpm_pxl_aid Value: 1358138099726111045
.adform.net/	1970-01-20 03:04:29	Name: uid Value: 8263666895936391270
.adform.net/	1970-01-20 01:39:32	Name: CM Value: 1\|1
.tinypass.com/	1970-01-21 13:38:05	Name: LANG Value: en_US
.cxense.com/	1970-01-20 10:23:41	Name: gckp Value: 32trephjuhlcu3q5iatzsbigx9
.americanbanker.com/	1970-01-20 10:23:41	Name: cX_G Value: cx%3A2nyoxfh1f9j283iqosvl6daslm%3Ahgb0m6j96rv6
.adform.net/	1970-01-20 01:58:15	Name: CM14 Value: 1647572087_1647485687_1_Hu7u4e4e4e7u7u4REREeERERERHhEQ
.americanbanker.com/	1970-01-20 02:21:17	Name: _lo_bn Value: 1
.seadform.net/	1970-01-20 03:04:26	Name: uid Value: 8263666895936391270
.tinypass.com/	1970-01-20 01:39:32	Name: LANG_CHANGED Value: en_US
.adscale.de/	1970-01-20 10:20:21	Name: uu Value: 791566c0a74641bdbc3968ee4fae9364
.adscale.de/	1970-01-20 10:20:21	Name: cct Value: 1647485687746
.casalemedia.com/	1970-01-20 10:23:41	Name: CMID Value: YjKi9zkIRNr1yrBwhiRoMAAA
.casalemedia.com/	1970-01-20 03:47:41	Name: CMPS Value: 3240
.advertising.com/	1970-01-20 10:25:08	Name: APID Value: UP9b6b6d79-a59d-11ec-a432-06bfa37d4102
.yieldlab.net/	1970-01-20 10:23:41	Name: id Value: 46522351-8fd6-4dbf-a25a-cc1ca3b07568
.eyeota.net/	1970-01-20 01:38:06	Name: SERVERID Value: 16408~DM
.ih.adscale.de/	1970-01-20 10:20:21	Name: tu Value: 4#1990967001#42~8263666895936391270~457634~0~0
.casalemedia.com/	1970-01-20 03:47:41	Name: CMPRO Value: 1149
.casalemedia.com/	1970-01-20 01:39:32	Name: CMST Value: YjKi92IyovcA
.casalemedia.com/	1970-01-20 10:23:41	Name: CMRUM3 Value: 6f6232a2f727608263666895936391270
.360yield.com/	1970-01-20 03:47:41	Name: tuuid Value: 14a7ccf3-d651-402e-b8ee-ea506931a912
.360yield.com/	1970-01-20 03:47:41	Name: tuuid_lu Value: 1647485687
.semasio.net/	1970-01-20 10:23:41	Name: SEUNCY Value: 511A8BFB50A8BBA9
ads.stickyadstv.com/	1970-01-20 03:04:29	Name: uid-bp-617 Value: 8263666895936391270
ads.stickyadstv.com/	1970-01-20 02:21:17	Name: UID Value: 142f2ef10d49cf182c0f1d370e6a520
ads.stickyadstv.com/	1969-12-31 23:59:59	Name: sessionId Value: 7ab43fcff13d13e91a4cf32dbf42f8c
.360yield.com/	1970-01-20 03:47:41	Name: um Value: !42,217mdYc1IgRJEtaakCtXmqfHBWHO96XcgL6hLhNprcQU,1648695287
.360yield.com/	1970-01-20 03:47:41	Name: umeh Value: !42,0,1709693687,-1
.exelator.com/	1970-01-20 04:30:53	Name: EE Value: "743e8ed2c7e50d3a0c2e15fe0410ecb9"
cm.adsafety.net/	1970-01-20 10:23:41	Name: UID Value: CM1202203170223ecf03fe663dcdde99
.adsafety.net/	1970-01-20 10:23:41	Name: cm_uid Value: CM1202203170223ecf03fe663dcdde99
.onaudience.com/	1970-01-20 10:23:41	Name: cookie Value: d535434c9aeaad56
.onaudience.com/	1970-01-20 01:39:32	Name: done_redirects104 Value: 1
.exelator.com/	1970-01-20 04:30:53	Name: ud Value: "eJxrXxzq6XKLQcHcxDjVIjXFKNk81dQgxTjRINko1dA0LdXAxNAgNTnJcnFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq0yNJySX5RZvoid6fFRSlpDItKik8F7z%252F1DACaXSsy"
