Submitted URL: https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43...
Effective URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&u...
Submission: On April 27 via api from DE

Summary

This website contacted 72 IPs in 8 countries across 69 domains to perform 372 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is securityaffairs.co.
TLS certificate: Issued by GeoTrust TLS DV RSA Mixed SHA256 2020... on March 24th 2021. Valid for: a year.
This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification


Live information

Domain & IP information

IP Address AS Autonomous System
1 2 199.60.103.2 209242 (CLOUDFLAR...)
46 2001:8d8:100f... 8560 (IONOS-AS ...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:20c... 16509 (AMAZON-02)
1 2600:9000:20c... 16509 (AMAZON-02)
13 104.108.144.24 16625 (AKAMAI-AS)
13 68.183.31.14 14061 (DIGITALOC...)
14 2606:2800:234... 15133 (EDGECAST)
10 192.0.77.2 2635 (AUTOMATTIC)
2 2a03:2880:f01... 32934 (FACEBOOK)
3 192.0.76.3 2635 (AUTOMATTIC)
3 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:20c... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 23.62.140.165 16625 (AKAMAI-AS)
1 2600:9000:20c... 16509 (AMAZON-02)
2 23.32.238.131 20940 (AKAMAI-ASN1)
10 2.18.235.93 16625 (AKAMAI-AS)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
1 2a03:2880:f01... 32934 (FACEBOOK)
1 2.16.186.67 20940 (AKAMAI-ASN1)
4 2606:4700:20:... 13335 (CLOUDFLAR...)
11 52.2.238.194 14618 (AMAZON-AES)
2 3.122.26.231 16509 (AMAZON-02)
1 18.133.35.94 16509 (AMAZON-02)
4 34.102.149.62 15169 (GOOGLE)
1 2 2a02:2638::1c 44788 (ASN-CRITE...)
2 178.250.0.157 44788 (ASN-CRITE...)
1 52.35.237.254 16509 (AMAZON-02)
4 8 52.51.173.5 16509 (AMAZON-02)
8 20 185.33.221.91 29990 (ASN-APPNEX)
4 178.162.133.150 60781 (LEASEWEB-...)
2 26 34.98.64.218 15169 (GOOGLE)
4 34.200.78.134 14618 (AMAZON-AES)
3 3.122.57.214 16509 (AMAZON-02)
4 185.64.189.112 62713 (AS-PUBMATIC)
2 35.157.246.167 16509 (AMAZON-02)
3 104.244.42.136 13414 (TWITTER)
18 2a00:1450:400... 15169 (GOOGLE)
2 8 2a00:1450:400... 15169 (GOOGLE)
3 142.250.186.66 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
8 2.18.233.180 16625 (AKAMAI-AS)
4 2.18.232.130 16625 (AKAMAI-AS)
1 67.202.110.23 32748 (STEADFAST)
6 178.162.133.149 60781 (LEASEWEB-...)
1 1 193.0.160.129 54312 (ROCKETFUEL)
6 6 198.148.27.140 19189 (PULSEPOINT)
17 20 142.250.186.162 15169 (GOOGLE)
6 6 185.29.133.199 30419 (MEDIAMATH...)
8 9 213.19.147.44 3356 (LEVEL3)
6 6 18.195.177.11 16509 (AMAZON-02)
20 2a00:1450:400... 15169 (GOOGLE)
4 4 2620:116:800d... 16509 (AMAZON-02)
9 9 37.157.6.241 198622 (ADFORM)
3 3 2001:678:cb4:... 56396 (TURN)
1 2 35.186.253.211 15169 (GOOGLE)
3 2a00:1288:110... 34010 (YAHOO-IRD)
2 2 3.127.88.255 16509 (AMAZON-02)
1 1 13.224.111.76 16509 (AMAZON-02)
13 13 52.209.246.140 16509 (AMAZON-02)
1 40 185.64.190.80 62713 (AS-PUBMATIC)
3 3 185.86.137.110 201081 (SMARTADSE...)
2 185.64.190.78 62713 (AS-PUBMATIC)
2 178.250.0.163 44788 (ASN-CRITE...)
4 4 213.155.156.168 1299 (TELIANET ...)
2 2 85.114.159.118 24961 (MYLOC-AS ...)
2 63.251.232.170 29791 (VOXEL-DOT...)
2 2 87.98.128.108 16276 (OVH)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 4 2606:4700::68... 13335 (CLOUDFLAR...)
2 169.197.150.7 398989 (DEEPINTENT)
2 4 199.232.137.44 54113 (FASTLY)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
2 4 77.243.60.138 42697 (NETIC-AS)
4 4 35.201.96.126 15169 (GOOGLE)
2 185.64.189.249 62713 (AS-PUBMATIC)
2 159.253.128.188 36351 (SOFTLAYER)
3 3 18.156.0.31 16509 (AMAZON-02)
2 185.64.189.114 62713 (AS-PUBMATIC)
1 1 51.75.146.159 16276 (OVH)
5 6 52.57.230.211 16509 (AMAZON-02)
4 4 151.101.114.49 54113 (FASTLY)
2 2 159.65.197.210 14061 (DIGITALOC...)
4 4 66.155.71.150 13768 (COGECO-PEER1)
2 2a02:fa8:8806... 41041 (VCLK-EU-SE)
2 2 34.98.107.212 15169 (GOOGLE)
2 2 34.251.173.19 16509 (AMAZON-02)
3 2606:2800:134... 15133 (EDGECAST)
1 1 2a00:1450:400... 15169 (GOOGLE)
2 185.64.190.81 62713 (AS-PUBMATIC)
4 4 52.208.69.189 16509 (AMAZON-02)
1 1 154.59.122.79 174 (COGENT-174)
1 1 2620:116:800d... 16509 (AMAZON-02)
372 72
Apex Domain
Subdomains
Transfer
60 pubmatic.com
hbopenbid.pubmatic.com
ads.pubmatic.com
image2.pubmatic.com
image6.pubmatic.com
simage2.pubmatic.com
aud.pubmatic.com
image4.pubmatic.com
simage4.pubmatic.com
150 KB
46 securityaffairs.co
securityaffairs.co
1 MB
38 googlesyndication.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
494 KB
28 openx.net
pixfuture2-d.openx.net
eu-u.openx.net
us-u.openx.net
rtb.openx.net
7 KB
28 media.net
contextual.media.net
adservetx.media.net
lg3.media.net
navvy.media.net
282 KB
26 doubleclick.net
googleads.g.doubleclick.net
cm.g.doubleclick.net
37 KB
24 adnxs.com
ib.adnxs.com
acdn.adnxs.com
secure.adnxs.com
84 KB
17 twitter.com
platform.twitter.com
syndication.twitter.com
705 KB
17 pixfuture.com
served-by.pixfuture.com
cdn.pixfuture.com
484 KB
13 bidr.io
match.prod.bidr.io
6 KB
13 wp.com
i0.wp.com
i1.wp.com
stats.wp.com
i2.wp.com
pixel.wp.com
94 KB
12 bidswitch.net
x.bidswitch.net
5 KB
12 adsrvr.org
match.adsrvr.org
5 KB
11 clnmde.com
dt.clnmde.com
dt6.clnmde.com
4 KB
10 sonobi.com
apex.go.sonobi.com
sync.go.sonobi.com
12 KB
9 adform.net
c1.adform.net
4 KB
8 yahoo.com
c2shb.ssp.yahoo.com
pr-bh.ybp.yahoo.com
ups.analytics.yahoo.com
6 KB
6 1rx.io
sync.1rx.io
3 KB
6 mathtag.com
sync.mathtag.com
3 KB
6 contextweb.com
bh.contextweb.com
4 KB
6 criteo.com
gum.criteo.com
mug.criteo.com
dis.criteo.com
2 KB
5 quantserve.com
pixel.quantserve.com
2 KB
5 33across.com
ssc.33across.com
ssc-cms.33across.com
2 KB
5 sharethis.com
ws.sharethis.com
platform-api.sharethis.com
buttons-config.sharethis.com
l.sharethis.com
40 KB
4 sitescout.com
pixel-sync.sitescout.com
2 KB
4 everesttech.net
sync-tm.everesttech.net
1 KB
4 fiftyt.com
visitor.fiftyt.com
2 KB
4 semasio.net
uipglob.semasio.net
2 KB
4 taboola.com
trc.taboola.com
match.taboola.com
1008 B
4 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
2 KB
4 de17a.com
d5p.de17a.com
1 KB
4 googletagservices.com
www.googletagservices.com
118 KB
4 google.com
adservice.google.com
www.google.com
1 KB
4 google-analytics.com
www.google-analytics.com
google-analytics.com
39 KB
3 twimg.com
cdn.syndication.twimg.com
pbs.twimg.com
50 KB
3 smartadserver.com
rtb-csync.smartadserver.com
2 KB
3 turn.com
ad.turn.com
1 KB
3 unrulymedia.com
sync.targeting.unrulymedia.com
1 KB
3 google.de
adservice.google.de
1 KB
3 googleadservices.com
partner.googleadservices.com
805 B
3 sharethrough.com
btlr.sharethrough.com
343 B
3 akamaihd.net
pxlclnmdecom-a.akamaihd.net
qsearch-a.akamaihd.net
38 KB
2 gumgum.com
rtb.gumgum.com
669 B
2 playground.xyz
ads.playground.xyz
726 B
2 dotomi.com
pubmatic-match.dotomi.com
207 B
2 bidtheatre.com
match.adsby.bidtheatre.com
1 KB
2 simpli.fi
um.simpli.fi
1 KB
2 zeotap.com
mwzeom.zeotap.com
1 KB
2 deepintent.com
match.deepintent.com
83 B
2 ad4m.at
ad4m.at
2 KB
2 erne.co
green.erne.co
652 B
2 adgrx.com
cm.adgrx.com
816 B
2 adition.com
dsp.adfarm1.adition.com
1002 B
2 w55c.net
pm.w55c.net
1 KB
2 facebook.net
connect.facebook.net
67 KB
2 silobreaker.com
info.silobreaker.com
3 KB
1 acuityplatform.com
ums.acuityplatform.com
706 B
1 rqtrk.eu
ws.rqtrk.eu
516 B
1 smadex.com
cm.smadex.com
524 B
1 rfihub.com
p.rfihub.com
752 B
1 sharedid.org
id.sharedid.org
375 B
1 agkn.com
aa.agkn.com
185 B
1 facebook.com
graph.facebook.com
639 B
1 gravatar.com
secure.gravatar.com
1 KB
1 consensu.org
c.sharethis.mgr.consensu.org
1 KB
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com
5 KB
1 googletagmanager.com
www.googletagmanager.com
35 KB
0 rlcdn.com Failed
api.rlcdn.com Failed
0 googleapis.com Failed
fonts.googleapis.com Failed
372 69
Domain Requested by
46 securityaffairs.co info.silobreaker.com
securityaffairs.co
23 simage2.pubmatic.com image6.pubmatic.com
ads.pubmatic.com
20 tpc.googlesyndication.com googleads.g.doubleclick.net
tpc.googlesyndication.com
pagead2.googlesyndication.com
20 cm.g.doubleclick.net 17 redirects eu-u.openx.net
18 pagead2.googlesyndication.com cdn.pixfuture.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
www.googletagservices.com
18 ib.adnxs.com 6 redirects cdn.pixfuture.com
acdn.adnxs.com
17 image2.pubmatic.com 1 redirects image6.pubmatic.com
ads.pubmatic.com
14 platform.twitter.com securityaffairs.co
platform.twitter.com
13 match.prod.bidr.io 13 redirects
13 eu-u.openx.net 2 redirects cdn.pixfuture.com
eu-u.openx.net
13 served-by.pixfuture.com securityaffairs.co
cdn.pixfuture.com
pagead2.googlesyndication.com
13 contextual.media.net securityaffairs.co
contextual.media.net
12 x.bidswitch.net 11 redirects ads.pubmatic.com
12 match.adsrvr.org 8 redirects cdn.pixfuture.com
eu-u.openx.net
10 dt.clnmde.com pxlclnmdecom-a.akamaihd.net
securityaffairs.co
10 lg3.media.net securityaffairs.co
contextual.media.net
9 c1.adform.net 9 redirects
9 us-u.openx.net eu-u.openx.net
8 ads.pubmatic.com cdn.pixfuture.com
ads.pubmatic.com
6 sync.1rx.io 6 redirects
6 sync.mathtag.com 6 redirects
6 bh.contextweb.com 6 redirects
6 sync.go.sonobi.com
6 googleads.g.doubleclick.net 2 redirects pagead2.googlesyndication.com
googleads.g.doubleclick.net
5 pixel.quantserve.com 5 redirects
5 i0.wp.com securityaffairs.co
4 pixel-sync.sitescout.com 4 redirects
4 sync-tm.everesttech.net 4 redirects
4 visitor.fiftyt.com 4 redirects
4 uipglob.semasio.net 2 redirects ads.pubmatic.com
4 d5p.de17a.com 4 redirects
4 acdn.adnxs.com cdn.pixfuture.com
4 www.googletagservices.com pagead2.googlesyndication.com
googleads.g.doubleclick.net
4 hbopenbid.pubmatic.com cdn.pixfuture.com
4 ssc.33across.com cdn.pixfuture.com
4 pixfuture2-d.openx.net cdn.pixfuture.com
4 apex.go.sonobi.com cdn.pixfuture.com
4 navvy.media.net contextual.media.net
4 cdn.pixfuture.com served-by.pixfuture.com
cdn.pixfuture.com
3 ups.analytics.yahoo.com 3 redirects
3 rtb-csync.smartadserver.com 3 redirects
3 pr-bh.ybp.yahoo.com eu-u.openx.net
ads.pubmatic.com
3 ad.turn.com 3 redirects
3 sync.targeting.unrulymedia.com 2 redirects
3 adservice.google.com pagead2.googlesyndication.com
3 adservice.google.de pagead2.googlesyndication.com
3 partner.googleadservices.com pagead2.googlesyndication.com
3 syndication.twitter.com platform.twitter.com
3 btlr.sharethrough.com cdn.pixfuture.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 i1.wp.com securityaffairs.co
2 simage4.pubmatic.com ads.pubmatic.com
2 pbs.twimg.com
2 rtb.gumgum.com 2 redirects
2 secure.adnxs.com 2 redirects
2 ads.playground.xyz 2 redirects
2 pubmatic-match.dotomi.com ads.pubmatic.com
2 match.adsby.bidtheatre.com 2 redirects
2 image4.pubmatic.com ads.pubmatic.com
2 um.simpli.fi ads.pubmatic.com
image6.pubmatic.com
2 aud.pubmatic.com ads.pubmatic.com
2 mwzeom.zeotap.com ads.pubmatic.com
2 match.taboola.com image6.pubmatic.com
2 trc.taboola.com 2 redirects
2 match.deepintent.com image6.pubmatic.com
2 s.tribalfusion.com image6.pubmatic.com
2 a.tribalfusion.com 2 redirects
2 ad4m.at image6.pubmatic.com
2 green.erne.co 2 redirects
2 cm.adgrx.com image6.pubmatic.com
2 dsp.adfarm1.adition.com 2 redirects
2 dis.criteo.com image6.pubmatic.com
2 image6.pubmatic.com ads.pubmatic.com
2 pm.w55c.net 2 redirects
2 rtb.openx.net 1 redirects eu-u.openx.net
2 c2shb.ssp.yahoo.com cdn.pixfuture.com
2 mug.criteo.com
2 gum.criteo.com 1 redirects
2 l.sharethis.com ws.sharethis.com
securityaffairs.co
2 pixel.wp.com securityaffairs.co
2 pxlclnmdecom-a.akamaihd.net contextual.media.net
pxlclnmdecom-a.akamaihd.net
2 i2.wp.com securityaffairs.co
2 connect.facebook.net securityaffairs.co
connect.facebook.net
2 info.silobreaker.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 www.google.com 1 redirects
1 cdn.syndication.twimg.com platform.twitter.com
1 ws.rqtrk.eu 1 redirects
1 cm.smadex.com 1 redirects
1 p.rfihub.com 1 redirects
1 ssc-cms.33across.com cdn.pixfuture.com
1 id.sharedid.org cdn.pixfuture.com
1 aa.agkn.com cdn.pixfuture.com
1 dt6.clnmde.com securityaffairs.co
1 qsearch-a.akamaihd.net securityaffairs.co
1 graph.facebook.com securityaffairs.co
1 secure.gravatar.com securityaffairs.co
1 c.sharethis.mgr.consensu.org ws.sharethis.com
1 adservetx.media.net contextual.media.net
1 google-analytics.com securityaffairs.co
1 buttons-config.sharethis.com platform-api.sharethis.com
1 stats.wp.com securityaffairs.co
1 platform-api.sharethis.com securityaffairs.co
1 ws.sharethis.com securityaffairs.co
1 maxcdn.bootstrapcdn.com securityaffairs.co
1 www.googletagmanager.com securityaffairs.co
0 api.rlcdn.com Failed cdn.pixfuture.com
0 fonts.googleapis.com Failed securityaffairs.co
372 108
Subject Issuer Validity Valid
info.silobreaker.com
Cloudflare Inc ECC CA-3
2020-06-30 -
2021-06-30
a year crt.sh
www.securityaffairs.co
GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
2021-03-24 -
2022-04-06
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-03-01 -
2022-02-28
a year crt.sh
sharethis.com
Amazon
2020-08-17 -
2021-09-16
a year crt.sh
*.media.net
DigiCert SHA2 Secure Server CA
2021-04-12 -
2022-04-20
a year crt.sh
*.pixfuture.com
Sectigo RSA Domain Validation Secure Server CA
2019-12-03 -
2021-12-02
2 years crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-05 -
2021-11-09
a year crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA
2020-04-02 -
2022-07-05
2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-04-06 -
2021-07-03
3 months crt.sh
sharethis.mgr.consensu.org
Amazon
2021-04-07 -
2022-05-06
a year crt.sh
a248.e.akamai.net
DigiCert Secure Site ECC CA-1
2020-07-15 -
2021-09-13
a year crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA
2020-08-14 -
2022-11-16
2 years crt.sh
*.clnmde.com
Amazon
2020-06-04 -
2021-07-04
a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018
2020-07-25 -
2022-09-18
2 years crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2021-04-14 -
2021-07-12
3 months crt.sh
id.sharedid.org
Amazon
2021-01-08 -
2022-02-06
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2021-03-18 -
2022-04-19
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2
2020-12-06 -
2022-01-07
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2020-06-18 -
2021-08-17
a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA
2019-10-01 -
2021-09-30
2 years crt.sh
*.sharethrough.com
Amazon
2020-09-09 -
2021-10-11
a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1
2020-12-07 -
2021-12-14
a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2021-03-18 -
2021-09-08
6 months crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
*.google.de
GTS CA 1O1
2021-04-13 -
2021-07-06
3 months crt.sh
*.google.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018
2021-03-11 -
2022-02-07
a year crt.sh
*.targeting.unrulymedia.com
DigiCert SHA2 Secure Server CA
2020-05-04 -
2022-05-09
2 years crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2021-03-29 -
2021-09-22
6 months crt.sh
public1.adgear.com
Sectigo RSA Domain Validation Secure Server CA
2021-02-24 -
2022-03-26
a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2
2020-04-09 -
2022-06-08
2 years crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-25 -
2021-12-26
a year crt.sh
*.semasio.net
GlobalSign GCC R3 DV TLS CA 2020
2021-03-09 -
2022-04-10
a year crt.sh
*.simpli.fi
DigiCert SHA2 Secure Server CA
2019-09-18 -
2021-12-12
2 years crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018
2019-06-19 -
2021-08-31
2 years crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA
2020-04-23 -
2022-05-04
2 years crt.sh

This page contains 59 frames:

Primary Page: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Frame ID: 3DAB372765292EFF7EAC7A2176BECF51
Requests: 156 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/portal-v2.html
Frame ID: C1650B09804795647DDFE8AABAD804DC
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.63899b173766ee6f8a729a72b542b0fb.html?origin=https%3A%2F%2Fsecurityaffairs.co
Frame ID: 3F0A082DAD10ED131161FE2F9EE3A771
Requests: 2 HTTP requests in this frame

Frame: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Frame ID: E7F8EEBFEB51FA702820E62DA1EBBBFE
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV65342.js
Frame ID: 825429F2718ABCF7774812DF2C8BD0A6
Requests: 6 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV65342.js
Frame ID: EC107D74CB6BC607ED11E177D6EB1FF2
Requests: 6 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV65342.js
Frame ID: A6A1450A04BECE3CE99DC16C0BE7C91F
Requests: 6 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV65342.js
Frame ID: C712A01EF9AA9C1B1113198C68B99D87
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: F380B2E7ED0161441CA58D539C8BD8DE
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: B0B5763C95D4713FE33F26B723BF6C4F
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 140164524AF701447B3402F8AE7D9D8F
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 6DCB71505819436BC9B6766099E55FF0
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210422/r20190131/zrt_lookup.html
Frame ID: B37360F5E0B3B21BF04ADEE96C889B0F
Requests: 1 HTTP requests in this frame

Frame: https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5529
Frame ID: 7FF81C52E91F13EA926BE48C99070148
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Frame ID: 97A8E31CCEC701A9CEFF109C4422DB6F
Requests: 7 HTTP requests in this frame

Frame: https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Frame ID: D40054652ED68C66275C719F8661CCBF
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
Frame ID: 12B133D2EF84A867D71A3F4C51D88502
Requests: 16 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 589C5DD31889A0FF5C5D927078CF5004
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: AA02FB82F8E4A20634E380D5957CD371
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: AA88700CED326827FF669BA2D018C6C0
Requests: 25 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=azC7qard4r6OkMaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Frame ID: E1ADA12EEA7D68E46EF4E2A1673C89F9
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Frame ID: F485A6D498EC61D195C3A064F005F603
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: F20B545F80DBB5DC72BC4978E0195E54
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 920F6C5040550997AD42C36DF971D173
Requests: 26 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5441DE9F0D31994E792C2A46AF4C3F2C
Requests: 3 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Frame ID: 83D86540870842FE65D169CB3EE39755
Requests: 7 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Frame ID: 3F24A384E5B41EE7A5CC341AA2FD14D4
Requests: 7 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 77D0BDBE5F7B2E319B1658E83F7B2941
Requests: 3 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Frame ID: 67A59BAE5090662323BDD306455D36FD
Requests: 7 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 9F8451E69D2F562ACF04B3EFF5130119
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Frame ID: 84BDD82F6F00E3C2AA5EB2BE083435FA
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 1FDF714BF4F4307E4FDBCFE953246FA2
Requests: 2 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: CD5B89820A9D6598538E266CFC185C3D
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
Frame ID: 4A0B24EEE5A05EC1CC5C4D48FD9FA70F
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795326539069581
Frame ID: 2FFE4752BE5964BCC48FC3B0119A945B
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Frame ID: 4E89A96019B4656389D44C9503B06E76
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 9388EE3C2BF9FB9FDEDBF7E16CE372B2
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
Frame ID: D35E25AD1E3EFEC6E4EF1533A917F4F3
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
Frame ID: E0C912CDC4C42B0C577226BA4F9E539F
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Frame ID: 84B46F55611B4CC67B7894851420012C
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 1F0852ED7BA4A69BE821EC36A3599175
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Uhjz15oBUlXD&pid=557219
Frame ID: 24CEB749DABEAF4099CEFF5EF39B73E5
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?redir=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=${DI_USER_ID}&gdpr=0&gdpr_consent=
Frame ID: FFE243F4FBD7E9AA1996F89CBA6FAE4B
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: 41BA3CEC68B2C61F58A7516A54967E14
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 3DF12A73B63B3976CC6616F16C3CFBDC
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: C4FFC84115DDA9667617E66A10381F61
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 5BDC1AF4A215CD35C85FE1BCABEB7532
Requests: 2 HTTP requests in this frame

Frame: https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Frame ID: 81601FE0F47AF7F6BC79F02193BD5E8C
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
Frame ID: 59BB2792EEB1142BD91CC530C70BCC0C
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795335128676493
Frame ID: AAC5E0816BC47672B8162825F19C99B0
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Frame ID: 1298A8B2FCA29572D21CECD36BEB172A
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 115A995CA643FAC77E26DC938B16BDFD
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003
Frame ID: 1771648C29B05544FEAF1D69BE111441
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
Frame ID: 0909B1311A4C6F182C4ADB212AF1C6B3
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Frame ID: 7EE1E854FA43DDF6F017D263DA08F416
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 40B426D1D70F8E93965098F5FF5962BA
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Qg2Cu6d51QGd&pid=557219
Frame ID: 07AD59EF7299AB8CABC2B4741DE8F0A5
Requests: 1 HTTP requests in this frame

Frame: https://match.deepintent.com/usersync/141?redir=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=${DI_USER_ID}&gdpr=0&gdpr_consent=
Frame ID: 6B59F9CDFBBC1C171E71C9D3828668A0
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: FF263B027E692F349ED48BCEB9B1DD5C
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5v... Page URL
  2. https://info.silobreaker.com/events/public/v1/track/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1... HTTP 307
    https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emote... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

372
Requests

99 %
HTTPS

32 %
IPv6

69
Domains

108
Subdomains

72
IPs

8
Countries

4115 kB
Transfer

8757 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1 Page URL
  2. https://info.silobreaker.com/events/public/v1/track/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1?_ud=b4a7eaf7-2719-4532-8778-827a55734808&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
    https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 132
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=oGi_jXxFNzB3SjZISy9DQkpvekJtYVhEMlc5cmFQREUwanVZd2tkNU15dmtLcno0cU0ydCtlc2hZSHU2NjBhRmp0UndDNlR0biszUHFseUlmQktwOHVrUTRSNUhPTnZVMEI4TlVBdmtseXhjT3hjWnZjYktuZExvSjNpd2RCWUFXdzNWeHlEbGNVa0xUbDdCdVkxa0VQUThLek0rMjdVTzZ5MVQ2MFhLUFBRbThZUUdYNUdLMGtQZ1Q3Z3NxZUNQK0ZXNWE2ekVlU1VsVzJ3NGkvOTVhWks4Y1p4R1FDd0tXVVZUYU05djJmRUdEcGI0PXw&cppv=2
Request Chain 185
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1480696128&pi=t.ma~as.1680648786&w=300&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300115&bpp=34&bdt=250&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=2&ga_vid=971449260.1619522301&ga_sid=1619522301&ga_hid=1231739267&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=4099&biw=1600&bih=1200&isw=300&ish=250&ifk=1853042362&scr_x=0&scr_y=0&eid=44739522%2C21065725&oid=3&pvsid=2395319066769911&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.kmnltsg35r6o&btvi=1&fsb=1&xpc=K41p1fvii3&p=https%3A//securityaffairs.co&dtd=428 HTTP 302
  • https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5529
Request Chain 195
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1480696190&pi=t.ma~as.1139220782&w=320&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300320&bpp=5&bdt=306&idt=371&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=118889622.1619522301&ga_sid=1619522301&ga_hid=1465179935&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=844&biw=1600&bih=1200&isw=320&ish=50&ifk=1738512595&scr_x=0&scr_y=0&eid=42530671%2C31060829&oid=3&pvsid=4239238126509352&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.oaoi6s7b69d6&fsb=1&xpc=6EH8yL2etG&p=https%3A//securityaffairs.co&dtd=380 HTTP 302
  • https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Request Chain 209
  • https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0 HTTP 302
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Request Chain 211
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=09affd61-1009-4498-b9f0-e2daea690cf0&pubid=0b24fdfc82
Request Chain 212
  • https://p.rfihub.com/cm?pub=35683&in=1 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878969570699774
Request Chain 213
  • https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=e9609499-bb32-4796-9b0e-7fee38eba6c3&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=d2dEcEFWd1BCcXQ3Wm1oTC1BSzdTdw&gdpr=&gdpr_consent= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEIevSDvszZkRjKep12dPQdE&google_cver=1 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Uhjz15oBUlXD
Request Chain 214
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID] HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=01306087-f2fc-4400-a3a4-d1b195914b19
Request Chain 215
  • https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=ZTk2MDk0OTktYmIzMi00Nzk2LTliMGUtN2ZlZTM4ZWJhNmMz HTTP 302
  • https://sync.go.sonobi.com/usg.gif?google_gid=CAESEO_Y83TQ6gAU4obWxuHakrA&google_cver=1
Request Chain 216
  • https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=212963970 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/09affd61-1009-4498-b9f0-e2daea690cf0 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
Request Chain 217
  • https://x.bidswitch.net/sync?ssp=sonobi HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=sonobi HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1&google_hm=ZmFkYjVlYTEtOGI5Ny00YTM0LWEzODgtYTE2OGJjMTdkMmUx HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESED0LTejXMr5lUWJOEbjzsis&google_cver=1&ssp=sonobi&bsw_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1 HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
Request Chain 229
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Request Chain 230
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
Request Chain 231
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5510645463395423367
Request Chain 234
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
Request Chain 235
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Request Chain 236
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
Request Chain 237
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=626901678625525145
Request Chain 240
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
Request Chain 241
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Request Chain 242
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
Request Chain 243
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7395524573033724106
Request Chain 246
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
Request Chain 250
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Request Chain 251
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 252
  • https://rtb.openx.net/sync/dds HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=3Q7LiJYLio2I18K2bE42Ug==&ox_sc=1&ox_init=1 HTTP 302
  • https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Request Chain 254
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=oM1GKaMO1LBlJv5 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?cc=1&id=537072979&val=oM1GKaMO1LBlJv5
Request Chain 255
  • https://x.bidswitch.net/sync?ssp=openx HTTP 302
  • https://cm.smadex.com/sync?sm_did=bds&bds_ssp_id=openx&bds_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=340&user_id=c5ee4a25-a01b-49f4-b5f8-05e38e119429&expires=10&ssp=openx&bsw_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
Request Chain 256
  • https://match.prod.bidr.io/cookie-sync/ox HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCR2FrN0JELVlBQUNtdTRiX1hydw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCR2FrN0JELVlBQUNtdTRiX1hydw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1&google_tc= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cox%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABGak7BD-YAACmu4b_Xrw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cox&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=1784839922786100870 HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABGak7BD-YAACmu4b_Xrw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D1784839922786100870%26bee_sync_partners%3Dox%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?userid=1784839922786100870&bee_sync_partners=ox&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AABGak7BD-YAACmu4b_Xrw&pid=558502&do=add HTTP 303
  • https://us-u.openx.net/w/1.0/sd?id=537125688&val=AABGak7BD-YAACmu4b_Xrw
Request Chain 257
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Request Chain 258
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Request Chain 259
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Request Chain 274
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
Request Chain 275
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795326539069581
Request Chain 276
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDaWwwN0JELVlBQUNwV2luSFVzZw&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDaWwwN0JELVlBQUNwV2luSFVzZw&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1&google_tc= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABGak7BD-YAACmu4b_Xrw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABGak7BD-YAACmu4b_Xrw&pid=558502&do=add HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABGak7BD-YAACmu4b_Xrw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=1784839922786100870 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Request Chain 278
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1162584194 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/09affd61-1009-4498-b9f0-e2daea690cf0 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-33851508-a9fe-43df-b7ea-6d475f7007b8-003 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
Request Chain 279
  • https://green.erne.co/pubmatic/cm HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
Request Chain 281
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 282
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%% HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Uhjz15oBUlXD&pid=557219
Request Chain 284
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Request Chain 285
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Centwt3NTwmHLC0I-8EyOQ%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 287
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&sInitiator=external&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&sInitiator=external&gdpr=0&gdpr_consent=
Request Chain 288
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&gdpr=&fbounce=1 HTTP 302
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&addseg=31
Request Chain 289
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDlFOUVEQzItRERDRC00RjA5LTg3MkMtMkQwOEZCQzEzMjM5&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 290
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKFzA5X7OrjpCNzKN0XUgSQ&google_cver=1
Request Chain 292
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:01306087-f2fc-4400-a3a4-d1b195914b19&gdpr=0&gdpr_consent=
Request Chain 293
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7395524573033724106
Request Chain 294
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=09affd61-1009-4498-b9f0-e2daea690cf0
Request Chain 295
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
Request Chain 297
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wS8idTNE2uWYovjDh5.DWRZWzS7qmHI-~A&gdpr=0&gdpr_consent=
Request Chain 298
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://ws.rqtrk.eu/pull?redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D193%26user_id%3D%24BROWSER_ID%26expires%3D1%26ssp%3D%24bidswitch_ssp_id&return-unstable=true&eb=&bidswitch_ssp_id=pubmatic&g=1&gdpr_pd=&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=193&user_id=&expires=1&ssp=pubmatic HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=193&user_id=&expires=1&ssp=pubmatic HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f5702e91-6ee1-4d71-b858-3d19dba24411&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 299
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT
Request Chain 300
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 301
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YIfy-gAAgIhwiQAC HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfy-gAAgIhwiQAC&gdpr=0&gdpr_consent=&_test=YIfy-gAAgIhwiQAC
Request Chain 302
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:2b8d3ea0-23a9-4fa0-aaa1-29da3cae996d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 303
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7979cd4d-4dc3-43a1-9093-4fdbc7bdc4b5-6087f2ff-4348&gdpr=0&gdpr_consent=
Request Chain 305
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
Request Chain 306
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_53f81292-2a29-4145-8af2-4a0cd10fae10
Request Chain 324
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 345
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECa27be77Xm2sX0giKgy2xU&google_cver=1
Request Chain 348
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:bed76087-f304-4600-a368-6582ad2cf265&gdpr=0&gdpr_consent=
Request Chain 349
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
Request Chain 350
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5176658639249221789
Request Chain 351
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=95e471ea-00ee-471c-a54d-85bacf63223d
Request Chain 352
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
Request Chain 353
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://ums.acuityplatform.com/bum?tpid=29&uid=f5702e91-6ee1-4d71-b858-3d19dba24411&bidswitch_ssp_id=pubmatic HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=236&user_id=575332066921&expires=30&user_group=1&ssp=Pubmatic HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=236&user_id=575332066921&expires=30&user_group=1&ssp=Pubmatic
Request Chain 354
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0
Request Chain 355
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795335128676493
Request Chain 356
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABGak7BD-YAACmu4b_Xrw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dpm%26bee_sync_hop_count%3D1%26userid%3DSMART_USER_ID HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=pm&bee_sync_hop_count=1&userid=8399306420114810423 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Request Chain 357
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:6617c627-e0d6-4ccb-9223-411cdfdcdbf4&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 358
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348&gdpr=0&gdpr_consent=
Request Chain 360
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4477411516 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4477411516 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/95e471ea-00ee-471c-a54d-85bacf63223d HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003
Request Chain 361
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
Request Chain 362
  • https://green.erne.co/pubmatic/cm HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
Request Chain 364
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf
Request Chain 365
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 366
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%% HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Qg2Cu6d51QGd&pid=557219
Request Chain 368
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Request Chain 369
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YF7wuGPURXGZt6RY0E6JrQ%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 371
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=605EF0B8-63D4-4571-99B7-A458D04E89AD&sInitiator=external&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=605EF0B8-63D4-4571-99B7-A458D04E89AD&sInitiator=external&gdpr=0&gdpr_consent=
Request Chain 372
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&gdpr= HTTP 302
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&gdpr=&fbounce=1 HTTP 302
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=605EF0B8-63D4-4571-99B7-A458D04E89AD&addseg=31
Request Chain 373
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjA1RUYwQjgtNjNENC00NTcxLTk5QjctQTQ1OEQwNEU4OUFE&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 375
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-yxBT1EpE2uX6S8nhRF7wid5YM0wMbrA-~A&gdpr=0&gdpr_consent=
Request Chain 376
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2461256698955117415&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 377
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YIfzAQAAgcwJuAA4 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfzAQAAgcwJuAA4&gdpr=0&gdpr_consent=&_test=YIfzAQAAgcwJuAA4

372 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20p...
info.silobreaker.com/e2t/tc/
9 KB
3 KB
Document
General
Full URL
https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.2 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9552fd4fdded6f095a9d4953389e0e9b116fe4b2eaeee7c4fb8b10bb48b8480

Request headers

:method
GET
:authority
info.silobreaker.com
:scheme
https
:path
/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:11 GMT
content-type
text/html;charset=utf-8
set-cookie
__cfduid=d650ec5a4b8f6a268a1870417ab25cb5d1619522291; expires=Thu, 27-May-21 11:18:11 GMT; path=/; domain=.info.silobreaker.com; HttpOnly; SameSite=Lax __cfruid=366f0be571c9bf58351c0f283d349d1ee4ac8738-1619522291; path=/; domain=.info.silobreaker.com; HttpOnly; Secure; SameSite=None
cf-ray
6467a610299001fc-ZRH
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
cf-request-id
09b4a61e1a000001fcc63e0000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
x-hubspot-correlation-id
3367c722-28fb-4edd-be0b-bb65c83a3278
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GPusDNFDMoFrto%2BmFTAgker%2FJfPgOi%2BBfr8%2FZeSshunEJ7axskgF5%2ByHv0K2IDZxekzZJ6a88MdwF2AXgFA77tjhKhmtflCYBRBoG2Z0INjCm75D9g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
br
Primary Request emotet-global-uninstall.html
securityaffairs.co/wordpress/117238/cyber-crime/
Redirect Chain
  • https://info.silobreaker.com/events/public/v1/track/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKg...
  • https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-...
98 KB
26 KB
Document
General
Full URL
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
f9bd7f14c93030136ee29d6da6e45317acec75c6b878fc2305842af6fe4e06d5

Request headers

:method
GET
:authority
securityaffairs.co
:scheme
https
:path
/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 27 Apr 2021 11:18:11 GMT
server
Apache
x-pingback
https://securityaffairs.co/wordpress/xmlrpc.php
link
<https://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <https://securityaffairs.co/wordpress/wp-json/wp/v2/posts/117238>; rel="alternate"; type="application/json", <https://securityaffairs.co/wordpress/?p=117238>; rel=shortlink
content-encoding
gzip

Redirect headers

date
Tue, 27 Apr 2021 11:18:11 GMT
location
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
cf-ray
6467a6110a9f01fc-ZRH
link
<https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss>; rel="canonical"
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
cf-request-id
09b4a61ea0000001fcf7b3e000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
x-hubspot-correlation-id
80ad51b5-3272-417b-814c-da044007e23c
x-robots-tag
none
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ulnxQ4zvNvtiTUBlZgbAcmcBYSX%2BQIIh5LEt8VHAyvOKvhCPCWbn1oonHI3DC9e85sH8oPtI9L6rgC6FltRFxRFYO4I3TB03CHM1euyX3Rp9%2B2%2FO5g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
js
www.googletagmanager.com/gtag/
88 KB
35 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-59069958-1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
23ab24068005cf42a22a5196da7fbc74827d5f60a6d537a7909ed80d16a0e07a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35719
x-xss-protection
0
last-modified
Tue, 27 Apr 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 27 Apr 2021 11:18:13 GMT
style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/
68 KB
68 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
7014d55ece110a38ebbf87acfe487f95f1b78a9575a12291da5463ec13d1074f

Request headers

:path
/wordpress/wp-includes/css/dist/block-library/style.css?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Thu, 15 Apr 2021 18:49:28 GMT
server
Apache
accept-ranges
bytes
etag
"10eb0-5c00752bc3a5d"
content-length
69296
content-type
text/css
cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
3 KB
3 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.0.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80

Request headers

:path
/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.0.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Thu, 18 Mar 2021 22:58:46 GMT
server
Apache
accept-ranges
bytes
etag
"c25-5bdd78ab0a073"
content-length
3109
content-type
text/css
cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/
28 KB
28 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.0.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
a82fb0df229ab511ba5e585874443b97a62bfbd76c369a6944ed9e0750ebf698

Request headers

:path
/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.0.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Thu, 18 Mar 2021 22:58:46 GMT
server
Apache
accept-ranges
bytes
etag
"6ecf-5bdd78ab0a073"
content-length
28367
content-type
text/css
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/
23 KB
5 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617
age
367399
cdn-cachedat
2021-04-23 07:08:43
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09b4a62896000005d025372000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
0f37bfbdb2bcc5a7f341443578873edb
cf-ray
6467a620edb605d0-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/
19 KB
20 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Wed, 16 Dec 2015 13:54:59 GMT
server
Apache
accept-ranges
bytes
etag
"4d92-52704407f72c0"
content-length
19858
content-type
text/css
tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
539 B
683 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
accept-ranges
bytes
etag
"21b-526fe6d7cd700"
content-length
539
content-type
text/css
flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
6 KB
6 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Wed, 16 Dec 2015 13:55:09 GMT
server
Apache
accept-ranges
bytes
etag
"1851-5270441180940"
content-length
6225
content-type
text/css
mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/
11 KB
11 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

:path
/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Wed, 09 Dec 2020 23:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"2bf8-5b61073af996a"
content-length
11256
content-type
text/css
animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
2 KB
2 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:13 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
accept-ranges
bytes
etag
"6b4-526fe6d5e5280"
content-length
1716
content-type
text/css
font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
17 KB
18 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
accept-ranges
bytes
etag
"4574-526fe6d5e5280"
content-length
17780
content-type
text/css
swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
5 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
accept-ranges
bytes
etag
"118d-526fe6e527680"
content-length
4493
content-type
text/css
jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
334 B
478 B
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:02 GMT
server
Apache
accept-ranges
bytes
etag
"14e-526fe6d5e5280"
content-length
334
content-type
text/css
screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
110 KB
110 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:04 GMT
server
Apache
accept-ranges
bytes
etag
"1b844-526fe6d7cd700"
content-length
112708
content-type
text/css
custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/
12 KB
12 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

:path
/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
content-type
text/css; charset: UTF-8;charset=UTF-8
server
Apache
grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/
49 KB
50 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

:path
/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:03 GMT
server
Apache
accept-ranges
bytes
etag
"c5f2-526fe6d6d94c0"
content-length
50674
content-type
text/css
sharing.css
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/
19 KB
19 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.css?ver=9.6.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
1b11f2c81cddaa0d12147ff5fbecdec023a921b64088411da37f81915b8b4b40

Request headers

:path
/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.css?ver=9.6.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Tue, 13 Apr 2021 21:43:02 GMT
server
Apache
accept-ranges
bytes
etag
"4cdc-5bfe183ba8d29"
content-length
19676
content-type
text/css
social-logos.css
securityaffairs.co/wordpress/wp-content/plugins/jetpack/_inc/social-logos/
12 KB
12 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/_inc/social-logos/social-logos.css?ver=9.6.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
4cdecc62f5b2c8e9f7cf7b14b9fd42e0c4787d912c1b71426cdfbe0144cede46

Request headers

:path
/wordpress/wp-content/plugins/jetpack/_inc/social-logos/social-logos.css?ver=9.6.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Tue, 13 Apr 2021 21:43:01 GMT
server
Apache
accept-ranges
bytes
etag
"312f-5bfe183af2349"
content-length
12591
content-type
text/css
frontend-gtag.js
securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/
23 KB
23 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.js?ver=1619522293
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0cdc6e956294d2e2352f1c0a62b2ba989108b6e04338e0d24a14b452335697a6

Request headers

:path
/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend-gtag.js?ver=1619522293
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Thu, 18 Mar 2021 22:58:48 GMT
server
Apache
accept-ranges
bytes
etag
"5b2e-5bdd78ad87b99"
content-length
23342
content-type
application/javascript
jquery.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
281 KB
281 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=3.5.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
86f937a29eaee70aaf9935799a414bea46c62fb136cc0465f63f9d6820cf4982

Request headers

:path
/wordpress/wp-includes/js/jquery/jquery.js?ver=3.5.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 09 Dec 2020 23:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"463a2-5b61073af5aea"
content-length
287650
content-type
application/javascript
jquery-migrate.js
securityaffairs.co/wordpress/wp-includes/js/jquery/
25 KB
25 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a

Request headers

:path
/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 09 Dec 2020 23:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"62d4-5b61073af5aea"
content-length
25300
content-type
application/javascript
cookie-law-info-public.js
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/
35 KB
35 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.0.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
8c8c2e3e0af8248c66e02fd3901558e969a7b0f35cf1fe0da4872e01f77e2ebd

Request headers

:path
/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.0.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Thu, 18 Mar 2021 22:58:46 GMT
server
Apache
accept-ranges
bytes
etag
"8bdf-5bdd78ab0b013"
content-length
35807
content-type
application/javascript
medianetAdInjector.js
securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/
741 B
895 B
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/medianetAdInjector.js?ver=2.10.12
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
c8817bacfc84fd39e4daec4096011ed3d117c7fe8b3c55fdd22af47c299099bc

Request headers

:path
/wordpress/wp-content/plugins/media-net-ads-manager/js/medianetAdInjector.js?ver=2.10.12
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Tue, 09 Mar 2021 23:34:48 GMT
server
Apache
accept-ranges
bytes
etag
"2e5-5bd22feff7aba"
content-length
741
content-type
application/javascript
st_insights.js
ws.sharethis.com/button/
26 KB
8 KB
Script
General
Full URL
https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c8:8000:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
f8284365ba340253ee9c71cfb5efcc37f10a23e8b8b5dd134ec7bbab05073845

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 24 Apr 2021 18:29:38 GMT
content-encoding
gzip
server
nginx/1.16.1
age
233316
etag
W/"60256fd5-676f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 adaa7e69b304066aa4eaf0d2190ecfd7.cloudfront.net (CloudFront)
cache-control
max-age=259200
x-amz-cf-pop
MAD50-C1
x-robots-tag
noindex, nofollow
content-length
7567
x-amz-cf-id
n31LwXShpxEp_xXm1hcPtcl3g3JqMnCBVHSHMJ5VkGkT672768GhEA==
expires
Tue, 27 Apr 2021 18:29:38 GMT
sharethis.js
platform-api.sharethis.com/js/
101 KB
32 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c8:bc00:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
38c288b893b166348ca23e242921ba2f260e3444cb2027e0c844304a894f0bbe

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:09:26 GMT
content-encoding
gzip
age
528
etag
W/"192cc-3TBOdKYF02HlA++J6fQ0dmTq6Ow"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 eb28dde7b66308b26496e3a543c93412.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
MAD50-C1
x-amz-cf-id
6pu59tPwmXbHN7D29hlpZKRvRIIc58E1397cqizgmN4bF-x8zxdpYA==
loginbot.js
securityaffairs.co/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/shield/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/shield/loginbot.js?ver=11.1.1&mtime=1618350192
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
474776eb17d0e4ca038f4994076ede6f4017ecdf91eff0d3d074c3b7bb6a5a97

Request headers

:path
/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/shield/loginbot.js?ver=11.1.1&mtime=1618350192
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Tue, 13 Apr 2021 21:43:12 GMT
server
Apache
accept-ranges
bytes
etag
"c9f-5bfe18455d334"
content-length
3231
content-type
application/javascript
dmedianet.js
contextual.media.net/
151 KB
51 KB
Script
General
Full URL
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d8e21f9d683d7086b778d75d17252cc0dc3296a258b2487c29bae2680663b084
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-mnt-h
8-8
content-encoding
gzip
server
Apache
etag
"bd806f6598596379f951e43cd219d77d"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
max-age=300
date
Tue, 27 Apr 2021 11:18:15 GMT
strict-transport-security
max-age=604800
x-mnt-w
8-19
expires
Tue, 27 Apr 2021 11:23:15 GMT
logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/
44 KB
44 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

:path
/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Wed, 16 Dec 2015 17:30:42 GMT
server
Apache
accept-ranges
bytes
etag
"b0e9-5270743f5f480"
content-length
45289
content-type
image/png
headerbid.js
served-by.pixfuture.com/www/delivery/
973 B
2 KB
Script
General
Full URL
https://served-by.pixfuture.com/www/delivery/headerbid.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
d490f2efc64637640a21c5282a89dd22344e58974641bc7bbbfa4c7e4dc8648e

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:15 GMT
Last-Modified
Tue, 02 Mar 2021 20:36:48 GMT
Server
nginx/1.10.3 (Ubuntu)
ETag
"603ea1e0-3cd"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length
973
Expires
Thu, 29 Apr 2021 11:18:15 GMT
widgets.js
platform.twitter.com/
95 KB
29 KB
Script
General
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/669F) /
Resource Hash
501ed6f37588ea4083347c8c1b9fd9bfbc560f8f9977aa2847749e0977063f6c