.quantserve.com/	1970-01-20 03:47:41	Name: d Value: EIQBBgHXJQISAa70iw2e6bRu
.quantserve.com/	1970-01-20 11:08:20	Name: mc Value: 6232a2f7-de6ff-f0f7f-c890a
.yahoo.com/	1970-01-20 10:24:03	Name: A3 Value: d=AQABBPeiMmICECxqqphr1LvEQsX7zJLu7KsFEgEBAQH0M2I8YgAAAAAA_eMAAA&S=AQAAAiS9jOLxoyj-ShSQ89zL6gc
.analytics.yahoo.com/	1970-01-20 10:23:41	Name: IDSYNC Value: 1760~23sq
.crwdcntrl.net/	1970-01-20 08:06:51	Name: _cc_dc Value: 1
.crwdcntrl.net/	1970-01-20 08:06:51	Name: _cc_id Value: a0f5869ceb8c6a2de291c3bed95c6040
tags.adsafety.net/	1970-01-20 10:23:41	Name: UID Value: 9423fc829f1b9222c2fa0ae50061de55
tags.adsafety.net/	1970-01-20 10:23:41	Name: DID Value: 9423fc829f1b9222c2fa0ae50061de55
tags.adsafety.net/	1970-01-20 10:23:41	Name: IDT Value: 100
tags.adsafety.net/	1970-01-20 10:23:41	Name: cookie_ver Value: 2
tags.adsafety.net/	1970-01-20 02:21:17	Name: block_reset Value: 1
.adsafety.net/	1970-01-20 10:23:41	Name: ct_uid Value: 9423fc829f1b9222c2fa0ae50061de55
.adsafety.net/	1970-01-20 10:23:41	Name: ct_did Value: 9423fc829f1b9222c2fa0ae50061de55
.adsafety.net/	1970-01-20 10:23:41	Name: ct_idt Value: 100
.onaudience.com/	1970-01-20 01:39:32	Name: done_redirects161 Value: 1
cm.adsafety.net/	1970-01-20 10:23:41	Name: permanent Value: 1
.krxd.net/	1970-01-20 05:57:17	Name: _kuid_ Value: OuNzcV9i
ads.smartstream.tv/	1970-01-20 10:23:41	Name: DID Value: 9423fc829f1b9222c2fa0ae50061de55
ads.smartstream.tv/	1970-01-20 10:23:41	Name: idt Value: 100
ads.smartstream.tv/	1970-01-20 10:23:41	Name: permanent Value: 1
ads.smartstream.tv/	1970-01-20 02:21:17	Name: cm_uid Value: CM1202203170223ecf03fe663dcdde99
.onaudience.com/	1970-01-20 01:39:32	Name: done_redirects219 Value: 1
.mathtag.com/	1970-01-20 11:04:00	Name: uuid Value: 8e3d6232-a2f7-4100-8ac7-ffa37a5ad201
.zeotap.com/	1970-01-20 10:23:41	Name: zc Value: 3292bba1-3c4c-4053-5889-9c8f51c8073a
.zeotap.com/	1970-01-20 01:39:32	Name: zsc Value: %B7%C4l%29g%DF%89X%DE%83%85%3Bu%B3%01.%94%B6%9EQ%B6v%27%90%04%AF%F4%3F1p%0E%D0%1F%AD%84%B5%BB%83r%21%C3%93j%0B%D1%AB%BAI%B7%C6%BE%E9%1D%40%0C%80o%2A%DEF%DB%F1%24%3F%95%B0%5Dl%EF%217%60.%05%A7V4%BE%90%A4M%93%F0
.agkn.com/	1970-01-20 10:23:41	Name: ab Value: 0001%3APE%2BPt%2BFv5sTDPxv28Hw1%2Bc79hSxgxMw7
.adnxs.com/	1970-01-20 03:47:41	Name: anj Value: dTM7k!M41.CxrEQF']wIg2ImULl8(b!EKyr!GY-CIKX0PT6!Ag3N^JF4KhEE4ut1z4Yb.x4/kiBMj?/]5D8-@P)[Q]P)j.gnTqTD
.adfarm1.adition.com/	1970-01-20 03:47:41	Name: UserID1 Value: 7075897150589302932
.bidswitch.net/	1970-01-20 10:23:41	Name: tuuid Value: d81120b2-13b5-491e-8547-1f50aae82e54
.bidswitch.net/	1970-01-20 10:23:41	Name: c Value: 1647485688
.bidswitch.net/	1970-01-20 10:23:41	Name: tuuid_lu Value: 1647485688
.demdex.net/	1970-01-20 05:57:17	Name: demdex Value: 54959948143446757721325264659840586056