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:15 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:47:45 GMT
Server
ECS (frb/669F)
Age
1017
Etag
"f8e2082c1f210ffae5a2de107bd73ffc+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28769
facebook.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
830 B
1 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
4c6b4ef22f4c5dd8fd6e17ab6706d8c55d236824c20b3d8dcd310f7de744def6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Tue, 27 Apr 2021 11:18:15 GMT
x-content-type-options
nosniff
last-modified
Wed, 10 Jun 2020 20:34:29 GMT
server
nginx
etag
"509a053c355d6394"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length
830
expires
Sat, 11 Jun 2022 08:34:29 GMT
twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
650868ebc4c00b2ea4ea72747f655f8a0552ba53c9b5b55defd9457be75f1aa9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Tue, 27 Apr 2021 11:18:15 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"fbafb4fa36d9fc66"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length
1082
expires
Sat, 05 Nov 2022 20:12:40 GMT
linkedin.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/
1 KB
1 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png?ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
b97d80b9eedfeb29936f0d7f89afbdd425ef8d930d09fa1f98030ceb8b26cabd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Tue, 27 Apr 2021 11:18:15 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"8daaaf021369fdba"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length
1184
expires
Sat, 05 Nov 2022 20:12:40 GMT
sdk.js
connect.facebook.net/en_US/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
bfa21f286e3bc68b8a86de420a49b5b1e45321fd241004a6b35dba7ff807c1ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
I7QtO9zpaERa2yyl8ihHNg==
cross-origin-resource-policy
cross-origin
expires
Tue, 27 Apr 2021 11:22:59 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1782
x-fb-rlafr
0
x-fb-debug
RbQO4PYI1UPAORWTJ2BulZbUyUXPhL9fzrm0jU6bMvp1Y3gD+VUHuLcC4aVVLyZgbuS9Js6boV3LCbO0r/ZiwA==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
x-fb-content-md5
ac765a239045563c6d26c685575e1345
date
Tue, 27 Apr 2021 11:18:15 GMT
x-frame-options
DENY
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"6b726aff64e54966b303ca2c1962c3ab"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
macOs-Shlayer-malware-alert.jpg
securityaffairs.co/wordpress/wp-content/uploads/2021/04/
131 KB
132 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2021/04/macOs-Shlayer-malware-alert.jpg
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
800cc6f76e053ece29647974c1a229508463db5017d841cdec7ba5ec7d396d00

Request headers

:path
/wordpress/wp-content/uploads/2021/04/macOs-Shlayer-malware-alert.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Mon, 26 Apr 2021 23:33:50 GMT
server
Apache
accept-ranges
bytes
etag
"20d17-5c0e893ead797"
content-length
134423
content-type
image/jpeg
airdrop-hack.png
securityaffairs.co/wordpress/wp-content/uploads/2015/09/
23 KB
23 KB
Image
General
Full URL
https://securityaffairs.co/wordpress/wp-content/uploads/2015/09/airdrop-hack.png
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
6c4e5b013fca4f66b566c8c6b036fc2423c82a426bab0753134ec995e62ad679

Request headers

:path
/wordpress/wp-content/uploads/2015/09/airdrop-hack.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Wed, 16 Dec 2015 13:06:52 GMT
server
Apache
accept-ranges
bytes
etag
"5b42-52703946b5300"
content-length
23362
content-type
image/png
prometei-attack-chain.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/04/
5 KB
5 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/04/prometei-attack-chain.jpg?resize=300%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c683924ef457e6a840aaea2cccafe8fa49da504e7e2d990aa59f59205ddbe510
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Tue, 27 Apr 2021 11:18:15 GMT
x-content-type-options
nosniff
last-modified
Mon, 26 Apr 2021 09:57:13 GMT
server
nginx
etag
"e96804338b2db3ec"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2021/04/prometei-attack-chain.jpg>; rel="canonical"
content-length
4632
expires
Wed, 26 Apr 2023 21:57:13 GMT
ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/
122 KB
122 KB
Stylesheet
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
f4d4eda42f85c6ccbbb5de2aff596085b3b1d380c8585464f2e53df2cad66f8e

Request headers

:path
/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Fri, 25 Dec 2020 23:58:53 GMT
server
Apache
accept-ranges
bytes
etag
"1e76e-5b752b4e76df8"
content-length
124782
content-type
text/css
photon.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da

Request headers

:path
/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Tue, 13 Apr 2021 21:43:01 GMT
server
Apache
accept-ranges
bytes
etag
"6e0-5bfe183b83b69"
content-length
1760
content-type
application/javascript
jquery.adrotate.clicktracker.js
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/
365 B
519 B
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a

Request headers

:path
/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Mon, 26 Apr 2021 22:25:23 GMT
server
Apache
accept-ranges
bytes
etag
"16d-5c0e79f28b3c3"
content-length
365
content-type
application/javascript
ssba.js
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/
2 KB
2 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

:path
/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Fri, 25 Dec 2020 23:58:53 GMT
server
Apache
accept-ranges
bytes
etag
"792-5b752b4e7bc18"
content-length
1938
content-type
application/javascript
hint.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
987 B
1 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"3db-526fe6e433440"
content-length
987
content-type
application/javascript
jquery.tipsy.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
4 KB
4 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"1113-526fe6e433440"
content-length
4371
content-type
application/javascript
jquery.easing.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"1fa1-526fe6e433440"
content-length
8097
content-type
application/javascript
browser.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
accept-ranges
bytes
etag
"a36-526fe6e33f200"
content-length
2614
content-type
application/javascript
jquery.flexslider-min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/
21 KB
21 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 13:55:10 GMT
server
Apache
accept-ranges
bytes
etag
"53ae-5270441274b80"
content-length
21422
content-type
application/javascript
waypoints.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
8 KB
8 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:18 GMT
server
Apache
accept-ranges
bytes
etag
"1f6c-526fe6e527680"
content-length
8044
content-type
application/javascript
mediaelement-and-player.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/
69 KB
70 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 13:55:14 GMT
server
Apache
accept-ranges
bytes
etag
"11571-5270441645480"
content-length
71025
content-type
application/javascript
jquery.swipebox.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
11 KB
11 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"2a67-526fe6e433440"
content-length
10855
content-type
application/javascript
jquery.circliful.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"c18-526fe6e433440"
content-length
3096
content-type
application/javascript
jquery.smarticker.min.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
13 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
last-modified
Wed, 16 Dec 2015 06:58:17 GMT
server
Apache
accept-ranges
bytes
etag
"3225-526fe6e433440"
content-length
12837
content-type
application/javascript
custom.js
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/
12 KB
13 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

:path
/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Wed, 16 Dec 2015 06:58:16 GMT
server
Apache
accept-ranges
bytes
etag
"31d4-526fe6e33f200"
content-length
12756
content-type
application/javascript
wp-embed.js
securityaffairs.co/wordpress/wp-includes/js/
3 KB
3 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Request headers

:path
/wordpress/wp-includes/js/wp-embed.js?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Thu, 21 Feb 2019 22:56:38 GMT
server
Apache
accept-ranges
bytes
etag
"c8e-5826f6315ef61"
content-length
3214
content-type
application/javascript
sharing.js
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/
23 KB
23 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?ver=9.6.1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
bc29c34d0738c5cb3f96585219667566799d9e142699e982f9406d5b04fa9794

Request headers

:path
/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?ver=9.6.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Tue, 13 Apr 2021 21:43:02 GMT
server
Apache
accept-ranges
bytes
etag
"5a9e-5bfe183ba8d29"
content-length
23198
content-type
application/javascript
e-202117.js
stats.wp.com/
9 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-202117.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT ams
date
Tue, 27 Apr 2021 11:18:15 GMT
content-encoding
gzip
server
nginx
etag
W/"5c6340e3-350a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Sun, 17 Apr 2022 22:00:21 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-59069958-1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
6933
date
Tue, 27 Apr 2021 09:22:42 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Tue, 27 Apr 2021 11:22:42 GMT
twemoji.js
securityaffairs.co/wordpress/wp-includes/js/
27 KB
28 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e98cd00e7be004c4360ad0c38471911312d74a117babcc29f239935afc80c8cb

Request headers

:path
/wordpress/wp-includes/js/twemoji.js?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Wed, 09 Dec 2020 23:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"6d6a-5b61073b100ca"
content-length
28010
content-type
application/javascript
wp-emoji.js
securityaffairs.co/wordpress/wp-includes/js/
9 KB
9 KB
Script
General
Full URL
https://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=7a4684187a2478c1cdbb1d579c9362f3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6

Request headers

:path
/wordpress/wp-includes/js/wp-emoji.js?ver=7a4684187a2478c1cdbb1d579c9362f3
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Tue, 31 Mar 2020 22:49:14 GMT
server
Apache
accept-ranges
bytes
etag
"231d-5a22e608152f1"
content-length
8989
content-type
application/javascript
css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

css
fonts.googleapis.com/
0
0

5b71b64b04b9a500117b1015.js
buttons-config.sharethis.com/js/
30 B
379 B
Script
General
Full URL
https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c8:7200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:17:26 GMT
via
1.1 e39311b8bbf120eef85be5222b7fadac.cloudfront.net (CloudFront)
last-modified
Mon, 13 Aug 2018 16:48:12 GMT
server
AmazonS3
age
50
etag
"e6e1643313740711175f51662a65b42f"
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
x-amz-cf-pop
MAD50-C1
accept-ranges
bytes
content-length
30
x-amz-cf-id
dCO2ruT_cn4_8kVLd2SUA4HHgeER2Yf086iXO-6vWwqGAztk1lh1Ew==
analytics.js
google-analytics.com/
48 KB
20 KB
Script
General
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
2081
date
Tue, 27 Apr 2021 10:43:34 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Tue, 27 Apr 2021 12:43:34 GMT
videoAds.js
adservetx.media.net/
6 KB
3 KB
Script
General
Full URL
https://adservetx.media.net/videoAds.js?cid=8CU5BD6EW&crid=126440378&dn=securityaffairs.co&https=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.62.140.165 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
456910543c2e9ce455f37cc1baea1aa87f54e959a327717a055442b43953d66a

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:15 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=300
Connection
keep-alive
Content-Length
2707
Expires
Tue, 27 Apr 2021 11:23:15 GMT
fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/
43 KB
44 KB
Font
General
Full URL
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software
Apache /
Resource Hash
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

:path
/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
pragma
no-cache
origin
https://securityaffairs.co
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
securityaffairs.co
referer
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:15 GMT
last-modified
Wed, 16 Dec 2015 06:58:09 GMT
server
Apache
accept-ranges
bytes
etag
"ad90-526fe6dc92240"
content-length
44432
content-type
application/font-woff
portal-v2.html
c.sharethis.mgr.consensu.org/ Frame C165
2 KB
1 KB
Document
General
Full URL
https://c.sharethis.mgr.consensu.org/portal-v2.html
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c8:d800:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
ac84513c4c5ea7e4458e91c46e33ba71b56e19fabf93cc079ffcb01a975c2e3d

Request headers

:method
GET
:authority
c.sharethis.mgr.consensu.org
:scheme
https
:path
/portal-v2.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

content-type
text/html; charset=utf-8
content-encoding
gzip
date
Tue, 27 Apr 2021 10:32:48 GMT
cache-control
max-age=3600, public
etag
W/"83a-K1Ex0xzH2LCxSyRnDnyZEg18N68"
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 adaa7e69b304066aa4eaf0d2190ecfd7.cloudfront.net (CloudFront)
x-amz-cf-pop
MAD50-C1
x-amz-cf-id
zKzAZAgF0DzEcMeiYUyVTBnCQJX5wpOGaN_6WB-ID9IexmbFw2EWhw==
age
2727
emotet-exports.jpg
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/04/
28 KB
28 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/04/emotet-exports.jpg?w=578&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
30b2b5ab9321d17dfd840a476719b420adf4891c0389c2129717e1d3b8f3a07d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Mon, 26 Apr 2021 14:57:52 GMT
server
nginx
etag
"e900741741c28d81"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2021/04/emotet-exports.jpg>; rel="canonical"
content-length
28974
expires
Thu, 27 Apr 2023 02:57:52 GMT
Emotet-uninstall_in_april_.jpg
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/04/
23 KB
24 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2021/04/Emotet-uninstall_in_april_.jpg?w=642&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
d7926a6fbca4745b90dcce9532cae06d4c4c6bfc3c6bf634cb30b6dbce23cf76
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Mon, 26 Apr 2021 14:57:52 GMT
server
nginx
etag
"f1135d451cf64e87"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2021/04/Emotet-uninstall_in_april_.jpg>; rel="canonical"
content-length
23858
expires
Thu, 27 Apr 2023 02:57:52 GMT
browserfp.min.js
pxlclnmdecom-a.akamaihd.net/javascripts/
108 KB
33 KB
Script
General
Full URL
https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
23.32.238.131 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-32-238-131.deploy.static.akamaitechnologies.com
Software
/ Express
Resource Hash
fa7c2db6bad4dc8040c7ac9f9ba9966750660e29addaf9b95b65b2ce97ad02f9

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:16 GMT
Content-Encoding
gzip
X-Powered-By
Express
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Max-Age
1800
Cache-Control
max-age=1800
Connection
keep-alive
Content-Length
33903
Expires
Tue, 27 Apr 2021 11:48:16 GMT
fcmain.js
contextual.media.net/1017354394/
76 KB
24 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=CH&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&nse=5&vi=1619522295635879429&lw=1&ugd=4&nb=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e79e6faa3cd5efeb8e62b036549ade82272b2ad89c2e7cbb490cdea7c88a6504
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
x-mnt-hl2
8-3
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300
date
Tue, 27 Apr 2021 11:18:16 GMT
x-mnt-w
12-12, 12-14
content-length
24536
expires
Tue, 27 Apr 2021 11:23:16 GMT
bping.php
lg3.media.net/
35 B
322 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1619522295635879429&ugd=4&lf=6&cc=CH&sc=ZH&lper=100&wsip=2886781336&r=1619522296120&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001619522296046032874714598272&gdpr=0&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:16 GMT
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 27 Apr 2021 11:18:16 GMT
fcmain.js
contextual.media.net/1017354394/
76 KB
24 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=CH&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&nse=5&vi=1619522295125828826&lw=1&ugd=4&nb=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9643378d0de9a9e186c9148a2b31c554615ef6e7e4bb8e2137008c42f6660b48
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
x-mnt-hl2
8-3
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300
date
Tue, 27 Apr 2021 11:18:16 GMT
x-mnt-w
12-12, 12-14
content-length
24547
expires
Tue, 27 Apr 2021 11:23:16 GMT
bping.php
lg3.media.net/
35 B
322 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1619522295125828826&ugd=4&lf=6&cc=CH&sc=ZH&lper=100&wsip=2886781336&r=1619522296167&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001619522296046032874714598272&gdpr=0&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:16 GMT
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 27 Apr 2021 11:18:16 GMT
truncated
/
7 KB
7 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Origin
https://securityaffairs.co
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff;charset=utf-8
f00db26378ef7df7c440a8ee60ead62b
secure.gravatar.com/avatar/
1 KB
1 KB
Image
General
Full URL
https://secure.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Tue, 27 Apr 2021 11:18:16 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="f00db26378ef7df7c440a8ee60ead62b.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f00db26378ef7df7c440a8ee60ead62b?s=60&d=mm&r=g>; rel="canonical"
content-length
1186
expires
Tue, 27 Apr 2021 11:23:16 GMT
sdk.js
connect.facebook.net/en_US/
219 KB
65 KB
Script
General
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=627fc12fa324537f6f678c4f586b7204&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
76f434fcf8e5fef0f5b0ec5c88907b9202caa133a7f2b224dcc95c9c2fd39d22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
k/tcmZv9MAVppfuj7hjtZg==
cross-origin-resource-policy
cross-origin
expires
Wed, 27 Apr 2022 10:03:43 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
66027
x-fb-rlafr
0
x-fb-debug
Bvc/TzvGX2q7CoAw7cXrrAm8OFDN4PmCFli9EJeZhx0HGHwnxlmGzn6JLbMpLphFwZ1MUSWsFTRP6b/Jx/w6dA==
x-fb-trip-id
2052514463
x-fb-content-md5
9fa801b03fcc6a9bbee22f20f5930a89
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Tue, 27 Apr 2021 11:18:16 GMT
x-frame-options
DENY
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"e201fe10e07aadcdf46bd119ff7fdc4e"
timing-allow-origin
*
priority
u=3,i
access-control-expose-headers
X-FB-Content-MD5
fcmain.js
contextual.media.net/1017354394/
83 KB
25 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=CH&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&nse=5&vi=1619522295395818209&lw=1&ugd=4&nb=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85c45aac951a3920e5884ede0f38fff5e2ec09e820e763765ba3ced1c159e175
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
x-mnt-hl2
8-3
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300
date
Tue, 27 Apr 2021 11:18:17 GMT
x-mnt-w
10-9, 10-7
content-length
25280
expires
Tue, 27 Apr 2021 11:23:17 GMT
bping.php
lg3.media.net/
35 B
322 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1619522295395818209&ugd=4&lf=6&cc=CH&sc=ZH&wsip=2886781336&r=1619522296613&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001619522296579032874714596832&gdpr=0&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:16 GMT
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 27 Apr 2021 11:18:16 GMT
fcmain.js
contextual.media.net/1017354394/
83 KB
25 KB
Script
General
Full URL
https://contextual.media.net/1017354394/fcmain.js?cb=window._mNDetails.initAd&&gdpr=0&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=647633027&size=300x250&cc=CH&https=1&vif=1&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&nse=5&vi=1619522295107570078&lw=1&ugd=4&nb=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
05e5f220a85ec07d4e923a8ba2c348b4fd63a88859526594e1e080659814a3a5
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
x-mnt-hl2
8-3
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300
date
Tue, 27 Apr 2021 11:18:17 GMT
x-mnt-w
12-4, 12-10
content-length
24986
expires
Tue, 27 Apr 2021 11:23:17 GMT
bping.php
lg3.media.net/
35 B
322 B
Image
General
Full URL
https://lg3.media.net/bping.php?&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&vi=1619522295107570078&ugd=4&lf=6&cc=CH&sc=ZH&lper=100&wsip=2886781336&r=1619522296629&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001619522296624032874714599724&gdpr=0&vgd_end=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:16 GMT
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 27 Apr 2021 11:18:16 GMT
Digging-The-Deep-Web.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/
6 KB
6 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ba716187f8cc8c54806f5b9de46d1d94bec574ddf31c82f68532cd181e242b7f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"156244085faab7d3"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length
6414
expires
Sat, 05 Nov 2022 20:12:40 GMT
securityaffairs-best-european-blog2.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/
10 KB
10 KB
Image
General
Full URL
https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png?resize=300%2C217&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
x-bytes-saved
103276
content-length
10314
x-nc
HIT hhn 2
last-modified
Tue, 02 Jun 2020 21:29:55 GMT
server
nginx
etag
"c8c3d7b06b174426"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png>; rel="canonical"
expires
Fri, 03 Jun 2022 09:29:55 GMT
logo-center-for-cybersecurity.jpg
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/
7 KB
7 KB
Image
General
Full URL
https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg?resize=290%2C300&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Thu, 05 Nov 2020 08:12:40 GMT
server
nginx
etag
"312ff21e46f29f3d"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg>; rel="canonical"
content-length
7482
expires
Sat, 05 Nov 2022 20:12:40 GMT
newsletter.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/
6 KB
6 KB
Image
General
Full URL
https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png?resize=300%2C207&ssl=1
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
40bc46248d8f8d5fbea7678bd0c0031327e206daaf99f3bf6723b9a70f665f7f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Dec 2020 07:29:12 GMT
server
nginx
etag
"a6fb49f7a00a0498"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png>; rel="canonical"
content-length
6336
expires
Thu, 15 Dec 2022 19:29:12 GMT
collect
www.google-analytics.com/j/
1 B
87 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1408185309&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&ul=en-us&de=UTF-8&dt=Bye%20Bye%20Emotet%2C%20law%20enforcement%20pushed%20the%20uninstall%20code%20via%20the%20botnetSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=211686922&gjid=1824252519&cid=1827374092.1619522297&tid=UA-59069958-1&_gid=1368945222.1619522297&_r=1&did=dNDMyYj&gtm=2ou4e1&z=1347993714
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
2 B
69 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1408185309&t=pageview&_s=1&dl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&ul=en-us&de=UTF-8&dt=Bye%20Bye%20Emotet%2C%20law%20enforcement%20pushed%20the%20uninstall%20code%20via%20the%20botnetSecurity%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEDAAUABAAAAAC~&jid=1799161631&gjid=1525603468&cid=1827374092.1619522297&tid=UA-59069958-1&_gid=1368945222.1619522297&_r=1&_slc=1&z=1012050071
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
g.gif
pixel.wp.com/
50 B
115 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A9.6.1&blog=29506073&post=117238&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=4469&rand=0.3082367655848208
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:16 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
widget_iframe.63899b173766ee6f8a729a72b542b0fb.html
platform.twitter.com/widgets/ Frame 3F0A
319 KB
103 KB
Document
General
Full URL
https://platform.twitter.com/widgets/widget_iframe.63899b173766ee6f8a729a72b542b0fb.html?origin=https%3A%2F%2Fsecurityaffairs.co
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
977402
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Tue, 27 Apr 2021 11:18:16 GMT
Etag
"dab7ee9ff99366614e06e117bab5e542+gzip"
Last-Modified
Thu, 15 Apr 2021 22:44:33 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/674D)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105298
/
graph.facebook.com/
244 B
639 B
Script
General
Full URL
https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?ver=9.6.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
cd89793d4187a24ac1bd06f10b9e2b7ac586973a9b4efe4830bdde5096b44b95
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
www-authenticate
OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev
1003690832
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
182
x-fb-rlafr
0
pragma
no-cache
x-fb-debug
HdwpqrzIgNAAipNOvjCz6C+G9cDZN4FnzcMMXHL7EREtSh8uy9od9TiJZk2JR7N8zisbCiY1yFFQ0QoajNsBig==
x-fb-trace-id
DFt7ruUdbP+
date
Tue, 27 Apr 2021 11:18:17 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AGWRUvImq4kwIoG2urVGVbf
cache-control
no-store
facebook-api-version
v3.2
expires
Sat, 01 Jan 2000 00:00:00 GMT
g.gif
pixel.wp.com/
50 B
97 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.2848960324675296
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:17 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
log
qsearch-a.akamaihd.net/
35 B
329 B
Image
General
Full URL
https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=videoerror&cid=8CU5BD6EW&crid=null&dn=securityaffairs.co&REASON=33&ACTION=0&visitorId=DefVid&dc=0&adtagId=126440378&bidder_id=99999&biddertagid=99999&bsr=Chrome_89&dt=desktop&os=WIN&id=00001619522297023006941794745364&purl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2.16.186.67 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:17 GMT
Server
Jetty(9.4.35.v20201120)
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
35
Expires
Tue, 27 Apr 2021 11:18:17 GMT
hb_v2.js
cdn.pixfuture.com/
30 KB
31 KB
Script
General
Full URL
https://cdn.pixfuture.com/hb_v2.js
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c1f9a8c62c06c10300bb008f0ea06d0451df268662d7f97545c2c3b48d5ec04

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:17 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
54430
cf-bgj
minify
cf-request-id
09b4a634fc00004e1faa175000000001
last-modified
Mon, 26 Apr 2021 19:56:11 GMT
server
cloudflare
etag
W/"60871adb-77b6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5lFJFxIZyEzfynazweWt3bqGaC4ge567RyhaquH96EeAdJiodAX%2BBcljWt11hW6G2gWOHQ2tt7ZGRLolcVrAIWEmmgzbWK2fxaow3FmFksVXX0euVitsPKnPp0hmEA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=2678400, no-transform
cf-ray
6467a634cc7f4e1f-FRA
expires
Wed, 28 Apr 2021 20:11:07 GMT
bfp_ssn.js
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame E7F8
12 KB
4 KB
Document
General
Full URL
https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
23.32.238.131 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-32-238-131.deploy.static.akamaitechnologies.com
Software
/ Express
Resource Hash
508a8b73dfefe6e9998cca8a66aef5f7b9b5a8b24b35ae0e6e8a02f37d4a2c93