.dpmsrv.com/	1970-04-11 02:04:45	Name: xdpm_segsid_342 Value: 7568712%2C6745137%2C6451507
.dpmsrv.com/	1970-04-11 02:04:45	Name: xdpm_segs_342 Value:
.adsrvr.org/	1970-01-20 10:23:41	Name: TDID Value: f892a337-c834-4d10-863c-48e109458ab5
.w55c.net/	1970-01-20 11:08:20	Name: wfivefivec Value: SSH1wFH41NuGhO5
.w55c.net/	1970-01-20 02:21:17	Name: matchadform Value: 5
.dpm.demdex.net/	1970-01-20 05:57:17	Name: dpm Value: 54959948143446757721325264659840586056
.americanbanker.com/	1970-01-20 10:59:41	Name: __gads Value: ID=3d85aa6ae528a534:T=1647485687:S=ALNI_MYQ-WHn_4jXt3yYKJ7u9nguNdC_TA
.adsrvr.org/	1970-01-20 10:23:41	Name: TDCPM Value: CAEYBSABKAIyCwje1Lmvh_PDOhAFOAE.
.id5-sync.com/	1970-01-20 01:38:05	Name: cf Value:
.id5-sync.com/	1970-01-20 01:38:05	Name: cip Value:
.id5-sync.com/	1970-01-20 01:38:05	Name: cnac Value:
.id5-sync.com/	1970-01-20 01:38:05	Name: car Value:
.id5-sync.com/	1970-01-20 01:38:05	Name: gdpr Value:
.id5-sync.com/	1970-01-20 01:38:05	Name: callback Value:
.weborama.fr/	1970-01-20 11:04:00	Name: AFFICHE_W Value: v8tO-Gqf3Oq-22
.3lift.com/	1970-01-20 03:47:41	Name: tluid Value: 3212162628214270083169
.1dmp.io/	1970-01-20 10:23:41	Name: uid Value: 9bbce860-a59d-11ec-acfd-901b0e8b2a6e
.tapad.com/	1970-01-20 03:04:29	Name: TapAd_TS Value: 1647485688320
.tapad.com/	1970-01-20 03:04:29	Name: TapAd_DID Value: 515e4e45-d9d6-4760-8528-99044cd62fa2
.pubmatic.com/	1970-01-20 02:21:17	Name: KRTBCOOKIE_391 Value: 22924-8263666895936391270&KRTB&23263-8263666895936391270
.pubmatic.com/	1970-01-20 02:21:17	Name: PugT Value: 1647485687
.pubmatic.com/	1970-01-20 03:47:41	Name: PUBMDCID Value: 3
cm.adsafety.net/	1970-01-20 10:23:41	Name: cache0 Value: KzFHSk9wMUZsMkpMMjlsMzBXenlaMnlCNG1jSzVwRFVvK0ZxdkFIYytjVFJKaHdKMjJMdmNwdjFXUGd3UkcyRzRZL1NVeDhuUXk4OTcrelhjNldkRk5HY2V1S2t3cFBwWi9USXlFcHVINDBQNmhXS0RGWHBqV3BDbjZCTlNWQXdRTEFBVVBBZldWbUxZK28wTlRwRXBSeGk3YlNVMWRla1YvVFJwRG1JWE9IUTZFbDdTK2dQdWVORml3L2tOMGxKMUNocHBKTDh3RXliN3lqdUNzRE1SVFNVbjRtU09XcVpNSzVOaGNTdVZkbFF6R2VaQ1FnVTFKR05FUkxUTHhmWUNLZU1pNk9nNkRBK05EWFY4bFVuMmI5anpxUk9IUDRLUmJnZ1hpNnFsRmRyYzBpTVdPU0lRQTc2SnVmK2NRQWJTV09QaHdRZmk1eFBiTkNUYkFnRkJmWTY1aExPSlh2bmZJR2JKMWJBeDloZ0c2RXNrNnBnNENzL0Z6azA4a01ydHloK0kxSTcyV0hlajhyWmNraDc2WVVMNEdPU05IM2RpUjhLVE13cWkvaVhWei9sek43S2RiVU9sVmhrdDFZTkFGdXY5WXBaSUtVSFhCL1BqdStlNWUzOWpkSG0vb3FGZ0EvbkkyN3RmaVdFTWVWbGl2dUdDdXhzRmV5SUxHdVhqdzN2eGpuMFpKZjBQbWpDYTI2V3BYR1JLdW4zRy9Ib3dXVklMUnNCSHYzRXhSN0dHMmZQZjRqZzMyaGlOTTRObkFJSHFIanhRTUt0cEFDQWt6SmVEeVBrQXBhaGRkdFA0TUpGdzlxTDNkSHBibHIwb0ZVWW9yRlJiSU93QXdPK05ZM0k2dktFVWRuYXEwazFCM0VkQzhVd0tURUhCNkNiRVhwTDhZbTk3Uy9ub3puNEhvUXlBZER5MFpZbTk4b0pDd0ExWHVpbE5lZUJSMU8xK3Z1bUw4U3VVM2dhMnFBRWNMVlpUaS9rVnJuQkoxVmZOcGRqeXp3VkNFRi9DWUJkV2NVbStqNi9qL2tDS252RXVRVml0VkpZSmJXamZTV3hUQmY1V0UxWTZ6K3JMa0JUbUZGRHRXQWpRUDVCcHZTRmZFdEdHNDZhWTZPUVRRZHBlRTR3c0pva3pMVVpiTklqU1h2Z0ZZZDJ0U3VWeEZ6c3pibzY4bGxMNHpDNkZIcXg0MDFNU1RpRlRKbE41dHgwQTNlRDUxODFGR1ZXMHRWRUJIemZObFhMUjRqNVVjQnBPM2ZvTUFWc1kybE5CTU9CSWp1QUpMb0FzeXlzeHFMR0VuUEN1U1dZS09Ham5FNmVFdEd1eUdiTmRoak5teTlITTF3UGh1bjdFMmdvNnI2Zg%3D%3D