Request headers

Host
pxlclnmdecom-a.akamaihd.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Content-Type
text/html; charset=utf-8
X-Powered-By
Express
Vary
Accept-Encoding
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Content-Encoding
gzip
Cache-Control
max-age=1800
Expires
Tue, 27 Apr 2021 11:48:17 GMT
Date
Tue, 27 Apr 2021 11:18:17 GMT
Content-Length
3752
Connection
keep-alive
ptmdP
dt.clnmde.com/
7 B
328 B
Ping
General
Full URL
https://dt.clnmde.com/ptmdP
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 27 Apr 2021 11:18:17 GMT
vary
Accept-Encoding
x-powered-by
Express
etag
W/"7-Jgyp3YpFd/wAt71YECmAdg"
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length
7
cenw.js
dt.clnmde.com/
36 B
361 B
XHR
General
Full URL
https://dt.clnmde.com/cenw.js?identifier=bafp
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
6d295e91ed4fa70edc4008a2e4e0ef1ab329f81feee29097691744d9895ed360

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:17 GMT
vary
Accept-Encoding
x-powered-by
Express
etag
W/"24-ZHVek6nufEvpRIR7DTbEag"
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length
36
ptmdDual
dt6.clnmde.com/
70 B
330 B
Image
General
Full URL
https://dt6.clnmde.com/ptmdDual?t=%7B%22gh%22%3A%22161952229724831650617761%22%2C%22za%22%3A1%2C%22gcd%22%3A1619522297358%2C%22al%22%3A3%2C%22bcnd%22%3A1%7D
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:17 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
ptmd
dt.clnmde.com/
70 B
330 B
Image
General
Full URL
https://dt.clnmde.com/ptmd?t=161952229724831650617761_N4IgxmAWDWIFwG0QA4CMA2A7M5BmTqIANCOgCybq64AMATJsShtngSALokAOAlgCYAXeEhpMxJMVxAAnAKYAzAKoyANsMQgm26QGcZYFepEhIgwd10BSXAEErdAGIPHuuWACuM3oICeAQwUFf14ZXQA6MAB7FwB3KJl+bnldaydUVEw6XGQXMF8AIzkZAFowbwBbORc5CqjBOUESgHNVKIL-VRKPADteHt1BTtVwswrVG0cAfUhdCt4bABEcAE5MCjIyB3QZtx6wJe46WwA5AEdBAC8S5AArZAUvXEcewQAlRwKANzk3hS+AMpTAoAViUChWuGai0cJRksQACgVbBUAJoAD1RADUZAAZE7QMi4gEAKVUmAAGlMAPIyABavAUUymvAqMgAsv5IGB0LoSahIOyEajfLEsUozlM5LETvwSgCSuzuB4mR5IBSaGcPFMSeilH4QbdBNTcLjLrYaNsPIIKlNdFEvGBqrhFmFdEwzBZrHYXC43J5vH5AsFQhFonEEkkUmlHBksjk8oVimVKtUnLV6o0Wm0Ol1ev1BsNRjaJs9dvMlqt1ustnQdrM5PtDsdzlcbvdHjJnq8Pt9fv8gaDwZDobD4UiURjsXiCUTSeSqbSGUyWWzOdzefzBcLReLJdLZfLFcrVerNdrdfrfIbjabzZa69bbfbHc7XalOCQvroWUIRD0PFUVQiAAoDpEgb9fw0UQaFgjBUBWEE6GQlZ0BoMg0NwOhkGrVAyBBFZkAYOhxFgmh4MQ5C6FQ9A6DIGgsJwig8IItY6M-cAPEGKCTGQABhJQQQAIUWdAAFEAHUmH4wSRPEqTpHKL4TGAAAdZgsBwfBUHUuA1JAPxuDkXT1PKX91KIdSvl4cz4HUiikJQkEqBBHCVjIaiLPUiCfwEEyQDI8j0AQxzqLQjCGOw3D8MI4j1IAX3iph9PIShqHoTBdP0wzjLs8AZFsyyQGs2y4Hs4LKKc1AaEwEFMFg7AvNMSC-LywKHKomi6MipiCBitiyASpK9CGQQuJEMgiGoKbJtwEEpvQKbMCm5AppWIhZtwGapvm3BFvwFa1o2qattwMhpEufx4FQHhmngYqmEbZS4BAbgmGaSB7o6lCsjIPAMBBGhgswShCBIQR3RevDqOQGqMLoEFXKYb97vQcIaHCeiSJITp4C2kAFDAeAShukBGl4a6KtC1CSEGO64BoWnYChqnOp2OgaBBXBUARgg8JWR7eDeqHEPCOi6DF1BcHCFYBZIOQPCuuBSY8CmGflr5VBEUAen8Kp7oKAR+GKX8mH4fwhngUBDf4Y2CoEeBQOA4qbIdlmQs65y5rcjyBcSogdb1uQDaNk2HZIc3Lb0kAbbt024Cdr9Xf4L7Waqmq6oa5AQESvRVEGVOPZ+jmJBAVQFGupP45Ab7qJBHnXOwoj0CYTxuLdlABOE0TJPeonlbT6ia3xs5g+VkgFDVuh4qAA
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:17 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
ptmd
dt.clnmde.com/
70 B
330 B
Image
General
Full URL
https://dt.clnmde.com/ptmd?t=161952229724831650617761_N4IgzgTgxgqhA2AXEAuA2iAFoxAHMApAMwCCBATAGIWVgCmUArhAJaICeAhgGbecsQwAOigB7GgHdREACa4IdMISoBGFQHZyRABw0o7AEZ0IAWiisAtnRp0LoxHUQmA5vFEHO8E4wB2LH2CInvBC2BbwxJQA+phgFizEACLa2gCc6gAsmRkUAGwx9D5QSbjkJAByAI6IAF4m2gBW2tzMRJQ+iABKlAYAbnSd3L0AylEGAKww3KlEzomUJhASAAoGJBYAmgAeGwBqEAAy5QDWGQfDAFLw6gAaUQDyEABaLNxRUSwWEACynJhQuTAFxUmG+yw27AkuxglSidAk5RkJmGJm+uEYb0YmBuAAZKowohctjAOOMGoh7kQDjUSDi8oxEBYomBRMwoNYiIlBGAQAAaLA4fDEMhUGj0JisDg8PgCYRiSTSOQKJQ0NSaHR6QzGMyWaxUWz2RwuNweLy+fyBYKhRkRNoFeJJFLpLIZHLkfKxOhFEplKq1epNFoQNodbp9AZDUYTKYzOYLJardbbPaHE5nS7XO6PF5vD5fX7-QHA0HgyHQ2HwxHI1HozHYvEEokk9hkilUml090MpkstkcrlKPkCvCEUg0MUMZhsLi8fiCETiKhSWTyRTKShqrS6Kj6IymcyfPWUA0OJyudyebx+AJBeAhMK26KxB2cp2ZbJ5Ape4qc0oVap1I0zStO0XQ9P0gwjGMkzTLM8yLCsaybDs+xHKc5xXLcDzPK87yfD8fwAkCIJghCUIwnCCJIiiaIYlEWK4vihLEqS5KUtStL0oyzKstA-bciAAC6-K9GAHwyMg6A+Iwd7CVgoniZJGA4ipOIqLkKipOM5A6akuQ4hk+lEOQ2jvioGTjKk2jkJoQn8kwgSKagGDaAAwjA4wAEKJLkACiADqdngEEiCMDy6BEOMvJELk0XqNF2hyTUnCoCo-K4M4qAgL0Q5ejlKAgLgQ7OJgWXqZp2m6ZoGTaEQ6njDiGnqOoGlDog4UgOZ5BWTimS5OQ4zjNoQ6iVluRCDiQgZDi5BDp4qBEPy3BQKgJhpSAjgsKlGlaTp3WxcFmUoDi-JgMcZU7ZV+1ROQOLjHVA3qGoGSpLlLBFQVFVCOQGTkN9KhEEIqSvfydCMClKDrYwW3HaDvTwM5oA+JwVhZQYLAyDIxjiUOMicEEqCgOjmPYxjqDSXeIksDjn2XXtWm5JFpmpL9r0AL5s7ySMo3QaMY1jEA4-yeMEygRP86TMjkzJ8BUzTnV07p4wqL14zqCp6jDRzclgPAgQXRV9OaCpQ7wNwqVy2TtOG0rKgDdZKTukODmIPLbked5fmBfyzgrZDivde+GT8pUvOQ0tMNEGzQA
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:17 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
nrrV65342.js
contextual.media.net/4a/ Frame 8254
89 KB
29 KB
Script
General
Full URL
https://contextual.media.net/4a/nrrV65342.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b03511f3e0771658bf172f4ede71ce85d15ff8ccb7af3cdea0dd3e60ea0ff512
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
max-age=2592000
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
etag
"c8be0e32738f2ac7633a4d5db3a35e34"
vary
Accept-Encoding
x-mnet-h
12-7
content-type
text/javascript; charset=utf-8
cache-control
max-age=1209600
date
Tue, 27 Apr 2021 11:18:17 GMT
content-length
29302
expires
Tue, 11 May 2021 11:18:17 GMT
truncated
/ Frame 8254
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 8254
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
bullet1.woff
contextual.media.net/__media__/fonts/bullet1/ Frame 8254
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet1/bullet1.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:18 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
strict-transport-security
max-age=604800
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
1792
expires
Wed, 28 Apr 2021 11:18:18 GMT
nrrV65342.js
contextual.media.net/4a/ Frame EC10
89 KB
29 KB
Script
General
Full URL
https://contextual.media.net/4a/nrrV65342.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b03511f3e0771658bf172f4ede71ce85d15ff8ccb7af3cdea0dd3e60ea0ff512
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
max-age=2592000
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
etag
"c8be0e32738f2ac7633a4d5db3a35e34"
vary
Accept-Encoding
x-mnet-h
12-7
content-type
text/javascript; charset=utf-8
cache-control
max-age=1209600
date
Tue, 27 Apr 2021 11:18:18 GMT
content-length
29302
expires
Tue, 11 May 2021 11:18:18 GMT
truncated
/ Frame EC10
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame EC10
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
bullet1.woff
contextual.media.net/__media__/fonts/bullet1/ Frame EC10
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet1/bullet1.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:18 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
strict-transport-security
max-age=604800
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
1792
expires
Wed, 28 Apr 2021 11:18:18 GMT
pview
l.sharethis.com/
0
340 B
XHR
General
Full URL
https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1619522295493.65875&hostname=securityaffairs.co&location=%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&bsamesite=true&consent_cookie_duration=2994&consent_duration=2994&gdpr_domain=.consensu.org&gdpr_method=cookie&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&title=Bye%20Bye%20Emotet%2C%20law%20enforcement%20pushed%20the%20uninstall%20code%20via%20the%20botnetSecurity%20Affairs&sop=false&description=European%20law%20enforcement%20has%20conducted%20an%20operation%20aimed%20at%20performing%20a%20mass-sanitization%20of%20computers%20infected%20with%20the%20infamous%20Emotet%20Windows%20malware.%20European%20law%20enforcement%20agencies%20automatically%20wiped%20the%20infamous%20Emotet%20malware%20from%20infected%20systems%20across%20the%20world%20as%20part%20of%20a%20mass%20sanitization%20operation.%20Early%20this%20year%2C%20law%20enforcement%20and%20judicial%20authorities%20worldwide%20conducted%20a%20%5B%E2%80%A6%5D
Requested by
Host: ws.sharethis.com
URL: https://ws.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.26.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-122-26-231.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:18 GMT
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
ptmd
dt.clnmde.com/
70 B
330 B
Image
General
Full URL
https://dt.clnmde.com/ptmd?t=161952229724831650617761_N4IgxgTgbiBcDaJgB0QA4CMA2A7GtAzDhqrCiAC4CeADgKamqQD6AlgCaoA0qUrbnOKmwYAnAFYATNIkZJ4tJPySs3VAAsoAZwGMQABkP6RE6ZNFZ9AFksElOK8SvjRinJNQBfTyC5JhaFZ2BBjiVqTk1PR6LBxqIHy6QiAmUjLiBBKYivqi8Zo6cclGxlhiaeZY4jii+nZoDk4uWIQeIN4gALp+YGDqANZwiBiBwaFWXX40HBRDBpMgEHQAZgCqEAA2swggC1oQYOtbc+oUFDRaAKQEAIKXkgBi9w9adGAArhCs1ACGy8s-VgQLQAOjAAHtngB3cEQdg0JZaK6PDAYdwENDPMBUABGdAgAFpIKwALZ0Z50Engih0CgEgDmG3BOJ+GwJ7wAdqwOVoKKyNiDTiSNtcHsx1FoSaxrgARfCiRpWKz3LDi14csCymiSG4AOQAjhQAF4EtAAKzQy0+BAeHIoACUHjioHR7csoABlZg48SrZaiAj0mUPAkQKEABRxNxJAE0AB4xgBqEAAMrr+lYUx6AFIbHAADWYAHkIAAtVjLZhsEkQACyP3UYCwWmzGHUtfDMaoUMTq31zDoUN17AJHoJtZo70r73U+f0+vezGzcdW1HEZooRYIKaNN30KveFBJzC04M+YHJBBlwK0C20Am28A57w2G26IAKD7mJVSZgs1VqepGgwZwLFaBYPl5L8djQABhVZxAAIRlLAAFEAHUFg5H4hiscwrAsdwsCsLgMAIKx9AaOpRC4DJDECQh9HfbDb1gcw-FYH4SSGJiOJ+Vi0D8ONljgAwsGWDAwHMdgcUkKScAUSQ6BxAgcTQawJPkLA7BwfRfBAYTtnQAg6CwOhRFEHFlgonEHCwSQCGWMACHEMjlnYfQwBcfRJHYfTWBgWB9BBcQ-F5H4KHeVj4EyLgSIIAguHIpLQoILAkpwJLBNi9iCH0UjRHfI0cNgDApnpUSYD8OgOUCkAaH0+l1FE38ZHcKxCGwcR9DKHAcDKfSKFYlI8NcfQ7PkBR9O0USsBBYKKMkfTWTgRKQCcuACTKkBaVYOBWsqMKKAqoKwsGWAUjKUwZFVSR9AyORqlRAj9LoVgGou8oQUkPDvrIkELNe94Su2949tOnaoA2IZQGwslRJxDh2HxAR9PYCKStARH2GRiBUdgZ9Xz8RIOBaq6KgkbSFBqUb2k8LhYa4ugEaRlHSb8dG+TgLHWbx0mCZfDZif4fnLvKP9XPG6pDDwOmGZAOHmYu7HcdRjmMe5kAVbZvyBaJhIRd1sXrvMVz5EUZQsDlxn4eV3m1ZATnMa1+3+cJoWDfx42KYyLIRju0Q6ffLQNl5Mnxbau69L8DYRNK4WvYOiRMgUf3cn0yCKC9uCEOQtDML8ekwH28m-zQYjMpAfUle25ZwasTwgA
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:18 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
pbix.js
cdn.pixfuture.com/
368 KB
369 KB
Script
General
Full URL
https://cdn.pixfuture.com/pbix.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf16e6ade9d4222955aa5451361fa645183c42b3f525ddf73f4f27178f43c8ce

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:18 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
54430
cf-polished
origSize=376614
cf-bgj
minify
cf-request-id
09b4a63b2200004e1f9d124000000001
last-modified
Thu, 15 Apr 2021 13:31:36 GMT
server
cloudflare
etag
W/"60784038-5bf26"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FS8wYm1JTHj1QqvmjxINH4H847FEG0zpzX7cp6dshhJGLQPwLq0qkWbB%2BcnpsydEdGbY0%2BTR8tZ1Bg%2B6OTDYH9xyOoBd0e2eWpUMJ5WEJCMsSdy5%2BOyUbggy8VSAwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=2678400, no-transform
cf-ray
6467a63e98674e1f-FRA
expires
Wed, 28 Apr 2021 20:11:07 GMT
r.js
aa.agkn.com/adscores/
0
185 B
Script
General
Full URL
https://aa.agkn.com/adscores/r.js?sid=9112309848
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.133.35.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-133-35-94.eu-west-2.compute.amazonaws.com
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:18 GMT
server
AAWebServer
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
cache-control
no-cache, no-store, must-revalidate
content-type
application/javascript
content-length
0
expires
0
hb_v2.php
served-by.pixfuture.com/www/delivery/
2 KB
3 KB
XHR
General
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24272x320x50x4142x_ADSLOT1&keywords=bye,bye,emotet,law,enforcement,pushed,uninstall,code,via,botnetsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&jscookie=session_depth=securityaffairs.co%253D0%257C184323154%253D1%257C647633027%253D1;%20_ga=GA1.2.1827374092.1619522297;%20_gid=GA1.2.1368945222.1619522297;%20_gat_gtag_UA_59069958_1=1;%20_gat=1;%20cookielawinfo-checkbox-necessary=yes;%20cookielawinfo-checkbox-non-necessary=yes;%20bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78=Direct;%20bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78=1619522297294;%20bfp_sn_pl=1619522296%7C1_205312571149;%20bafp=442472f0-a74a-11eb-b392-5f0858387f09
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
36e02a28249d89da88030611b1fc17b5cbff522a8f0a95b3721805e5c8b6c458

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:18 GMT
Server
nginx/1.10.3 (Ubuntu)
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:18 GMT
hb_v2.php
served-by.pixfuture.com/www/delivery/
3 KB
3 KB
XHR
General
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24274x728x90x4142x_ADSLOT1&keywords=bye,bye,emotet,law,enforcement,pushed,uninstall,code,via,botnetsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&jscookie=session_depth=securityaffairs.co%253D0%257C184323154%253D1%257C647633027%253D1;%20_ga=GA1.2.1827374092.1619522297;%20_gid=GA1.2.1368945222.1619522297;%20_gat_gtag_UA_59069958_1=1;%20_gat=1;%20cookielawinfo-checkbox-necessary=yes;%20cookielawinfo-checkbox-non-necessary=yes;%20bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78=Direct;%20bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78=1619522297294;%20bfp_sn_pl=1619522296%7C1_205312571149;%20bafp=442472f0-a74a-11eb-b392-5f0858387f09
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
33938ee3fe7dbc6101db61d8597f832b0ca164ebc25e6734acb5fedef900f84f

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:18 GMT
Server
nginx/1.10.3 (Ubuntu)
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:18 GMT
hb_v2.php
served-by.pixfuture.com/www/delivery/
2 KB
3 KB
XHR
General
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24272x320x50x4142x_ADSLOT1&keywords=bye,bye,emotet,law,enforcement,pushed,uninstall,code,via,botnetsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&jscookie=session_depth=securityaffairs.co%253D0%257C184323154%253D1%257C647633027%253D1;%20_ga=GA1.2.1827374092.1619522297;%20_gid=GA1.2.1368945222.1619522297;%20_gat_gtag_UA_59069958_1=1;%20_gat=1;%20cookielawinfo-checkbox-necessary=yes;%20cookielawinfo-checkbox-non-necessary=yes;%20bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78=Direct;%20bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78=1619522297294;%20bfp_sn_pl=1619522296%7C1_205312571149;%20bafp=442472f0-a74a-11eb-b392-5f0858387f09
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
36e02a28249d89da88030611b1fc17b5cbff522a8f0a95b3721805e5c8b6c458

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:18 GMT
Server
nginx/1.10.3 (Ubuntu)
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:18 GMT
hb_v2.php
served-by.pixfuture.com/www/delivery/
3 KB
3 KB
XHR
General
Full URL
https://served-by.pixfuture.com/www/delivery/hb_v2.php?dat=24270x300x250x4142x_ADSLOT1&keywords=bye,bye,emotet,law,enforcement,pushed,uninstall,code,via,botnetsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&jscookie=session_depth=securityaffairs.co%253D0%257C184323154%253D1%257C647633027%253D1;%20_ga=GA1.2.1827374092.1619522297;%20_gid=GA1.2.1368945222.1619522297;%20_gat_gtag_UA_59069958_1=1;%20_gat=1;%20cookielawinfo-checkbox-necessary=yes;%20cookielawinfo-checkbox-non-necessary=yes;%20bfp_sn_rf_8b2087b102c9e3e5ffed1c1478ed8b78=Direct;%20bfp_sn_rt_8b2087b102c9e3e5ffed1c1478ed8b78=1619522297294;%20bfp_sn_pl=1619522296%7C1_205312571149;%20bafp=442472f0-a74a-11eb-b392-5f0858387f09
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
0a9165c4937548f326c7645147ebcaf8db5b7ac785be183777faba05ebed39d6