.tapad.com/	1970-01-20 03:04:29	Name: TapAd_3WAY_SYNCS Value:
.audrte.com/	1970-01-20 01:59:41	Name: arcki2 Value: 27l9EkzNUvXRjmRk-1-ZvqjPw!20210804!1647485688317
.audrte.com/	1970-01-20 01:59:41	Name: arcki2_adform Value: 8263666895936391270!20210804!1647485688318
.audrte.com/	1970-01-20 01:48:10	Name: arcki2_TTT Value: 1647485688319!27l9EkzNUvXRjmRk-1-ZvqjPw!H4sIAAAAAAAAACWWMZIuNwiED6OYKkkghEIHDlwuO3C9CwgQ9z/C61lvsv/uzK+B5utmur7JeYNyvkNcfunMcckPRy7OWcPb2XnWlEl7PCU5d9K5uxMf8Yx4lm+39HRVudTPS2K3Q1f80JSxZ4lt3tp6H1w6nfrrTjJWkV3pFBqxp7PeU229cOFatMoWyZpJNvqkjm/rS5XYt0WaeQ+lJfFIwpjcatLEg4tznamn7S02E+3UuBcnVdHJHbiJOcd76p7tuuvtV2itPkh0CApnpyEyt28/4ytc0IbwIiixiBOf7JxHZ8k6dV3ynDbfCjsxKZ4eEn+LfBiateOWq57Xat7fFDtGeXGIDLRwrjOZXNZz9dmsVncoZFjfTYLHQYxTyrSGhk7LsZObpMuVT4IdQgLJUNPEKN+7UbjllkGCt/ne76SD2cnB7PrtZDogjJ6BKtt9sxYGRIEf4omJnLE2eZc6nQs/2t7MuBs9sTIG/E3x6l50q1fM2Jx5G54v1zXJnwTGwkq2A7PpscQgtXm1vgqQ9EOlKEw+APztAW1P+OJlbtzAXM1TQjgY3XVXgkxCb6g9Tz1V2ZZh/MOEMFCDTh8FA7f3Wak+V2f2tr+Le33QcocEGLWfuLQ0TwAQyFstTQTSY6IOHSSgE8qA7OhnZ+nq7zSd12sspnQHdFUYWz5GC9DUeGXxadGzsjZQO2PiUjJ0EqYRll3elZzaQt3u3PgqyCf8C9UBNXqV8sS4ulibbA+oAWqASiwDEtwtBKFz7/uRHY2FFXoqZjd/ToL2/FV3AMo7t3hUG/J8MArHl9Adiga52gmgPIClGxg2/HFB6aHgC3y/QLB5Yb7wo/vC3JjdXG/3qR8Auj+eAB3aIteu5nMyb259XAYTcPBTSHAEJ+H5GEvs4Vtt62i3j24OD/RIjGVakNkCFGMUnGcTnDflIVEGHi+mLBgqWeEmgz1qdN02ovW3NoYkVGejJvgUffLBlPHLx1S+ryEWrCIT5jQYAaEEywmguyG+s69Yq8EFKQfmV//GujjILzJxYFpfh8fHhu84ukOnqfZlJm43gesTNfZdDHYWyJzrbEtIXEiVfjZdDkfIFCwOFIasplvDFerIRmPSP97gS2RiINH2fMCg2SsPn0bzC15xRAt8+2jcMZGqtpRRE5zW60fxa4AOAwReAxHKfvBh9XmbdDByhxOY+rp7gsBIVM89HdEyLATdyQPJQiqAkj/QP7KpAhDPswbqaRmobCSypsN3sqNQUxi9NV7EHbsqWgnktkqIuZVwxmcE5DiEhqNyHgy2icFFHxvZCxRsK2QF5v2QflGi6nxbSiKvYE6cNnCSXSiugA7mOwu5b9WbR2KM9ugB9q+7oJu+YcP+sfpkjtd+PlyMPbah8G/B+DoLzSLZTPb5LGXx5jDsAQiOVDkIjLuRP76P7/2Nj1d7WEwvkOPByETpsJQJbIhoL0XhoG41VkRCF/i2d5CJpUT3ffuum0IKX4Kw/+vff/747+8/fxEP4Dv77JhYC8OdawFFYIdLpV+M4E8YI/hMBmnN7WGz1YazQBEjVelbw7Qu4hwZMbBhkcmrw2n2BRo8xGsgRi7u7McmnD1cOjbzjQM705GPV3wm63WxmV02LsFv1kyjM5YnUMfa+X8zT0ysbuyc3L0z1Du7IyaLXn7RVg8j+MkSXDgvPmGslUXiFQKREF9wH0QbtgbwxwtC9g/FxFpyHfGwuQH6JzHciJDcwDcEazbhwmii/b6y+a0IjH0m9unEgyGMzQAbWKlN+xuVb2A7OChTSboDsq0DppMFxMKyvgciYn3qQALDxriBifaR6RGlgReBi1IfohjXB7qbaMELljsP07WBytZuNwCGMlPMibEAK7x31IP53xc0wjxWm4idAgEU9hDX3A2UQdF3Pjui9+2voZQ4B/t6z/Wl+8XSzYd3ocLyL7CfMpqvWpJAxfkkPOTwkOCtJ+76uN6FJdDmT86hZiQGUEy8f7ljY8y5UZIVvw3zj/69Yjw87nthKtx0rD/q6qX4n2+p3zsRA74zCgAA
.audrte.com/	1970-01-20 01:59:41	Name: arcki2_ddp Value: CAESEA6ve-S4VaLcBPd9aCT6CmI!20210804!1647485688435
.doubleclick.net/	1970-01-20 01:38:09	Name: DSID Value: NO_DATA
www.americanbanker.com/	1969-12-31 23:59:59	Name: dpm_time_site Value: 6.008