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Server
nginx/1.10.3 (Ubuntu)
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800, public, no-transform
Transfer-Encoding
chunked
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:19 GMT
nrrV65342.js
contextual.media.net/4a/ Frame A6A1
89 KB
29 KB
Script
General
Full URL
https://contextual.media.net/4a/nrrV65342.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b03511f3e0771658bf172f4ede71ce85d15ff8ccb7af3cdea0dd3e60ea0ff512
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
max-age=2592000
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
etag
"c8be0e32738f2ac7633a4d5db3a35e34"
vary
Accept-Encoding
x-mnet-h
12-7
content-type
text/javascript; charset=utf-8
cache-control
max-age=1209600
date
Tue, 27 Apr 2021 11:18:18 GMT
content-length
29302
expires
Tue, 11 May 2021 11:18:18 GMT
truncated
/ Frame A6A1
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame A6A1
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
bullet1.woff
contextual.media.net/__media__/fonts/bullet1/ Frame A6A1
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet1/bullet1.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:18 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
strict-transport-security
max-age=604800
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
1792
expires
Wed, 28 Apr 2021 11:18:18 GMT
pview
l.sharethis.com/
0
315 B
Image
General
Full URL
https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1619522295493.65875&hostname=securityaffairs.co&location=%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&bsamesite=true&consent_cookie_duration=2994&consent_duration=2994&gdpr_domain=.consensu.org&gdpr_method=cookie&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&title=Bye%20Bye%20Emotet%2C%20law%20enforcement%20pushed%20the%20uninstall%20code%20via%20the%20botnetSecurity%20Affairs&sop=false&description=European%20law%20enforcement%20has%20conducted%20an%20operation%20aimed%20at%20performing%20a%20mass-sanitization%20of%20computers%20infected%20with%20the%20infamous%20Emotet%20Windows%20malware.%20European%20law%20enforcement%20agencies%20automatically%20wiped%20the%20infamous%20Emotet%20malware%20from%20infected%20systems%20across%20the%20world%20as%20part%20of%20a%20mass%20sanitization%20operation.%20Early%20this%20year%2C%20law%20enforcement%20and%20judicial%20authorities%20worldwide%20conducted%20a%20%5B%E2%80%A6%5D&gdpr_domain=.consensu.org&gdpr_method=cookie&description=European%20law%20enforcement%20has%20conducted%20an%20operation%20aimed%20at%20performing%20a%20mass-sanitization%20of%20computers%20infected%20with%20the%20infamous%20Emotet%20Windows%20malware.%20European%20law%20enforcement%20agencies%20automatically%20wiped%20the%20infamous%20Emotet%20malware%20from%20infected%20systems%20across%20the%20world%20as%20part%20of%20a%20mass%20sanitization%20operation.%20Early%20this%20year%2C%20law%20enforcement%20and%20judicial%20authorities%20worldwide%20conducted%20a%20%5B%E2%80%A6%5D&img_pview=true
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.26.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-122-26-231.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:18 GMT
Access-Control-Max-Age
1728000
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
nrrV65342.js
contextual.media.net/4a/ Frame C712
89 KB
29 KB
Script
General
Full URL
https://contextual.media.net/4a/nrrV65342.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b03511f3e0771658bf172f4ede71ce85d15ff8ccb7af3cdea0dd3e60ea0ff512
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
max-age=2592000
strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
etag
"c8be0e32738f2ac7633a4d5db3a35e34"
vary
Accept-Encoding
x-mnet-h
12-7
content-type
text/javascript; charset=utf-8
cache-control
max-age=1209600
date
Tue, 27 Apr 2021 11:18:18 GMT
content-length
29302
expires
Tue, 11 May 2021 11:18:18 GMT
truncated
/ Frame C712
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame C712
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
bullet1.woff
contextual.media.net/__media__/fonts/bullet1/ Frame C712
2 KB
2 KB
Font
General
Full URL
https://contextual.media.net/__media__/fonts/bullet1/bullet1.woff
Requested by
Host: securityaffairs.co
URL: https://securityaffairs.co/wordpress/117238/cyber-crime/emotet-global-uninstall.html?utm_campaign=emotet-global-uninstall&utm_medium=rss&_hsmi=88974744&_hsenc=p2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0&utm_source=rss
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.144.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-108-144-24.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Origin
https://securityaffairs.co
Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:18 GMT
last-modified
Mon, 16 May 2016 10:39:41 GMT
server
Apache
strict-transport-security
max-age=604800
content-type
application/font-woff
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
content-length
1792
expires
Wed, 28 Apr 2021 11:18:18 GMT
bql.php
lg3.media.net/ Frame EC10
15 B
397 B
Script
General
Full URL
https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=0&hvsid=00001619522296046032874714598272&geo=47.37|8.55&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYIKPgptAbTBefyD7NUkW-8bWOTXahC47aqCDUCh1RnGmBdDaKFUgVO_AzWoO6ZJ0FFZJaYVcACsU&lpid=&tsid=1&q=&prv=&type=&ps=&cme=ajOpNbjAFHlRpIdmKR6SrUxjVPB-DW9M84r5YkHPEfw-8KcM83KI87YKPknIySF-Wa3laVDDuneE85At4gXhLYE4_4T8g9cXft-Q0nu4mJvyQcYI6-6M5PMVqiUdE8SQLA3BlZR-BQK0gSP1d9nxnSIepvnO7FJDdHddReWZyPJnroBxxwCSwQrAB3mIEOCXyYWYDXHNYjwzCPM0PwSkCSXBi44-wM2lRrdRkcCi3NA%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CSiUyr_wmTz9zfKOAddGZtiUaH4Y1vaZV3wUuWKYkPsA3ufeLNj_aLRm5yVyREq8uoNccNdgKfWzK16Hpxmqs5m8yo5D3iqx62zDTSLFOsbouF3CDTgCrsknlaGbABHYcGMtINrVBsIBsPWTPTEgWaRRFZ7XC4BIu7o8THSuLsBzuoNN9_m38WSSFPr38yFSXPYTSd9Q6-8PHxcx81ZyRQsuaEIA_PDIqArexq6_xUpjkSSEbm3EOfUwIvZFREEC4w0qxjVhF8TdF2rS0O8q2_nFaHoxSD8iFY2SL7MFNTLw%3D%7CN7fu2vKt8_s%3D%7C8X_sA2xQ58Z37_bPw_CTMa_X6Jha_GWJi7bbOj7unuCJ2UhGyaL5DeXkaQeU8LWrHLgHUsCyVtnCZvfMea6xoOlGFSXhdUX5HZsMoO-VsLjsfwE7fvIxQf5rvRDavhVhtRJpJuDOwpd7Ji50bj1FCEAm0LlgZvM32SUeQiLS0hZPnr-f9sIu4ElEqMEtwC7uobp0sukupRaKWw5qeZL5ETabaik9tr-V%7C&hint=&td=&cc=CH&wsip=2886938670&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_kbbh=ufNoNufzNuN&vgde_setid=NufozNuN&&rc=0&ksu=207&fdkt=439&kwd[]=Cyber%20Crime%20Complaint%20Portal&kwt[]=439&kbc[]=1202993920&kwp[]=1&kid[]=329867353&kbc2[]=ps%3D0.876%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=824650629376&kwd[]=Cyber%20Crime%20Law&kwt[]=439&kbc[]=1202993920&kwp[]=2&kid[]=7535109&kbc2[]=ps%3D0.876%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=274894815488&kwd[]=Cyber%20Crime%20Cases&kwt[]=439&kbc[]=1202993920&kwp[]=3&kid[]=68168811&kbc2[]=ps%3D0.876%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=274911592704&kwd[]=Cyber%20Security%20Certifications&kwt[]=439&kbc[]=1202993920&kwp[]=4&kid[]=68172844&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D1%7C%7Cps%3D0.876%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=288232850086826240&kwd[]=Online%20Cyber%20Crime%20Portal&kwt[]=439&kbc[]=1202993920&kwp[]=5&kid[]=330029445&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D7%7C%7Cps%3D0.876%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=2017615106980319488&rand=1619522298841&cid=8CU5BD6EW&vwid=1619522295125828826&vi=1619522295125828826&l3ch=1&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&vgd_l1rakh=1619522295122968327&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D2%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1619522296164&upk=1619522296.21735&hvsid=00001619522296046032874714598272&verid=4121199&kbbq=%26sde%3D1%26adepth%3D2%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=100&matm=1619522298850&vgd_ltime=2727&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=1&vgd_l1ch=1&vgd_katbid=-2&vgd_kals=base%7C%7Cpc%3D100&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886926799&vgd_nrrsf=nrr&vgd_nrrv=65342&vgd_nrrs=65342&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-816788371%7CDIV&vgd_x_pos=367&vgd_y_pos=3724&vgd_ren_page_h=5986&vgd_cty=ZURICH&vgd_l1hcsd=A8%7C2774&vgd_sethcsd=A3%7C2773&vgd_cfud=200205&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=524_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&oRurl=http%3A%2F%2Fcdn3ncc%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DCH%26isOffice%3D0%26fvips%3D0%26vi%3D1619522295635879429%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D816788371%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26cb%3Dwindow._mNDetails.initAd%26gdpr%3D0%26pid%3D8PO5M70HK%26requrl%3Dhttps%253a%252f%252fsecurityaffairs.co%252fwordpress%252f117238%252fcyber-crime%252femotet-global-uninstall.html%253f_hsmi%253d88974744%2526_hsenc%253dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%2526utm_source%253drss%26%26katen%3D1%26katbid%3D-2&tdAdd[]=uiparams%3D%3Brend_w%3A524%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:18 GMT
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 27 Apr 2021 11:18:18 GMT
log
navvy.media.net/ Frame EC10
807 B
980 B
Ping
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.149.102.34.bc.googleusercontent.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
via
1.1 google
server
Jetty(9.4.7.v20170914)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
alt-svc
clear
content-length
807
expires
Tue, 27 Apr 2021 11:18:19 GMT
bql.php
lg3.media.net/ Frame 8254
15 B
397 B
Script
General
Full URL
https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=0&hvsid=00001619522296046032874714598272&geo=47.37|8.55&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYIKPgptAbTBefyD7NUkW-8bWOTXahC47aqCDUCh1RnGmBdDaKFUgVO_AzWoO6ZJ0FFZJaYVcACsU&lpid=&tsid=1&q=&prv=&type=&ps=&cme=ajOpNbjAFHlRpIdmKR6SrUxjVPB-DW9M84r5YkHPEfw-8KcM83KI87YKPknIySF-Wa3laVDDuneE85At4gXhLYE4_4T8g9cXft-Q0nu4mJvyQcYI6-6M5PMVqiUdE8SQLA3BlZR-BQK0gSP1d9nxnSIepvnO7FJDdHddReWZyPJnroBxxwCSwQrAB3mIEOCXyYWYDXHNYjwzCPM0PwSkCSXBi44-wM2lRrdRkcCi3NA%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CSiUyr_wmTz9zfKOAddGZtiUaH4Y1vaZV3wUuWKYkPsA3ufeLNj_aLRm5yVyREq8uoNccNdgKfWzK16Hpxmqs5m8yo5D3iqx62zDTSLFOsbouF3CDTgCrsknlaGbABHYcGMtINrVBsIBsPWTPTEgWaRRFZ7XC4BIu7o8THSuLsBzuoNN9_m38WSSFPr38yFSXPYTSd9Q6-8PHxcx81ZyRQsuaEIA_PDIqArexq6_xUpjkSSEbm3EOfUwIvZFREEC4w0qxjVhF8TdF2rS0O8q2_nFaHoxSD8iFY2SL7MFNTLw%3D%7CN7fu2vKt8_s%3D%7C8X_sA2xQ58Z37_bPw_CTMa_X6Jha_GWJi7bbOj7unuCJ2UhGyaL5DeXkaQeU8LWrHLgHUsCyVtnCZvfMea6xoOlGFSXhdUX5HZsMoO-VsLjsfwE7fvIxQf5rvRDavhVhtRJpJuDOwpd7Ji50bj1FCEAm0LlgZvM32SUeQiLS0hZPnr-f9sIu4ElEqMEtwC7uobp0sukupRaKWw5qeZL5ETabaik9tr-V%7C&hint=&td=&cc=CH&wsip=2886938670&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_kbbh=ufNoNufzNuN&vgde_setid=NufozNuN&&rc=0&ksu=207&fdkt=439&kwd[]=Cyber%20Crime%20Complaint%20Portal&kwt[]=439&kbc[]=1202993920&kwp[]=1&kid[]=329867353&kbc2[]=ps%3D0.876%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=824650629376&kwd[]=Cyber%20Crime%20Law&kwt[]=439&kbc[]=1202993920&kwp[]=2&kid[]=7535109&kbc2[]=ps%3D0.876%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=274894815488&kwd[]=Cyber%20Crime%20Cases&kwt[]=439&kbc[]=1202993920&kwp[]=3&kid[]=68168811&kbc2[]=ps%3D0.876%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=274911592704&kwd[]=Cyber%20Security%20Certifications&kwt[]=439&kbc[]=1202993920&kwp[]=4&kid[]=68172844&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D1%7C%7Cps%3D0.876%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=288232850086826240&kwd[]=Online%20Cyber%20Crime%20Portal&kwt[]=439&kbc[]=1202993920&kwp[]=5&kid[]=330029445&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D7%7C%7Cps%3D0.876%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=2017615106980319488&rand=1619522299014&cid=8CU5BD6EW&vwid=1619522295635879429&vi=1619522295635879429&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&vgd_l1rakh=1619522295122968327&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1619522296046&upk=1619522296.21735&hvsid=00001619522296046032874714598272&verid=4121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&pid=8PO5M70HK&katen=1&pc=100&matm=1619522299019&vgd_ltime=3036&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_katbid=-2&vgd_kals=base%7C%7Cpc%3D100&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886926799&vgd_nrrsf=nrr&vgd_nrrv=65342&vgd_nrrs=65342&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-816788371%7CDIV&vgd_x_pos=367&vgd_y_pos=3467&vgd_ren_page_h=5986&vgd_cty=ZURICH&vgd_l1hcsd=A8%7C2774&vgd_sethcsd=A3%7C2773&vgd_cfud=200205&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=524_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&oRurl=http%3A%2F%2Fcdn3ncc%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DCH%26isOffice%3D0%26fvips%3D0%26vi%3D1619522295635879429%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D816788371%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26cb%3Dwindow._mNDetails.initAd%26gdpr%3D0%26pid%3D8PO5M70HK%26requrl%3Dhttps%253a%252f%252fsecurityaffairs.co%252fwordpress%252f117238%252fcyber-crime%252femotet-global-uninstall.html%253f_hsmi%253d88974744%2526_hsenc%253dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%2526utm_source%253drss%26%26katen%3D1%26katbid%3D-2&tdAdd[]=uiparams%3D%3Brend_w%3A524%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:19 GMT
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 27 Apr 2021 11:18:19 GMT
log
navvy.media.net/ Frame 8254
807 B
869 B
Ping
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.149.102.34.bc.googleusercontent.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
via
1.1 google
server
Jetty(9.4.7.v20170914)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
alt-svc
clear
content-length
807
expires
Tue, 27 Apr 2021 11:18:19 GMT
bql.php
lg3.media.net/ Frame A6A1
15 B
397 B
Script
General
Full URL
https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=0&hvsid=00001619522296624032874714599724&geo=47.37|8.55&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYIKPgptAbTBesoXBy39Fcx5Ypvyb-CKyh4qzoj-Wtod542fqHZPc0a24c-EjMtH8FzY9uLaYBI99&lpid=&tsid=1&q=&prv=&type=&ps=&cme=Aooh5nRzPxUMuX-gAJ0DYbGext3mOz_CN_7nhsbdcwSKRhh0xd3zhyxaRmJWHuqTGPOsBM4mIqtF6KwqJ12XEBKvQZPRabmMz6gpcHw-OdhyimWUpQ5RE9ACPRlGrwUTfN6vRKD-wJ18YPpjH8XSlPJwgPfKSrGgB9db7pEgc6XtG7wJwa6Xt9p1T1C3W1KPt-3HZuDGww282JX7ZCE_BM1-H_DA_iyo7_B8_QjdUVY%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CSiUyr_wmTz9zfKOAddGZtiUaH4Y1vaZV3wUuWKYkPsA3ufeLNj_aLRm5yVyREq8uoNccNdgKfWzK16Hpxmqs5m8yo5D3iqx62zDTSLFOsbouF3CDTgCrsknlaGbABHYcGMtINrVBsIBsPWTPTEgWaRRFZ7XC4BIu7o8THSuLsBzuoNN9_m38WSSFPr38yFSXPYTSd9Q6-8PHxcx81ZyRQsuaEIA_PDIqArexq6_xUpjkSSEbm3EOfUwIvZFREEC4w0qxjVhF8TdF2rS0O8q2_nFaHoxSD8iFY2SL7MFNTLw%3D%7CN7fu2vKt8_s%3D%7CZ3ikG3St0YoxRyG7wEfCAD0fFQGcMq0kwEvAbpYGn0GSdPiW5VvlU8gaJ6cAMvAqP3bzgy01_xCnY4rjDp6bur4NXx6Jzdm0NCmhKFFKFN3b9KQap5_fkw_Hh-GUcAXT97Een1wmpU9vO02IKBL4nlYS4jVVoXQTOMh0QnCnw1S8RLnOxvqmIUTkH87n7Jt2E_BXxENpnYc6UDLn_cjqZ0_OuRoGNxdJ%7C&hint=&td=&cc=CH&wsip=2886939396&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_kbbh=ufNoNufzNuN&vgde_setid=NufozNuN&&rc=0&ksu=207&fdkt=439&kwd[]=Cyber%20Security%20Certifications&kwt[]=439&kbc[]=1202993920&kwp[]=1&kid[]=68172844&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D1%7C%7Cps%3D0.876%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=288232850086760704&kwd[]=Online%20Cyber%20Crime%20Portal&kwt[]=439&kbc[]=1202993920&kwp[]=2&kid[]=330029445&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D7%7C%7Cps%3D0.876%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=2017615106980253952&kwd[]=Cyber%20Crime%20Complaint%20Portal&kwt[]=439&kbc[]=1202993920&kwp[]=3&kid[]=329867353&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D7%7C%7Cps%3D0.876%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=2017615656736067840&kwd[]=Cyber%20Crime%20Laws&kwt[]=439&kbc[]=1202993920&kwp[]=4&kid[]=7535110&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D7%7C%7Cps%3D0.876%7C%7Crpc%3D0.07%7C%7Clvl%3D1.00&ktd[]=2017615106980253952&kwd[]=Cyber%20Crime%20Articles&kwt[]=439&kbc[]=1202993920&kwp[]=5&kid[]=68168797&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D1%7C%7Cps%3D0.876%7C%7Crpc%3D0.09%7C%7Clvl%3D1.00&ktd[]=288232850086760704&rand=1619522299059&cid=8CU5BD6EW&vwid=1619522295107570078&vi=1619522295107570078&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&vgd_l1rakh=1619522295122968327&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1619522296624&upk=1619522296.21735&hvsid=00001619522296624032874714599724&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=100&matm=1619522299063&vgd_ltime=2451&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_katbid=-2&vgd_kals=base%7C%7Cpc%3D100&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886935528&vgd_nrrsf=nrr&vgd_nrrv=65342&vgd_nrrs=65342&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-647633027%7CDIV&vgd_x_pos=980&vgd_y_pos=723&vgd_ren_page_h=5986&vgd_cty=ZURICH&vgd_l1hcsd=A8%7C2774&vgd_sethcsd=A3%7C2773&vgd_cfud=200205&vgd_is_amp=0&vgd_optout=0&vgd_ect=4g&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&oRurl=http%3A%2F%2Fcdn3ncc%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DCH%26isOffice%3D0%26fvips%3D0%26vi%3D1619522295107570078%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D647633027%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26cb%3Dwindow._mNDetails.initAd%26gdpr%3D0%26pid%3D8PO5M70HK%26requrl%3Dhttps%253a%252f%252fsecurityaffairs.co%252fwordpress%252f117238%252fcyber-crime%252femotet-global-uninstall.html%253f_hsmi%253d88974744%2526_hsenc%253dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%2526utm_source%253drss%26%26katen%3D1%26katbid%3D-2&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:19 GMT
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 27 Apr 2021 11:18:19 GMT
log
navvy.media.net/ Frame A6A1
807 B
869 B
Ping
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.149.102.34.bc.googleusercontent.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
via
1.1 google
server
Jetty(9.4.7.v20170914)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
alt-svc
clear
content-length
807
expires
Tue, 27 Apr 2021 11:18:19 GMT
json
gum.criteo.com/sid/ Frame
0
0
Preflight
General
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1
Protocol
H2
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://securityaffairs.co
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
https://securityaffairs.co
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1430
date
Tue, 27 Apr 2021 11:18:18 GMT
content-encoding
gzip
vary
Accept-Encoding
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1
  • https://mug.criteo.com/sid?cpp=oGi_jXxFNzB3SjZISy9DQkpvekJtYVhEMlc5cmFQREUwanVZd2tkNU15dmtLcno0cU0ydCtlc2hZSHU2NjBhRmp0UndDNlR0biszUHFseUlmQktwOHVrUTRSNUhPTnZVMEI4TlVBdmtseXhjT3hjWnZjYktuZExvSjNpd2...
347 B
630 B
XHR
General
Full URL
https://mug.criteo.com/sid?cpp=oGi_jXxFNzB3SjZISy9DQkpvekJtYVhEMlc5cmFQREUwanVZd2tkNU15dmtLcno0cU0ydCtlc2hZSHU2NjBhRmp0UndDNlR0biszUHFseUlmQktwOHVrUTRSNUhPTnZVMEI4TlVBdmtseXhjT3hjWnZjYktuZExvSjNpd2RCWUFXdzNWeHlEbGNVa0xUbDdCdVkxa0VQUThLek0rMjdVTzZ5MVQ2MFhLUFBRbThZUUdYNUdLMGtQZ1Q3Z3NxZUNQK0ZXNWE2ekVlU1VsVzJ3NGkvOTVhWks4Y1p4R1FDd0tXVVZUYU05djJmRUdEcGI0PXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
88439e057d6f2cea06eb1cf5fa51382fe8d9656581737de141c04aed92bc2f17
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
content-encoding
gzip
date
Tue, 27 Apr 2021 11:18:19 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2591
expires
0

Redirect headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Tue, 27 Apr 2021 11:18:19 GMT
location
https://mug.criteo.com/sid?cpp=oGi_jXxFNzB3SjZISy9DQkpvekJtYVhEMlc5cmFQREUwanVZd2tkNU15dmtLcno0cU0ydCtlc2hZSHU2NjBhRmp0UndDNlR0biszUHFseUlmQktwOHVrUTRSNUhPTnZVMEI4TlVBdmtseXhjT3hjWnZjYktuZExvSjNpd2RCWUFXdzNWeHlEbGNVa0xUbDdCdVkxa0VQUThLek0rMjdVTzZ5MVQ2MFhLUFBRbThZUUdYNUdLMGtQZ1Q3Z3NxZUNQK0ZXNWE2ekVlU1VsVzJ3NGkvOTVhWks4Y1p4R1FDd0tXVVZUYU05djJmRUdEcGI0PXw&cppv=2
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1722
content-length
482
expires
0
envelope
api.rlcdn.com/api/identity/
0
0

id
id.sharedid.org/
41 B
375 B
XHR
General
Full URL
https://id.sharedid.org/id
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.35.237.254 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-35-237-254.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
2ed8c54f0caceb98b619e37178c2a8c5e8ba731d31b7d62c8d01b3a2770e3d23

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin
https://securityaffairs.co
cache-control
no-cache,no-store,must-revalidate
access-control-allow-credentials
true
content-length
41
expires
0
rid
match.adsrvr.org/track/
109 B
543 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.173.5 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-51-173-5.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
bf69a04d849896ab74ab589a4ff019d93cca4c7735748e31aec8620e7e48758b

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Thu, 27 May 2021 11:18:19 GMT
prebid
ib.adnxs.com/ut/v3/
19 B
720 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.80:80
AN-X-Request-Uuid
d66ac3f8-8d2d-4fb2-8021-cf9cfa4660cc
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trinity.json
apex.go.sonobi.com/
1 KB
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2244096ce4d07117%22%3A%22277a716b3c3b01668abf%7C320x50%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&s=b7dd1314-3f00-4aff-a922-d0cf0f23d963&pv=1cfeb150-ee21-452e-8047-1b4a96dc3ad1&vp=desktop&lib_name=prebid&lib_v=4.26.0&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22pubcid%22%3A%22ff2a363b-8c9e-48fb-a301-c88d5efb735a%22%7D&kw=bye%2Cbye%2Cemotet%2Claw%2Cenforcement%2Cpushed%2Cuninstall%2Ccode%2Cvia%2Cbotnetsecurity%2Caffairs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
9c3e46acc558842843584b7618dc8418cee95aeb5c9e98eae29fd2d379604eb1
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
587
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
arj
pixfuture2-d.openx.net/w/1.0/
172 B
357 B
XHR
General
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=98753605-70ad-4757-b5a9-73872fba3037&nocache=1619522299320&pubcid=ff2a363b-8c9e-48fb-a301-c88d5efb735a&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=320x50&divIds=24272x320x50x4142x_ADSLOT1&auid=540580841&tps=bXlrZXl3b3JkPWJ5ZSxieWUsZW1vdGV0LGxhdyxlbmZvcmNlbWVudCxwdXNoZWQsdW5pbnN0YWxsLGNvZGUsdmlhLGJvdG5ldHNlY3VyaXR5LGFmZmFpcnMmbXlvdGhlcmtleXdvcmQ9YnllLGJ5ZSxlbW90ZXQsbGF3LGVuZm9yY2VtZW50LHB1c2hlZCx1bmluc3RhbGwsY29kZSx2aWEsYm90bmV0c2VjdXJpdHksYWZmYWlycw%3D%3D
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
0ab269f8658efd475e4074334f27c5140c558bb4133488c38855ff21c26e6519

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
server
OXGW/16.205.4
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
162
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
hb
ssc.33across.com/api/v1/
65 B
642 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.78.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-78-134.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
052c3758457b2abb2b7bd45b689f01539224b55711adb21fe74900e46c05c1b5

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
v1
btlr.sharethrough.com/WYu2BXv1/
0
114 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:19 GMT
access-control-allow-credentials
true
vary
Origin
translator
hbopenbid.pubmatic.com/
0
117 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:17 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
trinity.json
apex.go.sonobi.com/
1 KB
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22148db9f1dda2fc7%22%3A%22951d83dd852c9348161e%7C728x90%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&s=be59ac76-3e58-4085-b0a1-094715111bc5&pv=1cfeb150-ee21-452e-8047-1b4a96dc3ad1&vp=desktop&lib_name=prebid&lib_v=4.26.0&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22pubcid%22%3A%22ff2a363b-8c9e-48fb-a301-c88d5efb735a%22%7D&kw=bye%2Cbye%2Cemotet%2Claw%2Cenforcement%2Cpushed%2Cuninstall%2Ccode%2Cvia%2Cbotnetsecurity%2Caffairs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
ae49b391a9533843055fe35edb45acf2eae13eb607fc3449c1f80323c7e4c273
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
584
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/
19 B
721 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.148:80
AN-X-Request-Uuid
8643ec27-a7ed-4189-ae1f-7d32deba2233
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bidRequest
c2shb.ssp.yahoo.com/
62 B
750 B
XHR
General
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969105017575db4f32dc2eda5c0067&pos=pixfuture_network_news_728x90&cmd=bid&secure=1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/7.1.2.128 /
Resource Hash
34ce52b168df48076692a035a102d06407c39c9568772987f586f05a8c56f385