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.googleadservices.com/pagead/conversion_async.js(Line 71) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://idsync.rlcdn.com/423396.gif?partner_uid=1358138099726111045 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://idsync.rlcdn.com/398366.gif?partner_uid=8263666895936391270 Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: https://global.ib-ibi.com/image.sbmx?go=302927&pid=567&xid=8263666895936391270 Message: Failed to load resource: net::ERR_CONNECTION_RESET
other	warning	URL: https://cdn.ampproject.org/rtv/012202142035000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

96a69ad6f12482b019c3c1c368f47dee.safeframe.googlesyndication.com
a.audrte.com
a.dpmsrv.com
a.teads.tv
a1.seadform.net
a2.adform.net
aa.agkn.com
ad.360yield.com
ad.yieldlab.net
ads.smartstream.tv
ads.stickyadstv.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
api.adrtx.net
api.zetaglobal.net
arizent.brightspotcdn.com
bat.bing.com
beacon.krxd.net
buy.tinypass.com
c1.adform.net
c2.piano.io
cdn.adsafeprotected.com
cdn.ampproject.org
cdn.boomtrain.com
cdn.cxense.com
cdn.keywee.co
cdn.parsely.com
cdn.tinypass.com
cm.adsafety.net
cm.g.doubleclick.net
cm.smartstream.tv
comcluster.cxense.com
connect.facebook.net
d10lpsik1i8c69.cloudfront.net
d1z2jf7jlzjs58.cloudfront.net
d20519brkbo4nz.cloudfront.net
dmp.adform.net
dpm.demdex.net
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
e1.emxdgt.com
eb2.3lift.com
eu-u.openx.net
events.api.boomtrain.com
experience.tinypass.com
fonts.googleapis.com
fonts.gstatic.com
global.ib-ibi.com
googleads.g.doubleclick.net
ib.adnxs.com
id.cxense.com
id.tinypass.com
id5-sync.com
idsync.rlcdn.com
ih.adscale.de
images.newsletters.arizent.com
info.appdome.com
load77.exelator.com
loada.exelator.com
loadm.exelator.com
match.adsrvr.org
match.contentexchange.me
ml314.com
mwzeom.zeotap.com
p1.parsely.com
p1cluster.cxense.com
pagead2.googlesyndication.com
pdw-adf.userreport.com
people.api.boomtrain.com
pixel.adsafeprotected.com
pixel.advertising.com
pixel.keywee.co
pixel.mathtag.com
pixel.onaudience.com
pixel.quantserve.com
pixel.tapad.com
pm.w55c.net
polyfill.io
ps.eyeota.net
px.ads.linkedin.com
px4.ads.linkedin.com
redirect.frontend.weborama.fr
rtb-csync.smartadserver.com
rules.quantcount.com
s.ad.smaato.net
s.dpmsrv.com
s2.adform.net
s3-eu-west-1.amazonaws.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
settings.luckyorange.com
settings.luckyorange.net
simage2.pubmatic.com
snap.licdn.com
spl.zeotap.com
static.adsafeprotected.com
stats.g.doubleclick.net
sync.1dmp.io
sync.crwdcntrl.net
sync.teads.tv
t.teads.tv
tags.adsafety.net
tags.bluekai.com
token.rubiconproject.com
tpc.googlesyndication.com
uipglob.semasio.net
unpkg.com
ups.analytics.yahoo.com
vjs.zencdn.net
www.americanbanker.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.npttech.com
x.bidswitch.net
global.ib-ibi.com
104.111.218.85
104.111.242.245
104.244.36.20
104.26.11.16
104.89.42.102
108.156.253.115
13.107.42.14
13.224.195.112
13.248.245.213
13.32.99.47
136.243.148.229
139.162.146.37
141.94.170.77
142.250.185.194
142.250.185.226
147.75.83.64
172.217.18.98
18.159.83.65
18.184.216.10
18.195.155.181
18.64.115.91
18.66.122.124
18.66.245.59
18.66.248.66
184.30.20.207
184.30.21.51
185.167.164.39
185.33.220.100
185.33.220.243
185.64.189.110
185.86.137.110
2.18.232.7
2.21.141.232
2.21.142.210
2600:9000:2156:3400:8:48e:53c0:93a1
2600:9000:2156:5c00:6:44e3:f8c0:93a1
2600:9000:223f:1a00:1b:5138:8a40:93a1
2600:9000:2250:1000:8:2b19:8600:93a1
2600:9000:225f:7800:e:ec66:e40:93a1
2600:9000:2490:8200:18:6c16:27c0:93a1
2606:2c40::c73c:67e1
2606:4700:10::ac43:db6
2606:4700:3030::6815:5476
2606:4700::6810:2a41
2606:4700::6810:7eaf
2606:4700::6811:b6b1
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:801::2003
2a00:1450:4001:803::2001
2a00:1450:4001:810::2002
2a00:1450:4001:810::200e
2a00:1450:4001:813::2008
2a00:1450:4001:827::2002
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::200a
2a00:1450:4001:830::2001
2a00:1450:4001:830::2003
2a00:1450:4001:831::2001
2a00:1450:400c:c04::9c
2a00:1450:400e:811::2004
2a02:26f0:6c00:2bf::268b
2a02:26f0:6c00::210:ba0a
2a02:6ea0:c700::4
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42:200::282
2a04:4e42:200::729
3.120.46.173
3.126.56.137
3.234.21.226
3.33.220.150
3.68.148.208
34.107.203.234
34.206.192.53
34.248.186.252
34.252.195.101
35.172.177.82
35.190.16.14
35.211.178.172
35.227.248.159
35.244.159.8
35.244.174.68
37.157.3.29
37.157.4.28
37.157.5.72
46.19.11.36
51.77.65.171
52.18.8.201
52.205.167.202
52.208.103.128
52.215.106.171
52.218.108.67
52.222.214.67
52.222.250.115
52.58.193.70
54.159.47.124
54.171.37.193
54.36.109.46
54.76.102.147
54.78.254.47
54.80.32.197
54.88.65.136
69.173.144.139
77.243.60.138
80.82.217.93
80.85.85.173
85.114.159.93
00ecf4c43e50bff8f100ba0572c369f96771b38cd9317edd5c29f257cf0aad68
0392529834cda04a9e7663ce2ac147b952e40f4f9c22e54c251d3554229bcd51
03d04277224f8a8dc50f9d3e6ebc1379c33d788c8333d15aea5d63829a5bac12
08664859baab5ed98f0bf818ed77e38464ff1826dc6406d5ecbd651409afbd92
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0afbf3e3889e23615b945ecd1920c1725f6f61d8563799f866f3ba2d1738c56a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
113e77e4e7763582965aebeb7f66945f0a7af85429d5bebe831ee7dfa03d3750
172d9fd9a11849f24d3f95bdeed1cc4e8939fe29d4d2cd3c89185b974645e282
1ae7d16f87ca137f509bbab628546e72f09920ad639f4253a2286edc6086f1cf
1af5a3983fc18ecbd557e0840c2a3c25ae6ce1c37dfadffd4ec19a6224c4a9e2
1b1a289c9e167bd1732c08fc6fdb8b6a169e6fad92f5bbcb44aea5c40fc4f93f
1e02189b6990b38c43207a8c0c206a2fda1833e7b7401fa42af72671e62f43a5
1f2b6c5613e703f11e27309ad9e7115cabb98e70acb07b7417a3e68b6e083e24
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
27e93d58299bbec64669d53c70f172936cb995c8ef3f168847e2636614db4ccc
2afcabe2eb6314148dfd9dfdec1333b973d97d0780cc08fddab8501afbb013e9
2b6a7289f2e184fc952db4d52a3e4167ae036b45296c178dbc139d0fa03cd32b
2c88d578e25dbe2172403b1059bce6e5c80a308409f6446b433acc32505451c9
2d5f7ed178594d09e25e87cba0e328167a6e48d2508b4a4898ee7f05c21c0a69
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ef6b24ec78bb3ac4bdfa91d2abf4d9f2d4b543ad54c411d50e4307fc8677110
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
3110966fa73dac64901ac2cec67656155bb9717286b7b0da0544cdd8ae7c888d
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32b8fae56a7edbfe89e7f7fd22aa7df75546183f81660692c9cf03d3c8d914ba
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36aa85b5d97f76a381de07cdcc8f2bdecf7462384f8207f8a54d6aae1a40e4f6
3db41d0eda0f9e8dc220a241eda61aa948e78be9f994d81c72f07a0a73b60913
3e18d0e3dd548e9745884578e3cd9f0a492ddbb6f3b797db364b45bb16cadfb3