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 27 Apr 2021 11:18:19 GMT
Server
ATS/7.1.2.128
Age
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST,GET,HEAD,OPTIONS
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
62
translator
hbopenbid.pubmatic.com/
0
61 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:17 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
arj
pixfuture2-d.openx.net/w/1.0/
173 B
360 B
XHR
General
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=94c17bce-645b-44c7-a6e4-0ca47720ed1d&nocache=1619522299334&pubcid=ff2a363b-8c9e-48fb-a301-c88d5efb735a&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=728x90&divIds=24274x728x90x4142x_ADSLOT1&auid=540580842&tps=bXlrZXl3b3JkPWJ5ZSxieWUsZW1vdGV0LGxhdyxlbmZvcmNlbWVudCxwdXNoZWQsdW5pbnN0YWxsLGNvZGUsdmlhLGJvdG5ldHNlY3VyaXR5LGFmZmFpcnMmbXlvdGhlcmtleXdvcmQ9YnllLGJ5ZSxlbW90ZXQsbGF3LGVuZm9yY2VtZW50LHB1c2hlZCx1bmluc3RhbGwsY29kZSx2aWEsYm90bmV0c2VjdXJpdHksYWZmYWlycw%3D%3D
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
5380b726c841b4b99b09a4ac9fd0f79d2d41b1a5742aa572c4f5f999d3bbf0b7

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
server
OXGW/16.205.4
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
hb
ssc.33across.com/api/v1/
66 B
634 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.78.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-78-134.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
b7387d4c7ecb9d2443950a8ca1f318b2666d1c3e1bc727a9b955ea69a7e3c50e

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/
19 B
719 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.6:80
AN-X-Request-Uuid
3e3b7bd0-354f-41ba-9695-1f1a49f679b3
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/
0
61 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:17 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
hb
ssc.33across.com/api/v1/
66 B
634 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.78.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-78-134.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
1ffc2b137c2505247b353f0906f6928b7f38a6e23365a5340006e34bc7634382

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
v1
btlr.sharethrough.com/WYu2BXv1/
0
115 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:19 GMT
access-control-allow-credentials
true
vary
Origin
bidRequest
c2shb.ssp.yahoo.com/
62 B
750 B
XHR
General
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969105017575db4f32dc2eda5c0067&pos=pixfuture_network_news_300x250&cmd=bid&secure=1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software
ATS/7.1.2.128 /
Resource Hash
4f556e6dcd6db86ce3ff56602776728fe931ed954a51e43f9be28dfea091f27b

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 27 Apr 2021 11:18:19 GMT
Server
ATS/7.1.2.128
Age
0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST,GET,HEAD,OPTIONS
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://securityaffairs.co
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
62
trinity.json
apex.go.sonobi.com/
1 KB
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22368981b41f27776%22%3A%22833199e4bd4003904bc3%7C300x250%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&s=6ed7670e-e9a7-49fd-b765-5f804150c866&pv=1cfeb150-ee21-452e-8047-1b4a96dc3ad1&vp=desktop&lib_name=prebid&lib_v=4.26.0&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22pubcid%22%3A%22ff2a363b-8c9e-48fb-a301-c88d5efb735a%22%7D&kw=bye%2Cbye%2Cemotet%2Claw%2Cenforcement%2Cpushed%2Cuninstall%2Ccode%2Cvia%2Cbotnetsecurity%2Caffairs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
69d6e2037b85dfa5cbb86bd06d71c8134a27d3a7f55d70c24bb45099d0bd1571
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
585
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
arj
pixfuture2-d.openx.net/w/1.0/
172 B
560 B
XHR
General
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=94420fd5-ce28-4a48-a4d8-e6dcbccb199a&nocache=1619522299350&pubcid=ff2a363b-8c9e-48fb-a301-c88d5efb735a&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=300x250&divIds=24270x300x250x4142x_ADSLOT1&auid=540580840&tps=bXlrZXl3b3JkPWJ5ZSxieWUsZW1vdGV0LGxhdyxlbmZvcmNlbWVudCxwdXNoZWQsdW5pbnN0YWxsLGNvZGUsdmlhLGJvdG5ldHNlY3VyaXR5LGFmZmFpcnMmbXlvdGhlcmtleXdvcmQ9YnllLGJ5ZSxlbW90ZXQsbGF3LGVuZm9yY2VtZW50LHB1c2hlZCx1bmluc3RhbGwsY29kZSx2aWEsYm90bmV0c2VjdXJpdHksYWZmYWlycw%3D%3D
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4d8630043c804695825ad3c6c60b41d9150da761a6be49279284ba87b43f8943

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
server
OXGW/16.205.4
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
163
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
bql.php
lg3.media.net/ Frame C712
15 B
397 B
Script
General
Full URL
https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=0&hvsid=00001619522296579032874714596832&geo=47.37|8.55&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYIKPgptAbTBesoXBy39Fcx5Ypvyb-CKyh4qzoj-Wtod542fqHZPc0a1P0Xn4AY5K7fcZ4ZW8zHtV&lpid=&tsid=1&q=&prv=&type=&ps=&cme=yNjTBIj9KU7YOwHzjxgy1BXKRbacS1nY08ndy65QHF4GWK8RtLoW015fWwVbGmVmOGRUF-jjxxZtMgW5dS1344Z68Kfq5tdyw6carWDknWM-3cJGilkViv6-i6vtVICDElM7T2ZNB0VG3rZN0Afp8ktjfEGvQQwukj9gtJphkQqZX5QlN8qkeRXb5NxawH52K543qqBldLNwCexYuK3EdQTA94oJIcEg%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CSiUyr_wmTz9zfKOAddGZtiUaH4Y1vaZV3wUuWKYkPsA3ufeLNj_aLRm5yVyREq8uoNccNdgKfWzK16Hpxmqs5m8yo5D3iqx62zDTSLFOsbouF3CDTgCrsknlaGbABHYcGMtINrVBsIBsPWTPTEgWaRRFZ7XC4BIu7o8THSuLsBzuoNN9_m38WSSFPr38yFSXPYTSd9Q6-8PHxcx81ZyRQsuaEIA_PDIqArexq6_xUpjkSSEbm3EOfUwIvZFREEC4w0qxjVhF8TdF2rS0O8q2_nFaHoxSD8iFY2SL7MFNTLw%3D%7CN7fu2vKt8_s%3D%7CcGQY_rxQcsqtzqlSGk7jDXhuGqqVyMbMm65ubnAHUJWlDjRASl6ADWqy6q4xR3bm4CAfyNq1i-Hs38N6fRv9f_UXtYlk6TqBS4IBjwTc9UILv3nRAeWwTumlCbn1Wrnap-5cvYFeFEtt1JLxeoAMcZfZAhCFyfjeW9OSIeajoftNC88EqVcpG3wxixLWpKPLvxbmIEJugc-gq38dAJRErEbAbw1S7bJM%7C&hint=&td=&cc=CH&wsip=2887305235&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_kbbh=u9oNufzeuJ&vgde_setid=Nu9&&rc=0&ksu=224&fdkt=355&kwd[]=Best%20Antivirus%20Software&kwt[]=355&kbc[]=de10c94588d2ac8b90c8f744ff42bb16.d2s&kwp[]=1&kid[]=3455182&kbc2[]=ps%3D0.982%7C%7Crpc%3D2.24%7C%7Clvl%3D3.32&ktd[]=274911592704&kwd[]=Best%20Anti-Ransomware%20Software&kwt[]=355&kbc[]=de10c94588d2ac8b90c8f744ff42bb16.d2s&kwp[]=2&kid[]=326729916&kbc2[]=ps%3D0.982%7C%7Crpc%3D0.72%7C%7Clvl%3D1.00&ktd[]=274894815488&kwd[]=Cyber%20Crime%20Law&kwt[]=439&kbc[]=1202993920&kwp[]=3&kid[]=7535109&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D1%7C%7Cps%3D0.876%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=288232850069983488&kwd[]=Cyber%20Security%20Certifications&kwt[]=439&kbc[]=1202993920&kwp[]=4&kid[]=68172844&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D1%7C%7Cps%3D0.876%7C%7Crpc%3D0.11%7C%7Clvl%3D1.00&ktd[]=288232850086760704&kwd[]=Cyber%20Crime%20Cases&kwt[]=439&kbc[]=1202993920&kwp[]=5&kid[]=68168811&kbc2[]=clust%3D1%7C%7Claw%20%26%20government%20%3E%20public%20safety%20%3E%20crime%20%26%20justice%7C%7Cdiff%3D1%7C%7Csetid%3D0%7C%7Cps%3D0.876%7C%7Crpc%3D0.01%7C%7Clvl%3D1.00&ktd[]=2473935048960&rand=1619522299367&cid=8CU5BD6EW&vwid=1619522295395818209&vi=1619522295395818209&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_sc=ZH&vgd_l1rakh=1619522295122968327&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_ifrmode=00&sttm=1619522296579&upk=1619522296.21735&hvsid=00001619522296579032874714596832&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=100&matm=1619522299372&vgd_ltime=2801&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l3_sc=ZH&vgd_l2ch=0&vgd_l1ch=1&vgd_katbid=-2&vgd_kals=base%7C%7Cpc%3D100&vgd_kasts=tstype%3D-10401%7C%7Cgbid%3D-2&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2887305233&vgd_nrrsf=nrr&vgd_nrrv=65342&vgd_nrrs=65342&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-184323154%7CDIV&vgd_x_pos=980&vgd_y_pos=413&vgd_ren_page_h=5986&vgd_cty=ZURICH&vgd_l1hcsd=A8%7C2774&vgd_sethcsd=A3%7C2773&vgd_cfud=200205&vgd_is_amp=0&vgd_icat=380&vgd_spcat=500986&vgd_optout=0&vgd_ect=4g&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_mbr=1&vgd_l1rpth=%2Fdmedianet.js&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&oRurl=http%3A%2F%2Fcdn3e%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DCH%26isOffice%3D0%26fvips%3D0%26vi%3D1619522295395818209%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D184323154%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26cb%3Dwindow._mNDetails.initAd%26gdpr%3D0%26pid%3D8PO5M70HK%26requrl%3Dhttps%253a%252f%252fsecurityaffairs.co%252fwordpress%252f117238%252fcyber-crime%252femotet-global-uninstall.html%253f_hsmi%253d88974744%2526_hsenc%253dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%2526utm_source%253drss%26%26katen%3D1%26katbid%3D-2&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:19 GMT
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 27 Apr 2021 11:18:19 GMT
log
navvy.media.net/ Frame C712
807 B
869 B
Ping
General
Full URL
https://navvy.media.net/log
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV65342.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.149.62 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.149.102.34.bc.googleusercontent.com
Software
Jetty(9.4.7.v20170914) /
Resource Hash
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
via
1.1 google
server
Jetty(9.4.7.v20170914)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache,no-store
alt-svc
clear
content-length
807
expires
Tue, 27 Apr 2021 11:18:19 GMT
settings
syndication.twitter.com/ Frame 3F0A
183 B
239 B
Fetch
General
Full URL
https://syndication.twitter.com/settings?session_id=3266b24efde8ef0b798107ec9e89ce4efbad4fab
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.63899b173766ee6f8a729a72b542b0fb.html?origin=https%3A%2F%2Fsecurityaffairs.co
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ced34f591157438ef47695f979ac95f8758408e8d9b88e63aee8b382ec975785
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
118
date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
last-modified
Tue, 27 Apr 2021 11:18:19 GMT
server
tsa_o
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
d6cdd53a3487fb52d2a774be0d26ec25
strict-transport-security
max-age=631138519
content-length
152
cenw.js
dt.clnmde.com/ Frame E7F8
36 B
360 B
XHR
General
Full URL
https://dt.clnmde.com/cenw.js
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
99b18d9efbee1415f204f8d1a7b87c1dd213beafe9adfc3bdf00b7938d447993

Request headers

Referer
https://pxlclnmdecom-a.akamaihd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
vary
Accept-Encoding
x-powered-by
Express
etag
W/"24-ofN+XjI9QnWlY2Id9ApQ7A"
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length
36
sid
mug.criteo.com/ Frame
0
0
Preflight
General
Full URL
https://mug.criteo.com/sid?cpp=oGi_jXxFNzB3SjZISy9DQkpvekJtYVhEMlc5cmFQREUwanVZd2tkNU15dmtLcno0cU0ydCtlc2hZSHU2NjBhRmp0UndDNlR0biszUHFseUlmQktwOHVrUTRSNUhPTnZVMEI4TlVBdmtseXhjT3hjWnZjYktuZExvSjNpd2RCWUFXdzNWeHlEbGNVa0xUbDdCdVkxa0VQUThLek0rMjdVTzZ5MVQ2MFhLUFBRbThZUUdYNUdLMGtQZ1Q3Z3NxZUNQK0ZXNWE2ekVlU1VsVzJ3NGkvOTVhWks4Y1p4R1FDd0tXVVZUYU05djJmRUdEcGI0PXw&cppv=2
Protocol
H2
Server
178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
null
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
content-type
application/json; charset=utf-8
expires
0
strict-transport-security
max-age=31536000
access-control-allow-origin
null
access-control-allow-headers
content-type
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
1261
date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
vary
Accept-Encoding
prebid
ib.adnxs.com/ut/v3/
19 B
720 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.50:80
AN-X-Request-Uuid
6fc9fc60-b2b2-4bac-8cb2-58b136b396d1
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
btlr.sharethrough.com/WYu2BXv1/
0
114 B
XHR
General
Full URL
https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.57.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:19 GMT
access-control-allow-credentials
true
vary
Origin
hb
ssc.33across.com/api/v1/
66 B
631 B
XHR
General
Full URL
https://ssc.33across.com/api/v1/hb?guid=azC7qard4r6OkMaKlId8sQ
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.78.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-78-134.compute-1.amazonaws.com
Software
/ 33Across
Resource Hash
1993569ff040835df84202bc0ac9a9b0162f0c6d7fd10cc6108f4d3202a3411f

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://securityaffairs.co
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/
0
61 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://securityaffairs.co
date
Tue, 27 Apr 2021 11:18:19 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
trinity.json
apex.go.sonobi.com/
1 KB
2 KB
XHR
General
Full URL
https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22481284b29c301c1%22%3A%22277a716b3c3b01668abf%7C320x50%7Cf%3D0.3%22%7D&ref=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&s=6305d5b2-dbf1-4828-937d-e472e4c284f2&pv=1cfeb150-ee21-452e-8047-1b4a96dc3ad1&vp=desktop&lib_name=prebid&lib_v=4.26.0&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22pubcid%22%3A%22ff2a363b-8c9e-48fb-a301-c88d5efb735a%22%2C%22tdid%22%3A%2209affd61-1009-4498-b9f0-e2daea690cf0%22%7D&kw=bye%2Cbye%2Cemotet%2Claw%2Cenforcement%2Cpushed%2Cuninstall%2Ccode%2Cvia%2Cbotnetsecurity%2Caffairs
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
516442279e5c3a73f7c76bd737a2041170ab522f7cac591dd5ce68cba05c3f9b
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Content-Encoding
gzip
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
https://securityaffairs.co
Cache-Control
no-cache, no-store, private
Access-Control-Allow-Credentials
true
Tcn
Choice
Content-Type
application/json
Content-Length
585
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
arj
pixfuture2-d.openx.net/w/1.0/
172 B
355 B
XHR
General
Full URL
https://pixfuture2-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=763cd3b5-f175-45a6-9de8-c25587fc7d26&nocache=1619522299784&pubcid=ff2a363b-8c9e-48fb-a301-c88d5efb735a&ttduuid=09affd61-1009-4498-b9f0-e2daea690cf0&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=320x50&divIds=24272x320x50x4142x_ADSLOT1&auid=540580841&tps=bXlrZXl3b3JkPWJ5ZSxieWUsZW1vdGV0LGxhdyxlbmZvcmNlbWVudCxwdXNoZWQsdW5pbnN0YWxsLGNvZGUsdmlhLGJvdG5ldHNlY3VyaXR5LGFmZmFpcnMmbXlvdGhlcmtleXdvcmQ9YnllLGJ5ZSxlbW90ZXQsbGF3LGVuZm9yY2VtZW50LHB1c2hlZCx1bmluc3RhbGwsY29kZSx2aWEsYm90bmV0c2VjdXJpdHksYWZmYWlycw%3D%3D
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
097ff5abf1b173df0136910cfdf6d91972114b236ee79bece66454ff1efe4be4

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
server
OXGW/16.205.4
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://securityaffairs.co
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
clear
content-length
163
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
ptmd
dt.clnmde.com/
70 B
330 B
Image
General
Full URL
https://dt.clnmde.com/ptmd?t=161952229724831650617761_N4Ig1ghiBcICxwExwOyIGYAYC0EVwmwEYiBTAI23IGYBORbAViwA5GXqWUtaQAacORhEBAYwBuMEMAA6IAM6l58gJYB7AHYB9eQBc1AJwgBzUnOhyEyNFlz5CJClToNmmNhy485AX34hjXXQYAG1MPnDIvgA2CIBdAUD5UKioxHiBPWToMIi88JFMBJBSUV0AWykiRjR-coBPUJCRamiUPhZaFrg2vmoUIhQEkPTW9s6WtDg+2nxh6j5aFgLEZb44IgXo6Oph6aWVtbQF2d3igHcAR1DihoMbsXLRIVgiFjhqRGpquH9RA3KAAdQiAiNEiLRGIhoZCduwULQkLQtOUICptER-GCIVCYYwiIh2KsWIhoii0dpEFjwZDoYhIXR2G9EJhkaj0VpqNScXTIURMCgapgBSxyRzfsUIAAbXQpfIZBRqGDTEAqSTQdIKXQQXQAV2yIVofWNCwWEOKAC8oNARCBAcYpJIBKQNOq7f5jAALKo03H0qYcMGMTDglAocH+XTZUFI5b4aKE9j+cTR6IAOkwabgmCpAmlMAWIHQohgxGduhUwl9vNiWod0HCCjAPp5MLJLMY30JAyIcF4zpUwNekLTyEQo82ado-ZKuuttt1lYbzvEUtCoA0EHKpCk5BUABN96QDFoD-59zrraA94fj6f9zANLqpVKBOIVPeW7S8XCuIj6SAPg+HwG5bjusA3keJ5ngIF7ajA14HlBn7QE+L5vh+Z6vNWeL8oKKDCigLCAcBoHbruSF3jBIBwVeICQVRD6oc+r4gO+KGgjh9L4oSJIsCS0QkSBICbuREGUdBD6wZeCH0RJKFoax7FYZxrbcYyLDMqyJHFPIUp6F+fqzCymD+FKwQ2hhHHYt+6mQppJLaWI+q6BxLAAMIAKqMAAQgAItEACiADqHoljaXHTppjaXOBtroEumA+EAA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:19 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame F380
91 KB
0
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32911
x-xss-protection
0
server
cafe
etag
1356821403584915245
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:19 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/
0
504 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Server
nginx/1.10.3 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:19 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame B0B5
91 KB
32 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
39474cc8e88ee91fb383bbe856d0b6c1a579ec557351fe3f2b48f31fc3be31b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32911
x-xss-protection
0
server
cafe
etag
1356821403584915245
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:19 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/
0
504 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Server
nginx/1.10.3 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:19 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 1401
91 KB
32 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
39474cc8e88ee91fb383bbe856d0b6c1a579ec557351fe3f2b48f31fc3be31b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32911
x-xss-protection
0
server
cafe
etag
1356821403584915245
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:19 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/
0
504 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:19 GMT
Server
nginx/1.10.3 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:19 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 6DCB
91 KB
32 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
39474cc8e88ee91fb383bbe856d0b6c1a579ec557351fe3f2b48f31fc3be31b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32911
x-xss-protection
0
server
cafe
etag
1356821403584915245
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:20 GMT
tracking.php
served-by.pixfuture.com/www/headerbid/library/tracking/
0
504 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/tracking.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:20 GMT
Server
nginx/1.10.3 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:20 GMT
bqi.php
lg3.media.net/
15 B
15 B
Image
General
Full URL
https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8PO5M70HK&kals=base%7C%7Cpc%3D100&katen=1&pc=100&kata=at2&katbid=-2&kasts=tstype%3D-10401%7C%7Cgbid%3D-2&cme=yNjTBIj9KU7YOwHzjxgy1BXKRbacS1nY08ndy65QHF4GWK8RtLoW015fWwVbGmVmOGRUF-jjxxZtMgW5dS1344Z68Kfq5tdyw6carWDknWM-3cJGilkViv6-i6vtVICDElM7T2ZNB0VG3rZN0Afp8ktjfEGvQQwukj9gtJphkQqZX5QlN8qkeRXb5NxawH52K543qqBldLNwCexYuK3EdQTA94oJIcEg||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|SiUyr_wmTz9zfKOAddGZtiUaH4Y1vaZV3wUuWKYkPsA3ufeLNj_aLRm5yVyREq8uoNccNdgKfWzK16Hpxmqs5m8yo5D3iqx62zDTSLFOsbouF3CDTgCrsknlaGbABHYcGMtINrVBsIBsPWTPTEgWaRRFZ7XC4BIu7o8THSuLsBzuoNN9_m38WSSFPr38yFSXPYTSd9Q6-8PHxcx81ZyRQsuaEIA_PDIqArexq6_xUpjkSSEbm3EOfUwIvZFREEC4w0qxjVhF8TdF2rS0O8q2_nFaHoxSD8iFY2SL7MFNTLw=|N7fu2vKt8_s=|cGQY_rxQcsqtzqlSGk7jDXhuGqqVyMbMm65ubnAHUJWlDjRASl6ADWqy6q4xR3bm4CAfyNq1i-Hs38N6fRv9f_UXtYlk6TqBS4IBjwTc9UILv3nRAeWwTumlCbn1Wrnap-5cvYFeFEtt1JLxeoAMcZfZAhCFyfjeW9OSIeajoftNC88EqVcpG3wxixLWpKPLvxbmIEJugc-gq38dAJRErEbAbw1S7bJM|&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&vi=1619522295395818209&ugd=4&cc=CH&sc=ZH&startTime=1619522296577&l2type=setting&vgd_l1rakh=1619522295122968327&l1ch=1&sttm=1619522296579&upk=1619522296.21735&hvsid=00001619522296579032874714596832&verid=3121199&vgd_sc=ZH&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0&l1hcsd=l1!A8|2774&vgd_uspa=0&vgd_isiolc=1&npgv=1&clp=%7B%7D&cl=%7B%7D&l2ch=0&l2wsip=2887305233&sethcsd=set!A3%7C2773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:20 GMT
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 27 Apr 2021 11:18:20 GMT
bqi.php
lg3.media.net/
15 B
15 B
Image
General
Full URL
https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8PO5M70HK&kals=base%7C%7Cpc%3D100&katen=1&pc=100&kata=at2&katbid=-2&kasts=tstype%3D-10401%7C%7Cgbid%3D-2&cme=Aooh5nRzPxUMuX-gAJ0DYbGext3mOz_CN_7nhsbdcwSKRhh0xd3zhyxaRmJWHuqTGPOsBM4mIqtF6KwqJ12XEBKvQZPRabmMz6gpcHw-OdhyimWUpQ5RE9ACPRlGrwUTfN6vRKD-wJ18YPpjH8XSlPJwgPfKSrGgB9db7pEgc6XtG7wJwa6Xt9p1T1C3W1KPt-3HZuDGww282JX7ZCE_BM1-H_DA_iyo7_B8_QjdUVY=||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|SiUyr_wmTz9zfKOAddGZtiUaH4Y1vaZV3wUuWKYkPsA3ufeLNj_aLRm5yVyREq8uoNccNdgKfWzK16Hpxmqs5m8yo5D3iqx62zDTSLFOsbouF3CDTgCrsknlaGbABHYcGMtINrVBsIBsPWTPTEgWaRRFZ7XC4BIu7o8THSuLsBzuoNN9_m38WSSFPr38yFSXPYTSd9Q6-8PHxcx81ZyRQsuaEIA_PDIqArexq6_xUpjkSSEbm3EOfUwIvZFREEC4w0qxjVhF8TdF2rS0O8q2_nFaHoxSD8iFY2SL7MFNTLw=|N7fu2vKt8_s=|Z3ikG3St0YoxRyG7wEfCAD0fFQGcMq0kwEvAbpYGn0GSdPiW5VvlU8gaJ6cAMvAqP3bzgy01_xCnY4rjDp6bur4NXx6Jzdm0NCmhKFFKFN3b9KQap5_fkw_Hh-GUcAXT97Een1wmpU9vO02IKBL4nlYS4jVVoXQTOMh0QnCnw1S8RLnOxvqmIUTkH87n7Jt2E_BXxENpnYc6UDLn_cjqZ0_OuRoGNxdJ|&gdpr=0&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&requrl=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3F_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&vi=1619522295107570078&ugd=4&cc=CH&sc=ZH&startTime=1619522296614&l2type=setting&vgd_l1rakh=1619522295122968327&l1ch=1&sttm=1619522296624&upk=1619522296.21735&hvsid=00001619522296624032874714599724&verid=3121199&vgd_sc=ZH&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D0%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D0&l1hcsd=l1!A8|2774&vgd_uspa=0&vgd_isiolc=1&npgv=1&clp=%7B%7D&cl=%7B%7D&l2ch=0&l2wsip=2886935528&sethcsd=set!A3%7C2773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=21600