3e5bda772d0f79994e4f3b90ef08425b1966e5ab7641554a992dd8d62577e899
3e67d5e7c6ed686d4b765d4cdc5a8798b15966e72d1775e67b182b5bc6cfb6ef
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f43e960e0976386a239312dc9c6ddfecf73a9fc55174aa0a0b0983d8c4913e9
441e0467656e99238bd0547e5bdaac626664183d1f53903117e83dbfb2a45a87
471fbb0dad3625f39ecaf428053d38d7b3bfcebe919e5e462248ec3ccd700c46
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d44b03d4e4d1df9a852bf35460f5584c94b37c52d08742682a1a03d20d2f6d1
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
53223cc800efd65753dec3ab9c1099a86c6eb0f37a044c45e64b4cd8469a5181
535be4b8bedf82433d210152dfb19dd4eaf5796c4e61c2be1c2ed356827b5580
548cadb46f2b92d88090b94a52ee774cb37ac9be4e169afc7cb8a34b4cb047b5
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55b19948cff3942746a3871c137e7fc89a71d815d4a6e824b128f50d7da6a38b
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56662b5f7b2eec1a8a93958ecf81ad47fe8003e4b124525e038724d30033a62d
56b9d2d2849305918fe661cce7bdb8dcdbc83bb18c170884e625d2b2dd417210
59a717e69bec72ad009181785a1a65b674d1c01e77e04bdc718deb02a9b97671
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5d5c53dad11c0e74196616d7e2afe2ade42ff6e4084cae1a977b4e741359e6b2
5f792fe255fbfcd352fe4b2f759c95980e57d8d297939e12262d9be1e87f48c4
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62f586be8571b23584eb4a60a45a3157ff7c8388b1b1e3b4e8890e243b3e47de
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b377a566b9e8e639823a036e09dc56ec5b21a967ec6cdfd8cf1cd6758975e00
713fc9f8abe79cb80fc0207cbd722d60746e79796a09a208942691386394473a
7234816209f5ffff423a5ff520c6144d69a2443439607f7ace4ac68b32c65f60
734421d9e2fa5fe78c7bbd157c8de6a60bd1e0752c8abfcd2ca27f4a477ff2e5
73d48e5b77e6f9c20e969dedbd1b226f3904b843b532a3324297d145596e0564
740c2605af4c5bd694afeadf6d4477011db75ee6685135505e9715482659376c
7538e8f23fac8278c6027d8865bd1240514a3ff64b2c0af3b8ed3583e8ecce6b
7640e8d43665a07616ae1b3671ed16186ce3239c56776a5409673ceb955cb1b9
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
79baec8122da15d50dadf74e665e73e22592990e0241f5ebcc6e1210f468597f
7f2229ee55e618b13fbb84d73eb6c30c2c52511a43b5f14399befeb7df26964e
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
86a676d25a23c478b5064a3f6d9275179f67de2bbebe1bfa842719f73658650a
87237e67bda762f962161472cb82dda223c80fd8d4a8231d1eb0dde2c099591e
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ae5b95f24ba3bf0fa5b9b21ffca4ef8a683558ae0a4985abf835f7b71ad0579
8cd82b9ac21645fbf6d67a30ff6461227664ea71b83108d3c37a382aae02721c
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468
9117852bb64ba272123bad5259c90fe34447a8faf1eec13c115774b449c86022
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
91d6318841019326507fbe32112cf14d8dacf94d835fd53c9add806c49efd5c6
91faea346778821b9c435f9fbb67d14e8de887cc3e34fbe2e0d8e028ff946c21
92f65d433b40a4c4719b742357563d08b1c16d6396571933da9f02f9ef7424d8
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
978533e747c483e61d642a67d62c1319a217d2ce8ec65a68f193f9ccfa801a61
9ad17f3e4887e34b70f3ce18b89ab672b2f4d5db65237e58d704055fdc80d54c
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a66176229882908d4a804b804674b9fcfc534927ffc16fcd75a091f8019723d9
a735032007963319f839c1c7e6ef2d5ee5de6b8f222ee5f8f6b2d13e51bb71dc
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a79633578e877916dc850d090a6cbbb5c3d3001c10f869239e49aa102cedafa7