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=21600
Server
Apache
Date
Tue, 27 Apr 2021 11:18:20 GMT
ntCoent-Length
15
Vary
Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
15
Expires
Tue, 27 Apr 2021 11:18:20 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/ Frame B0B5
223 KB
83 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4d3858fd6875118f687ea5fd972b3e88f1cbec0b84539bfe33585b6ea282af27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
84531
x-xss-protection
0
server
cafe
etag
18044138429448666955
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:20 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210422/r20190131/ Frame B373
10 KB
5 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210422/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210422/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Mon, 26 Apr 2021 19:22:05 GMT
expires
Mon, 10 May 2021 19:22:05 GMT
content-type
text/html; charset=UTF-8
etag
10446291943670460780
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4644
x-xss-protection
0
age
57375
cache-control
public, max-age=1209600
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/ Frame 1401
223 KB
83 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4d3858fd6875118f687ea5fd972b3e88f1cbec0b84539bfe33585b6ea282af27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
84531
x-xss-protection
0
server
cafe
etag
18044138429448666955
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:20 GMT
horizon_tweet.9a1486c56ce45426b4b402a38772a4d2.js
platform.twitter.com/js/
7 KB
3 KB
Script
General
Full URL
https://platform.twitter.com/js/horizon_tweet.9a1486c56ce45426b4b402a38772a4d2.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67F3) /
Resource Hash
d18c6d6e59f6af6b08174e8d3d0ed661b985715fe3949c4170a0af1546995b79

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:20 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:44:20 GMT
Server
ECS (frb/67F3)
Age
991575
Etag
"c1cb24c0b21170a6db999d2be82f0bbc+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2443
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/ Frame 6DCB
223 KB
83 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4d3858fd6875118f687ea5fd972b3e88f1cbec0b84539bfe33585b6ea282af27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
84531
x-xss-protection
0
server
cafe
etag
18044138429448666955
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 27 Apr 2021 11:18:20 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame B0B5
208 B
322 B
Script
General
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
5bdc333309db55d266aa2ae9a439d940399e1d843c91f6155b87a3b8095120a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
198
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame B0B5
107 B
799 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame B0B5
107 B
553 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
afr.php
served-by.pixfuture.com/www/delivery/ Frame 7FF8
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1480696128&pi=t.ma~as.1680648786&w=300&lmt=1619522300&url=http...
  • https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5529
617 B
1 KB
Document
General
Full URL
https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5529
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
76d35c700a1d819d2ab5bdeeaa17c7e4a2291f5ca1bdfafa6398e8bd49ad943a

Request headers

Host
served-by.pixfuture.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Server
nginx/1.10.3 (Ubuntu)
Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Cache-Control
max-age=172800 public, no-transform
Pragma
no-cache
Expires
Thu, 29 Apr 2021 11:18:21 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Encoding
gzip

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
location
https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5529
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 27 Apr 2021 11:18:21 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 27-Apr-2021 11:33:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/ Frame B0B5
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5c96c91c4ab2c0572ec8371c0f49d9f722eb71ae47224f29eabadf59f5fabe8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1619188783439141"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28201
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:20 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame 1401
208 B
266 B
Script
General
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
a65012694be912cc64f8dd5931d6c5e2170b5becaa24e4145153b67267395c9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
197
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 1401
107 B
122 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 1401
107 B
122 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 97A8
84 KB
30 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
88f04831d85910e359a49cfe0d2edcf51289dc52273ca75c5374eecd7c601248
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLD6vNumnvACFfzhuwgd4ZALmQ&gqi=_PKHYOXbJZns3wOvj4CgDg&layout=/sadbundle/%24csp%253Der3%24/2423676608385193032/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLD6vNumnvACFfzhuwgd4ZALmQ&gqi=_PKHYOXbJZns3wOvj4CgDg&layout=/sadbundle/%24csp%253Der3%24/2423676608385193032/index.html
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 27 Apr 2021 11:18:21 GMT
server
cafe
content-length
30509
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 27-Apr-2021 11:33:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/ Frame 1401
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5c96c91c4ab2c0572ec8371c0f49d9f722eb71ae47224f29eabadf59f5fabe8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1619188783439141"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28201
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:20 GMT
cookie.js
partner.googleadservices.com/gampad/ Frame 6DCB
208 B
217 B
Script
General
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
1f2061d1369363691d5fd23795c4d91c6f88edddda1e6beec14cf824a4f45345
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
195
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 6DCB
107 B
122 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 6DCB
107 B
122 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
afr.php
served-by.pixfuture.com/www/delivery/ Frame D400
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1480696190&pi=t.ma~as.1139220782&w=320&lmt=1619522300&url=https...
  • https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
615 B
1 KB
Document
General
Full URL
https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
064cb9385a8624022be834ed02c72dbd81a40d6d23c4869a31e962b71e9ff05b

Request headers

Host
served-by.pixfuture.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Server
nginx/1.10.3 (Ubuntu)
Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Cache-Control
max-age=172800 public, no-transform
Pragma
no-cache
Expires
Thu, 29 Apr 2021 11:18:21 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Access-Control-Allow-Methods
GET, POST, OPTIONS
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Encoding
gzip

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
location
https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Tue, 27 Apr 2021 11:18:20 GMT
server
cafe
content-length
46
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Tue, 27-Apr-2021 11:33:20 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 6DCB
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a5c96c91c4ab2c0572ec8371c0f49d9f722eb71ae47224f29eabadf59f5fabe8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1619188783439141"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28201
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:20 GMT
Tweet.html
platform.twitter.com/embed/ Frame 12B1
487 B
971 B
Document
General
Full URL
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6725) /
Resource Hash
f76b46135fa81747d8b937a43278410e8d9e322e78190b1cd17cf838d9766dec

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
696
Cache-Control
public, max-age=1800
Content-Type
text/html; charset=utf-8
Date
Tue, 27 Apr 2021 11:18:20 GMT
Etag
"1f717826186d7d667fa54f112bd59463"
Last-Modified
Tue, 13 Apr 2021 22:45:14 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/6725)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
487
showad.js
ads.pubmatic.com/AdServer/js/ Frame 589C
38 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 14 Apr 2021 09:18:30 GMT
ETag
"13006b6-98c2-5bfeb3aef82b4"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
14060
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=130632
Expires
Wed, 28 Apr 2021 23:35:33 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame AA02
52 KB
17 KB
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Wed, 28 Apr 2021 11:18:23 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
showad.js
ads.pubmatic.com/AdServer/js/ Frame AA88
38 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 14 Apr 2021 09:18:30 GMT
ETag
"13006b6-98c2-5bfeb3aef82b4"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
14060
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=130632
Expires
Wed, 28 Apr 2021 23:35:33 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
Vary
Accept-Encoding
/
ssc-cms.33across.com/ps/ Frame E1AD
0
0
Document
General
Full URL
https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=azC7qard4r6OkMaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.110.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip23.67-202-110.static.steadfastdns.net
Software
33XP004 /
Resource Hash

Request headers

:method
GET
:authority
ssc-cms.33across.com
:scheme
https
:path
/ps/?m=xch&rt=html&ru=deb&id=azC7qard4r6OkMaKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

x-33x-status
2020008
server
33XP004
date
Tue, 27 Apr 2021 11:18:20 GMT
pd
eu-u.openx.net/w/1.0/ Frame F485
668 B
729 B
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
e18842300c8239d22719f8161d7ad518fa927d037998280965b2c248dcff7998

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=ff2a363b-8c9e-48fb-a301-c88d5efb735a|1619522299
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=ff2a363b-8c9e-48fb-a301-c88d5efb735a|1619522299; Version=1; Expires=Wed, 27-Apr-2022 11:18:21 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1619522301|gekin0vNiygu; Version=1; Expires=Wed, 12-May-2021 11:18:21 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.205.4
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 27 Apr 2021 11:18:21 GMT
content-type
text/html
content-length
418
content-encoding
gzip
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/dmp/ Frame F20B
52 KB
17 KB
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Wed, 28 Apr 2021 11:18:23 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
showad.js
ads.pubmatic.com/AdServer/js/ Frame 920F
38 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 14 Apr 2021 09:18:30 GMT
ETag
"13006b6-98c2-5bfeb3aef82b4"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
14060
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=130632
Expires
Wed, 28 Apr 2021 23:35:33 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 5441
52 KB
17 KB
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Wed, 28 Apr 2021 11:18:23 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
pd
eu-u.openx.net/w/1.0/ Frame 83D8
668 B
717 B
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
e18842300c8239d22719f8161d7ad518fa927d037998280965b2c248dcff7998

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=ff2a363b-8c9e-48fb-a301-c88d5efb735a|1619522299
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=ff2a363b-8c9e-48fb-a301-c88d5efb735a|1619522299; Version=1; Expires=Wed, 27-Apr-2022 11:18:21 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1619522301|gekin0vNiygu; Version=1; Expires=Wed, 12-May-2021 11:18:21 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.205.4
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 27 Apr 2021 11:18:21 GMT
content-type
text/html
content-length
418
content-encoding
gzip
via
1.1 google
alt-svc
clear
pd
eu-u.openx.net/w/1.0/ Frame 3F24
668 B
717 B
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
e18842300c8239d22719f8161d7ad518fa927d037998280965b2c248dcff7998

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
i=ff2a363b-8c9e-48fb-a301-c88d5efb735a|1619522299
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=ff2a363b-8c9e-48fb-a301-c88d5efb735a|1619522299; Version=1; Expires=Wed, 27-Apr-2022 11:18:21 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1619522301|gekin0vNiygu; Version=1; Expires=Wed, 12-May-2021 11:18:21 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.205.4
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 27 Apr 2021 11:18:21 GMT
content-type
text/html
content-length
418
content-encoding
gzip
via
1.1 google
alt-svc
clear
async_usersync.html
acdn.adnxs.com/dmp/ Frame 77D0
52 KB
17 KB
Document
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-232-130.deploy.static.akamaitechnologies.com
Software
nginx/1.13.10 /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host
acdn.adnxs.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 02 Dec 2020 20:56:47 GMT
ETag
"5fc7ff8f-cf34"
Server
nginx/1.13.10
Access-Control-Allow-Origin
*
Content-Type
text/html
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
17053
Cache-Control
max-age=86402
Expires
Wed, 28 Apr 2021 11:18:23 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
pd
eu-u.openx.net/w/1.0/ Frame 67A5
Redirect Chain
  • https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
  • https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
498 B
629 B
Document
General
Full URL
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
ddc78e9e2feea12596546c5e257470607ea6f7f237a87578e160e11dc237e41a

Request headers

:method
GET
:authority
eu-u.openx.net
:scheme
https
:path
/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
pd=v2|1619522301|gekin0vNiygu; i=d1f47eed-960a-0c54-3475-46e9db703f15|1619522301
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

vary
Accept, Accept-Encoding
set-cookie
i=d1f47eed-960a-0c54-3475-46e9db703f15|1619522301; Version=1; Expires=Wed, 27-Apr-2022 11:18:21 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1619522301|mWkigqiysLommOgevNgunsn0; Version=1; Expires=Wed, 12-May-2021 11:18:21 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.205.4
p3p
CP="CUR ADM OUR NOR STA NID"
date
Tue, 27 Apr 2021 11:18:21 GMT
content-type
text/html
content-length
317
content-encoding
gzip
via
1.1 google
alt-svc
clear

Redirect headers

set-cookie
i=d1f47eed-960a-0c54-3475-46e9db703f15|1619522301; Version=1; Expires=Wed, 27-Apr-2022 11:18:21 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server
OXGW/16.205.4
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
date
Tue, 27 Apr 2021 11:18:21 GMT
content-length
0
via
1.1 google
alt-svc
clear
showad.js
ads.pubmatic.com/AdServer/js/ Frame 9F84
38 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/pbix.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://securityaffairs.co/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

Last-Modified
Wed, 14 Apr 2021 09:18:30 GMT
ETag
"13006b6-98c2-5bfeb3aef82b4"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
14060
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=130632
Expires
Wed, 28 Apr 2021 23:35:33 GMT
Date
Tue, 27 Apr 2021 11:18:21 GMT
Connection
keep-alive
Vary
Accept-Encoding
us.gif
sync.go.sonobi.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sonobi&ttd_tpi=1&ttd_puid=0b24fdfc82&gdpr=0&gdpr_consent=
  • https://sync.go.sonobi.com/us.gif?nw=td&nuid=09affd61-1009-4498-b9f0-e2daea690cf0&pubid=0b24fdfc82
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=td&nuid=09affd61-1009-4498-b9f0-e2daea690cf0&pubid=0b24fdfc82
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.go.sonobi.com/us.gif?nw=td&nuid=09affd61-1009-4498-b9f0-e2daea690cf0&pubid=0b24fdfc82
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
227
us.gif
sync.go.sonobi.com/
Redirect Chain
  • https://p.rfihub.com/cm?pub=35683&in=1
  • https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878969570699774
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878969570699774
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://sync.go.sonobi.com/us.gif?nw=zt&nuid=1871878969570699774
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
us.gif
sync.go.sonobi.com/
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?do=add&pid=560606&ev=e9609499-bb32-4796-9b0e-7fee38eba6c3&daaqp=1&rurl=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dpp%26nuid%3D%25%25VGUID%25%25
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=d2dEcEFWd1BCcXQ3Wm1oTC1BSzdTdw&gdpr=&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=&gdpr_consent=&ev=CAESEIevSDvszZkRjKep12dPQdE&google_cver=1
  • https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Uhjz15oBUlXD
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Uhjz15oBUlXD
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-US
location
https://sync.go.sonobi.com/us.gif?nw=pp&nuid=Uhjz15oBUlXD
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-7c488d4f5b-kx42z
expires
-1
us.gif
sync.go.sonobi.com/
Redirect Chain
  • https://sync.mathtag.com/sync/img?cs_wd_sy=1&dp=43&redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dmediamath%26nuid%3D[MM_UUID]
  • https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=01306087-f2fc-4400-a3a4-d1b195914b19
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=01306087-f2fc-4400-a3a4-d1b195914b19
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 27 Apr 2021 11:18:24 GMT
Server
MT3 3660 495c301 master zrh-pixel-x30
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://sync.go.sonobi.com/us.gif?nw=mediamath&nuid=01306087-f2fc-4400-a3a4-d1b195914b19
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 27 Apr 2021 11:18:23 GMT
usg.gif
sync.go.sonobi.com/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_cm&google_hm=ZTk2MDk0OTktYmIzMi00Nzk2LTliMGUtN2ZlZTM4ZWJhNmMz
  • https://sync.go.sonobi.com/usg.gif?google_gid=CAESEO_Y83TQ6gAU4obWxuHakrA&google_cver=1
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/usg.gif?google_gid=CAESEO_Y83TQ6gAU4obWxuHakrA&google_cver=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://sync.go.sonobi.com/usg.gif?google_gid=CAESEO_Y83TQ6gAU4obWxuHakrA&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
288
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
sync.targeting.unrulymedia.com/csync/
Redirect Chain
  • https://sync.1rx.io/usersync2/sonobi&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=212963970
  • https://sync.1rx.io/usersync/tradedesk/09affd61-1009-4498-b9f0-e2daea690cf0
  • https://sync.targeting.unrulymedia.com/csync/RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
43 B
395 B
Image
General
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.44 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software
Tengine /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
server
Tengine
content-length
43
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location
https://sync.targeting.unrulymedia.com/csync/RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
cache-control
no-store, no-cache, must-revalidate
server
Tengine
content-type
text/html
expires
0
us.gif
sync.go.sonobi.com/
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=sonobi
  • https://x.bidswitch.net/ul_cb/sync?ssp=sonobi
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=sonobi&bsw_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1&google_hm=ZmFkYjVlYTEtOGI5Ny00YTM0LWEzODgtYTE2OGJjMTdkMmUx
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESED0LTejXMr5lUWJOEbjzsis&google_cver=1&ssp=sonobi&bsw_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
  • https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
49 B
513 B
Image
General
Full URL
https://sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
//sync.go.sonobi.com/us.gif?nw=bidswitch&nuid=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
vtr.php
served-by.pixfuture.com/www/headerbid/library/tracking/
0
504 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/vtr.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
nginx/1.10.3 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:21 GMT
vtr.php
served-by.pixfuture.com/www/headerbid/library/tracking/
0
504 B
XHR
General
Full URL
https://served-by.pixfuture.com/www/headerbid/library/tracking/vtr.php
Requested by
Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/hb_v2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
Server
nginx/1.10.3 (Ubuntu)
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=172800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires
Thu, 29 Apr 2021 11:18:21 GMT
embed.runtime.ec8286a6a4887df701ad.js
platform.twitter.com/embed/ Frame 12B1
8 KB
4 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674B) /
Resource Hash
6eecd264fecac0f3baa1c6514ba5c2b44557158f352515de6e803656ed979948

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/674B)
Age
991576
Etag
"d0f950617c832801769c1a1d900ee8c4+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
3349
embed.modules.5e1e58de5d2ab2585a55.js
platform.twitter.com/embed/ Frame 12B1
899 KB
283 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.modules.5e1e58de5d2ab2585a55.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668D) /
Resource Hash
144bf8fa1ed44cf8536d60c5ff4a34d5482161a976b3b100663b6a165f27beec

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/668D)
Age
976272
Etag
"75c0956acff8ca9c225a5f679a47b3c9+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
288930
embed.i18n.f23123f5b7a17d3dda19.js
platform.twitter.com/embed/ Frame 12B1
145 B
650 B
Script
General
Full URL
https://platform.twitter.com/embed/embed.i18n.f23123f5b7a17d3dda19.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668A) /
Resource Hash
29e81df2e6a12f9a88533c12d164d616714579f8e1b9f059dba1e9f5c56a8ead

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:21 GMT
Access-Control-Allow-Methods
GET
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/668A)
Age
991576
Etag
"e88050c3ed3ac1ac3ce267320efc5b61"
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
Content-Length
145
embed.Tweet.5f40fc76d9343cf40dc4.js
platform.twitter.com/embed/ Frame 12B1
15 KB
6 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.Tweet.5f40fc76d9343cf40dc4.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668A) /
Resource Hash
b26d782d43592764b4638a4b605300848539a14adb2495340f5ac12c0e6aee51

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/668A)
Age
991576
Etag
"5f7961988151bd1b93987c4ac7cf30f0+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
5589
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/ Frame 84BD
27 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bc1e0462ef5111f5dffc2c78abc3f4fd40ee735b7595d4dd212337d26f0007b7
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sadbundle/$csp%3Der3$/2423676608385193032/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-type
text/html
access-control-allow-origin
*
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
date
Thu, 22 Apr 2021 15:49:16 GMT
expires
Fri, 22 Apr 2022 15:49:16 GMT
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
content-encoding
gzip
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
content-length
4058
age
415745
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/ Frame 97A8
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e9f3358441fb5f83ee3575f81df787bbade8b416b009cbdcbd3b71c8b6f560e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:16:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
95
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7028
x-xss-protection
0
server
cafe
etag
3134275839577271762
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 11 May 2021 11:16:46 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/ Frame 97A8
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:17:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1303
x-xss-protection
0
server
cafe
etag
14729628269804859526
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 11 May 2021 11:17:48 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 97A8
116 KB
35 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d76c09ea49a67623c581149d87ec821d813b9302aea4f871df16156cd1d28a53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1619188777539687"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36031
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:21 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/ Frame 97A8
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210422/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
439ab67fa3c312bb442bed574ea79be834dbd92f3bd7d2288b6f3fce4d0afb0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
7
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5604
x-xss-protection
0
server
cafe
etag
2846967340006788112
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 11 May 2021 11:18:14 GMT
sd
eu-u.openx.net/w/1.0/ Frame F485
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
43 B
122 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 27 Apr 2021 11:18:24 GMT
Server
MT3 3660 495c301 master zrh-pixel-x26
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 27 Apr 2021 11:18:23 GMT
sd
us-u.openx.net/w/1.0/ Frame F485
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame F485
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5510645463395423367
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5510645463395423367
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=5510645463395423367
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame F485
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=2c860962-2519-770c-f9d7-00653adc40a7&gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.173.5 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-51-173-5.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame F485
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDBlOWRhYTgtZWM2ZS0yOWE4LWVjMzctNWFkY2YwM2U4ZWM3
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame F485
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 83D8
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 27 Apr 2021 11:18:24 GMT
Server
MT3 3660 495c301 master zrh-pixel-x10
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 27 Apr 2021 11:18:23 GMT
sd
us-u.openx.net/w/1.0/ Frame 83D8
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 83D8
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=626901678625525145
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=626901678625525145
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=626901678625525145
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 83D8
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=2c860962-2519-770c-f9d7-00653adc40a7&gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.173.5 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-51-173-5.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 83D8
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDBlOWRhYTgtZWM2ZS0yOWE4LWVjMzctNWFkY2YwM2U4ZWM3
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 83D8
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 3F24
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 27 Apr 2021 11:18:24 GMT
Server
MT3 3660 495c301 master zrh-pixel-x30
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=01306087-f2fc-4400-a3a4-d1b195914b19
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 27 Apr 2021 11:18:23 GMT
sd
us-u.openx.net/w/1.0/ Frame 3F24
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=5SmZ2bUrx4r-IZXb5yyM37Ypx9z-f8KIsigby50R
pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 3F24
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7395524573033724106
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7395524573033724106
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=7395524573033724106
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 3F24
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=2c860962-2519-770c-f9d7-00653adc40a7&gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.51.173.5 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-51-173-5.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 3F24
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDBlOWRhYTgtZWM2ZS0yOWE4LWVjMzctNWFkY2YwM2U4ZWM3
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 3F24
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEP0zuzBGJDRy-4U7XtxOA74&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ptmd
dt.clnmde.com/
70 B
330 B
Image
General
Full URL
https://dt.clnmde.com/ptmd?t=161952229724831650617761_N4IgpgHiBcIAwgDQgM4GMD2MQEYBsOAnAKwBM5heA+qXMQMw6nEDsOOALIUqpgGYwcydBgAu2fETIVqtBk1bsuVABwAjWipZqccUmkJh6YYnz5gAJjjScWKy+rs8RogdCG8xFiQRLlSlDR0jMxsnIQ0AIY4LHxqcER8kSoqcPR8aGgseJEc9CxoePbk9MTOmKIWbh5gANaR2BzEHCp8xGhwALSRLByRnexgap0a9BYjaiwFGWCR+jg8dWqCyGgAbijYwAA6qGAoKACWGAB2VCiiGABOkQDmYLvQu00tbR3dvf2Dw6PjapPTNCzea7RC7TAYWqHMBUCyRUSRR7PZqtdpdHp9AY4IYjUhjCZTNAzOY2XYAXx4hzWMA4yFmABsYABtAC6dMiAAdmbgSAA6UgcUj8nD0XmEbhs1AI0QAV020CZeMQRGVKklAC8Gu5kBzbthqXSTtTYFzkLcABY+KT+QgsAUqRh4YhwAhTAg8UTy3CCwipXp4ZjEFQ8DbYPC8uC8jh6HiRRnQejIDIwAZ00SHQS+aQBPDCUR66BwYS1K1+GRBeShJTcOmHLmwKT8wXC0XixYyrUeGUZwt0tbxpmgE6RAC2YGwakOFgsYCuVCnPDhCJgoEn09n8+80BOMvp9OQa0Om9L2ZIeFKWkIPpAZLJiCHo-HsDXM7nC+QS61q6nr+P293+4gIef64FmNrELoLCsHAcBOLe94gMOY4Tj+G7viAn4riAL5oVuO57geR4Lg2YEUBBzAqKQKSkHgN53g+yHPqhb7eB+8JfthzF-vhgHAcRoHWmR9AkCoOCUXA3C3pKKD0hcJ42naME8PS1SESBkhlgEDAiWJtA1iAaByqIIEqAAwgAqsQABCAAieAAKIAOo8LcaCZoJ9AJMQeAsMgACOT4eHwPZwGSQA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:21 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
embed.vendors~ondemand.horizon-web.en-js.61cdf1774587c1f95e99.js
platform.twitter.com/embed/ Frame 12B1
20 KB
7 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.horizon-web.en-js.61cdf1774587c1f95e99.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6731) /
Resource Hash
d27910197214323c01182b91f3674aafd20260f85ab8ef54b6358be6e453ca8e