a865467f5bd0d9de0b206450d8b7acff6da5081d9c08cb7ed567a201aafe988c
ab171d3ce3f3d4deaab4717fddd7b5472ea04d8aefa77bc5934e71e7c39cd28e
ac2a6bdf3640e1213ba9a0a900ea6864a0274b080ba3bcf05ff245bfabb5eba0
af049cb9878153af170de62d07701370f22c95c9b652fe4f9fa078ea6d7034d4
b0dd2994a679ea0b4cfdb57f490a602ceaed5d9ccc9d440e19f03392eff06bd5
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4c9b940ff725bf2c2c73932c44d43b5ca6aa4302cd2e0ee6648d80ffa52c3ea
b7e65d41fb5860735c80ab7bcb1166b69fda442081426fc660cb678d04984205
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc33f45630834dda56c1077e99f591f439acf2792a8c9c1dd578ab3ea64e06d9
bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a
be36cf242d7b206d66842ab5b36af859b780372bba70cb5d72acda2626ffe52e
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c567d0068aa9d314d13047cf6af171cce476501aac5e5521bd2b2233b16fbce5
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cc439afff8beca06ec6cb95d2eb8721fc124eb6767662de5b3f0724bdd4ad8cd
cd5489dc88fd8e9e9ea9cacf8077f8b20446d10fab97186491fe62079051a10d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d081cdb1f07c54651c0d81b3d01122d66529fe9002f71e76931d54c38285e8ef
d29d84e698eb10452f97d8a6f249b73496beb844cef58e920e3832bd321d64a2
d5e1876373576f4110b6ad82c25041aa2e9762cc4a417939eeb20e654818a818
db46c5afd69f15b4408681f3f03ce5c4a3971d880f23b6b900b672430c7cb93b
dcda12d07c87e05830c2583e40a6357f21d3a9e5725018e02700455b47bd07c1
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e00cc6be2a728baaffc1e716b1cfceb1d42c88a76d2a655cf99267983f2794de
e17ef345a3598b3656b160ca57a1a44dab4365894b10c407f4257bb248504e94
e20f355c2087cd3cccd8bbbb7c149479e792a82b763353b0b0224f0aa1d09572
e2554e8949e7f36deaf93460f5cb9d6d43e817cf066fe0356dfc351a7e91f6a8
e3a56eb3953b87a7a04bc2930a7439066fc3130c5e3f9235125cd589efc11366
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f9a623a34f667704e0ab94a2ccdaa2d7dc53459f9b0eece212e1b4304ac4f9
ec70cfb1ce0aed65c10ebc00451fef58c830dbe4c02db1ba4115e7e3442c3c80
ed7385b2ca535f7f90bb14266ddd68d64393f41d1559cbb4af01ece4dd36b8fb
ee94251fea8b03da5d0dc6f8489a529c1a2d2a031d874b0ec61866784e3c73c3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0a36dc47096520228c4be03535d47c1deb217b539d6257287daefe739361a50
f2b761c524e3490154a26a97d6e8dcf7708749df5f96cdb696c19386be8d78c9
f95b2435a7b89e307f32fa5fcaa96fed294075356f6187b604221ddc950dcbe9
f9c321ffecd862a4a612a0077f84684747caefc667833f8e46e49ec71e5ba27e
fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b
fd63bb8c67fd70ea5f059b291a714c63aacd6893b8928a1bd65228b79db9f1b9
fe96e94ac39b56bb5bd99766bc5d38d1c929e6da6c1013fe8c870a5044b6a324
ff5aac9870f1410129ad566213ad662fb603e1ac7bb284712142b38426cbe9a2

www.americanbanker.com Open in urlscan Pro 18.66.122.124 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

240 Requests

86 %HTTPS

34 %IPv6

85 Domains

123 Subdomains

93 IPs

9 Countries

3886 kBTransfer

13090 kBSize

147 Cookies

15 Outgoing links

Page URL History

Redirected requests

240 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.americanbanker.com Open in urlscan Pro
18.66.122.124 Public Scan

Screenshot
Live screenshot

Full Image

240
Requests

86 %
HTTPS

34 %
IPv6

85
Domains

123
Subdomains

93
IPs

9
Countries

3886 kB
Transfer

13090 kB
Size

147
Cookies

240 HTTP transactions
4 data transactions