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/6731)
Age
991576
Etag
"e6d6ea6fcbde58bba05b838806bfda83+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
6780
embed.ondemand.i18n.en-js.80e9a53ba16ffec58718.js
platform.twitter.com/embed/ Frame 12B1
4 KB
2 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.80e9a53ba16ffec58718.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67A7) /
Resource Hash
ba5d4ad2291eb8531da85d9f1f58db9e7e78bae8515efb10c52ad65cc3deaec6

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:21 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/67A7)
Age
991576
Etag
"f534e52205cb13fc9f6142e55e126a87+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
1760
bounce
ib.adnxs.com/ Frame AA02
Redirect Chain
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
0
823 B
Script
General
Full URL
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.241:80
AN-X-Request-Uuid
5da59840-0f1c-46e0-8bf1-f0d78f745b4f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.86:80
AN-X-Request-Uuid
baaf21a8-4d96-4617-984b-f6393a41edc6
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 67A5
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 27 Apr 2021 11:18:20 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
dds
rtb.openx.net/sync/ Frame 67A5
Redirect Chain
  • https://rtb.openx.net/sync/dds
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=3Q7LiJYLio2I18K2bE42Ug==&ox_sc=1&ox_init=1
  • https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
43 B
146 B
Image
General
Full URL
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
clear
content-length
43
x-request-id
3p6c4j3jcjhpd72bdsrj2lck12ip262s

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
249
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
969f27f0-af21-a1ea-5f74-98f44000c1a1
pr-bh.ybp.yahoo.com/sync/openx/ Frame 67A5
43 B
837 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/969f27f0-af21-a1ea-5f74-98f44000c1a1?gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:21 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 67A5
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=oM1GKaMO1LBlJv5
  • https://eu-u.openx.net/w/1.0/sd?cc=1&id=537072979&val=oM1GKaMO1LBlJv5
43 B
106 B
Image
General
Full URL
https://eu-u.openx.net/w/1.0/sd?cc=1&id=537072979&val=oM1GKaMO1LBlJv5
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://eu-u.openx.net/w/1.0/sd?cc=1&id=537072979&val=oM1GKaMO1LBlJv5
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 google
server
OXGW/16.205.4
alt-svc
clear
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
sd
us-u.openx.net/w/1.0/ Frame 67A5
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=openx
  • https://cm.smadex.com/sync?sm_did=bds&bds_ssp_id=openx&bds_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
  • https://x.bidswitch.net/sync?dsp_id=340&user_id=c5ee4a25-a01b-49f4-b5f8-05e38e119429&expires=10&ssp=openx&bsw_param=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072968&val=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
//us-u.openx.net/w/1.0/sd?id=537072968&val=fadb5ea1-8b97-4a34-a388-a168bc17d2e1
date
Tue, 27 Apr 2021 11:18:22 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
sd
us-u.openx.net/w/1.0/ Frame 67A5
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ox
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCR2FrN0JELVlBQUNtdTRiX1hydw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCR2FrN0JELVlBQUNtdTRiX1hydw&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABGak7BD-YAACmu4b_Xrw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_curre...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pp%2Cox&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=1784839922786100870
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABGak7BD-YAACmu4b_Xrw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fuserid%3D1784839922786100870%26bee_sync_partners%3Dox%26bee_sync...
  • https://match.prod.bidr.io/cookie-sync?userid=1784839922786100870&bee_sync_partners=ox&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AABGak7BD-YAACmu4b_Xrw&pid=558502&d...
  • https://us-u.openx.net/w/1.0/sd?id=537125688&val=AABGak7BD-YAACmu4b_Xrw
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537125688&val=AABGak7BD-YAACmu4b_Xrw
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:27 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537125688&val=AABGak7BD-YAACmu4b_Xrw
Date
Tue, 27 Apr 2021 11:18:27 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
bounce
ib.adnxs.com/ Frame F20B
Redirect Chain
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
0
824 B
Script
General
Full URL
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.247:80
AN-X-Request-Uuid
bcc974c1-1bd6-4ed2-8f42-3c5d46746c4d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:21 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.45:80
AN-X-Request-Uuid
42d249d4-e1db-459a-a627-f2751d7497ff
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bounce
ib.adnxs.com/ Frame 5441
Redirect Chain
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
0
823 B
Script
General
Full URL
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.86:80
AN-X-Request-Uuid
8a7d5f6b-6736-4c43-8c6d-8722e486d515
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.147:80
AN-X-Request-Uuid
c55b7ecf-7e1d-4f60-866d-277bb02f4c59
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bounce
ib.adnxs.com/ Frame 77D0
Redirect Chain
  • https://ib.adnxs.com/async_usersync?cbfn=queuePixels
  • https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
0
823 B
Script
General
Full URL
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.86:80
AN-X-Request-Uuid
685248ad-94b1-4585-a9b2-18dca4f9e751
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.245:80
AN-X-Request-Uuid
46bdcf8f-a8e9-4020-8495-b977de9c5060
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame AA88
8 KB
9 KB
Script
General
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
675b45306cade1b57845cf6cab7e45f6c186949815f7eb7cb3078dff766513e9

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:20 GMT
P3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
320x50.png
cdn.pixfuture.com/banners/ Frame D400
20 KB
21 KB
Image
General
Full URL
https://cdn.pixfuture.com/banners/320x50.png
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5531
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f83d6d161d5d98ac0a6305e882cbf211c330178f30bac4095f967b5475c0e92

Request headers

Referer
https://served-by.pixfuture.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:21 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
54426
content-length
20836
cf-request-id
09b4a6481300004e1f7b215000000001
last-modified
Tue, 02 Feb 2021 21:40:24 GMT
server
cloudflare
etag
"6019c6c8-5164"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DYtD5%2Bp37xw4cwMsDIiiib64JJpHr15ciAEK%2F7i0wNBcbbhJNrYnt5Jn53sKFPvUPCntyD1q%2Bo31aMArEo8UQMGN%2F83wyqKDznq5PdyEV9dF7eu15xQfmHPbR5pG5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=2678400, no-transform
accept-ranges
bytes
cf-ray
6467a65359174e1f-FRA
expires
Wed, 28 Apr 2021 20:11:07 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 1FDF
143 B
226 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUl_6yoV1eeg_E7iIdBWomvYo9UPXGC_DZo9qvFqMlM-WkyIs0hMzHH0a_2etFw
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Tue, 27 Apr 2021 10:56:55 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
1287
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 97A8
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78a2c9f2dce8aa318ebbcbea82b64c926f5415fc085cbf05226d783cf6919a92

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
300x250.png
cdn.pixfuture.com/banners/ Frame 7FF8
44 KB
45 KB
Image
General
Full URL
https://cdn.pixfuture.com/banners/300x250.png
Requested by
Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/delivery/afr.php?zoneid=5529
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4671 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6251b4b4525b9007511a48a6cda9a168f07ff77ccc4dd75759486af624a13301

Request headers

Referer
https://served-by.pixfuture.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
54433
content-length
45195
cf-request-id
09b4a6490d00004e1fba85e000000001
last-modified
Wed, 03 Feb 2021 20:39:58 GMT
server
cloudflare
etag
"601b0a1e-b08b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZJXYIl97psi%2F3gIJ70%2FRlwfDj72XJV1J6Gul0TtXkYxvGb6WnaAo8cbCVQV27SffMes%2B5nqgphh5TOXoAYiVjVQbBdnKLJGHiUsJLNhEvMZwCw8OMmMOVt8AvZk%2FLw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=2678400, no-transform
accept-ranges
bytes
cf-ray
6467a654ec244e1f-FRA
expires
Wed, 28 Apr 2021 20:11:07 GMT
embed.vendors~ondemand.TimelineList~ondemand.Tweet.f32716689b77a8ca288c.js
platform.twitter.com/embed/ Frame 12B1
1 MB
155 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.TimelineList~ondemand.Tweet.f32716689b77a8ca288c.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6713) /
Resource Hash
5cf118e6f30d488d438172ad5d9b103700dfef7681c1dc405674d21d295d3d37

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:22 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/6713)
Age
991577
Etag
"c2267538527090017864a47157d7e684+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
158067
embed.vendors~loader.UserAvatar~ondemand.Tweet.7abb172d79a1b5b37ef8.js
platform.twitter.com/embed/ Frame 12B1
25 KB
9 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.vendors~loader.UserAvatar~ondemand.Tweet.7abb172d79a1b5b37ef8.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6772) /
Resource Hash
ac0271c0baa09b72774a933539b0a0c6dc0497a2ccc9ff2f7a045b4ee0222316

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:22 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/6772)
Age
991577
Etag
"8f3c1c4901ad01cef053f8435a1cfba3+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
8237
embed.vendors~ondemand.Tweet.3521a48f2517aec4f13c.js
platform.twitter.com/embed/ Frame 12B1
366 KB
88 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.vendors~ondemand.Tweet.3521a48f2517aec4f13c.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6795) /
Resource Hash
815b535e0883ba9b247dc7f4c38b1c191ec799fa44b587d86126a5722405da36

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:22 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/6795)
Age
991577
Etag
"a3a2de92018dac5fc543e7ed9ed48415+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
89825
embed.ondemand.Tweet.1056e74a66175c01f38c.js
platform.twitter.com/embed/ Frame 12B1
57 KB
14 KB
Script
General
Full URL
https://platform.twitter.com/embed/embed.ondemand.Tweet.1056e74a66175c01f38c.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.ec8286a6a4887df701ad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
240c0dd6c0dc6775702a4c436f4e1db94c533e7e83ce346fd93bf26b7d2f56df

Request headers

Referer
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=securityaffairs&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdHdlZXRfZW1iZWRfOTU1NSI6eyJidWNrZXQiOiJodGUiLCJ2ZXJzaW9uIjpudWxsfX0%3D&frame=false&hideCard=false&hideThread=false&id=1386413655659479043&lang=en&origin=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html&sessionId=3266b24efde8ef0b798107ec9e89ce4efbad4fab&siteScreenName=securityaffairs&theme=light&widgetsVersion=ff2e7cf%3A1618526400629&width=500px
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:22 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Apr 2021 22:45:09 GMT
Server
ECS (frb/674D)
Age
991577
Etag
"10da95d5bf7da792a8e44a6fdb33a484+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
14140
sodar
pagead2.googlesyndication.com/getconfig/ Frame 6DCB
9 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210422&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
120e20231af224a0e57b733f1626d69d3d35a080eee8e341b202f4aa3fa33e7c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6917
x-xss-protection
0
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 84BD
9 KB
3 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 23:34:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42257
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3271
x-xss-protection
0
server
cafe
etag
7483759447172721109
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 27 Apr 2021 23:34:05 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 84BD
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4634b94630896f1a23c5ce01f743d720847c5f4dd28fb549ed503cb2df4f8e87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 26 Apr 2021 23:11:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
43641
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8867
x-xss-protection
0
server
cafe
etag
18043545750443934562
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Tue, 27 Apr 2021 23:11:01 GMT
e55f3741aa02d4affc3b3b3d0eb401d8.js
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/ Frame 84BD
73 KB
19 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/e55f3741aa02d4affc3b3b3d0eb401d8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8d4570b2b8803c64031c94f91a07cae12023846878b51161251d92553f63f6a7
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
age
15136
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18992
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Tue, 27 Apr 2021 07:06:06 GMT
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Apr 2022 07:06:06 GMT
usersync.aspx
dis.criteo.com/dis/ Frame CD5B
43 B
304 B
Document
General
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method
GET
:authority
dis.criteo.com
:scheme
https
:path
/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

cache-control
no-cache
pragma
no-cache
content-type
image/gif
expires
Tue, 27 Apr 2021 00:00:00 GMT
server
Microsoft-IIS/10.0
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
server-processing-duration-in-ticks
1176
date
Tue, 27 Apr 2021 11:18:21 GMT
content-length
43
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame 4A0B
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
42 B
769 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63; KRTBCOOKIE_1101=23040-6955795335128676493; PugT=1619522305; KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; KRTBCOOKIE_80=16514-CAESECa27be77Xm2sX0giKgy2xU&KRTB&22987-CAESECa27be77Xm2sX0giKgy2xU&KRTB&23025-CAESECa27be77Xm2sX0giKgy2xU; KRTBCOOKIE_153=1923-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&19420-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&22979-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0; KRTBCOOKIE_57=22776-3694532967942166496; KRTBCOOKIE_188=3189-d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348; KRTBCOOKIE_1074=22956-e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf; KRTBCOOKIE_22=14911-2461256698955117415; KRTBCOOKIE_218=22978-YIfzAQAAgcwJuAA4&KRTB&23194-YIfzAQAAgcwJuAA4&KRTB&23209-YIfzAQAAgcwJuAA4&KRTB&23244-YIfzAQAAgcwJuAA4; KRTBCOOKIE_466=16530-f5702e91-6ee1-4d71-b858-3d19dba24411
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:26 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_336=5844-4360478701595109786; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:26 GMT; path=/ PugT=1619522306; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:26 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:26 GMT; path=/
X-lat
lhrpug007:0:483
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame 2FFE
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795326539069581
42 B
771 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795326539069581
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KADUSERCOOKIE=09E9EDC2-DDCD-4F09-872C-2D08FBC13239; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620086400%3A15_223_67_2%7C1620691200%3A222_161_81_71_8_176_13_22_99_21_56_3_231_189_7_166_165_88_220_54_55_204_230%7C1622073600%3A203%7C1620345600%3A63%7C1620777600%3A35; PUBMDCID=3; KRTBCOOKIE_594=17105-RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003&KRTB&17107-RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003; KRTBCOOKIE_22=14911-2426560690372709837; KRTBCOOKIE_377=6810-09affd61-1009-4498-b9f0-e2daea690cf0&KRTB&22918-09affd61-1009-4498-b9f0-e2daea690cf0&KRTB&23031-09affd61-1009-4498-b9f0-e2daea690cf0; PugT=1619522303; KRTBCOOKIE_409=22966-6N9RXdmVdHbiGnZh9xOIWthm; KRTBCOOKIE_391=22924-7395524573033724106&KRTB&23263-7395524573033724106; KRTBCOOKIE_153=1923-WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT&KRTB&19420-WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT&KRTB&22979-WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT; KRTBCOOKIE_218=22978-YIfy-gAAgIhwiQAC&KRTB&23194-YIfy-gAAgIhwiQAC&KRTB&23209-YIfy-gAAgIhwiQAC&KRTB&23244-YIfy-gAAgIhwiQAC; KRTBCOOKIE_80=16514-CAESEKFzA5X7OrjpCNzKN0XUgSQ&KRTB&22987-CAESEKFzA5X7OrjpCNzKN0XUgSQ&KRTB&23025-CAESEKFzA5X7OrjpCNzKN0XUgSQ; KRTBCOOKIE_57=22776-3694532967942166496
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:23 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_1101=23040-6955795326539069581; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:23 GMT; path=/ PugT=1619522303; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:23 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:23 GMT; path=/
X-lat
lhrpug008:0:450
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:23 GMT
Transfer-Encoding
chunked
Connection
keep-alive
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Set-Cookie
UserID1=6955795326539069581; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795326539069581
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame 4E89
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDaWwwN0JELVlBQUNwV2luSFVzZw&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDaWwwN0JELVlBQUNwV2luSFVzZw&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AABGak7BD-YAACmu4b_Xrw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpm%26bee_sync_current_partner%3Dpp%2...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABGak7BD-YAACmu4b_Xrw&pid=558502&do=add
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABGak7BD-YAACmu4b_Xrw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpm%26bee_sync_current_part...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=1784839922786100870
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
42 B
773 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63; KRTBCOOKIE_1101=23040-6955795335128676493; KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; KRTBCOOKIE_80=16514-CAESECa27be77Xm2sX0giKgy2xU&KRTB&22987-CAESECa27be77Xm2sX0giKgy2xU&KRTB&23025-CAESECa27be77Xm2sX0giKgy2xU; KRTBCOOKIE_153=1923-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&19420-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&22979-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0; KRTBCOOKIE_57=22776-3694532967942166496; KRTBCOOKIE_188=3189-d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348; KRTBCOOKIE_1074=22956-e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf; KRTBCOOKIE_22=14911-2461256698955117415; KRTBCOOKIE_218=22978-YIfzAQAAgcwJuAA4&KRTB&23194-YIfzAQAAgcwJuAA4&KRTB&23209-YIfzAQAAgcwJuAA4&KRTB&23244-YIfzAQAAgcwJuAA4; KRTBCOOKIE_466=16530-f5702e91-6ee1-4d71-b858-3d19dba24411; KRTBCOOKIE_336=5844-4360478701595109786; KRTBCOOKIE_377=6810-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&22918-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&23031-95e471ea-00ee-471c-a54d-85bacf63223d; SPugT=1619522305; KRTBCOOKIE_594=17105-RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003&KRTB&17107-RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003; PugT=1619522307
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:27 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:27 GMT; path=/ PugT=1619522307; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:27 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:27 GMT; path=/
X-lat
lhrpug007:0:496
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

Date
Tue, 27 Apr 2021 11:18:27 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
0
Connection
keep-alive
bridge
cm.adgrx.com/ Frame 9388
43 B
408 B
Document
General
Full URL
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.251.232.170 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
ams-mon-1.sys.adgear.com
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host
cm.adgrx.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
server
Cowboy
X-RealServer-NX
ams-delivery-2
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Pragma
no-cache
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin
*
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame D35E
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1162584194
  • https://sync.1rx.io/usersync/tradedesk/09affd61-1009-4498-b9f0-e2daea690cf0
  • https://sync.targeting.unrulymedia.com/csync/RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
42 B
849 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KADUSERCOOKIE=09E9EDC2-DDCD-4F09-872C-2D08FBC13239; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620086400%3A15_223_67_2%7C1620691200%3A222_161_81_71_8_176_13_22_99_21_56_3_231_189_7_166_165_88_220_54_55_204_230%7C1622073600%3A203%7C1620345600%3A63%7C1620777600%3A35
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:22 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_594=17105-RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003&KRTB&17107-RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:22 GMT; path=/ PugT=1619522302; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:22 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:22 GMT; path=/
X-lat
lhrpug020:0:658
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

server
Tengine
date
Tue, 27 Apr 2021 11:18:22 GMT
content-type
text/html
set-cookie
_rxuuid=%7B%22rx_uuid%22%3A%22RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003%22%7D; path=/; expires=Wed, 27 Apr 2022 11:18:22 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-33851508-a9fe-43df-b7ea-6d475f7007b8-003
etag
RX33851508a9fe43dfb7ea6d475f7007b8003
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame E0C9
Redirect Chain
  • https://green.erne.co/pubmatic/cm?
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
42 B
775 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KADUSERCOOKIE=09E9EDC2-DDCD-4F09-872C-2D08FBC13239; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620086400%3A15_223_67_2%7C1620691200%3A222_161_81_71_8_176_13_22_99_21_56_3_231_189_7_166_165_88_220_54_55_204_230%7C1622073600%3A203%7C1620345600%3A63%7C1620777600%3A35
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:23 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_409=22966-6N9RXdmVdHbiGnZh9xOIWthm; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:23 GMT; path=/ PugT=1619522303; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:23 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:23 GMT; path=/
X-lat
lhrpug020:0:527
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

server
openresty
date
Tue, 27 Apr 2021 11:18:22 GMT
content-length
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
set-cookie
u=6N9RXdmVdHbiGnZh9xOIWthm; Max-Age=63072000; Domain=.erne.co; Path=/; Secure; SameSite=None
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
strict-transport-security
max-age=0; includeSubDomains;
dpe
ad4m.at/ad/ Frame 84B4
42 B
1 KB
Document
General
Full URL
https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
content-type
image/gif
content-length
42
set-cookie
__cfduid=dd0bb4550c43f1ff77dcff27625e19baf1619522302; expires=Thu, 27-May-21 11:18:22 GMT; path=/; domain=.ad4m.at; HttpOnly; SameSite=Lax; Secure
report-to
{"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires
0
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
content-security-policy
block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy
same-origin
pragma
no-cache
surrogate-control
no-store
x-fastcgi-cache
BYPASS
x-backend-server
adsrv-wmp3
via
1.1 google
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-request-id
09b4a64a1300004e92751f0000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6467a6568e224e92-FRA
i.match
s.tribalfusion.com/z/ Frame 1F08
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
443 B
Document
General
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method
GET
:authority
s.tribalfusion.com
:scheme
https
:path
/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
ANON_ID=aYnoeUyKalVobWmaZcBxlKOQWTPVWgAAs4XeDyux8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
content-type
image/gif; charset=utf-8
content-length
43
set-cookie
__cfduid=d72d95dd1d9e873ef16ec24e55f7df7fb1619522302; expires=Thu, 27-May-21 11:18:22 GMT; path=/; domain=.tribalfusion.com; HttpOnly; SameSite=Lax ANON_ID=aMnseFR3YWi7UXuRvsb8WXaRYTgPFpiCKLSV2YbcV2FF6K2FUALcNJylZdDF5ymrBGZbqCUISevGPmBfZaykY6w; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:22 GMT; SameSite=None; Secure; ANON_ID_old=aMnseFR3YWi7UXuRvsb8WXaRYTgPFpiCKLSV2YbcV2FF6K2FUALcNJylZdDF5ymrBGZbqCUISevGPmBfZaykY6w; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:22 GMT;
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
302
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
cf-request-id
09b4a64ac300004e8c2f3b0000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6467a65799624e8c-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Tue, 27 Apr 2021 11:18:22 GMT
content-type
text/html
set-cookie
__cfduid=d72d95dd1d9e873ef16ec24e55f7df7fb1619522302; expires=Thu, 27-May-21 11:18:22 GMT; path=/; domain=.tribalfusion.com; HttpOnly; SameSite=Lax ANON_ID=aYnoeUyKalVobWmaZcBxlKOQWTPVWgAAs4XeDyux8; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:22 GMT; SameSite=None; Secure; ANON_ID_old=aYnoeUyKalVobWmaZcBxlKOQWTPVWgAAs4XeDyux8; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:22 GMT;
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
206
x-reuse-index
586
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status
DYNAMIC
cf-request-id
09b4a64a1500004e8c128af000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6467a6568f494e8c-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame 24CE
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%%
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Uhjz15oBUlXD&pid=557219
1 B
463 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Uhjz15oBUlXD&pid=557219
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
KADUSERCOOKIE=09E9EDC2-DDCD-4F09-872C-2D08FBC13239; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620086400%3A15_223_67_2%7C1620691200%3A222_161_81_71_8_176_13_22_99_21_56_3_231_189_7_166_165_88_220_54_55_204_230%7C1622073600%3A203%7C1620345600%3A63%7C1620777600%3A35
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:22 GMT
Content-Type
text/html; charset=utf-8
Content-Length
1
Connection
keep-alive
Set-Cookie
PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:22 GMT; path=/
X-lat
lhrpug001:0:432
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server
bh-deployment-7c488d4f5b-kx42z
cache-control
private, max-age=0, no-cache, no-store
expires
-1
content-language
en-US
set-cookie
V=Uhjz15oBUlXD;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 22-Apr-2022 11:18:22 GMT;Max-Age=31104000;SameSite=None
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Uhjz15oBUlXD&pid=557219
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
141
match.deepintent.com/usersync/ Frame FFE2
0
44 B
Document
General
Full URL
https://match.deepintent.com/usersync/141?redir=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=${DI_USER_ID}&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.deepintent.com
:scheme
https
:path
/usersync/141?redir=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=${DI_USER_ID}&gdpr=0&gdpr_consent=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

content-length
0
date
Tue, 27 Apr 2021 11:18:23 GMT
server
b
rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 41BA
Redirect Chain
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...
0
52 B
Document
General
Full URL
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=51565382&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
t_gid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
accept-ranges
bytes
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 varnish
x-served-by
cache-hhn11581-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1619522306.765116,VS0,VE8
content-length
0

Redirect headers

server
nginx
set-cookie
t_gid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881;Version=1;Path=/;Domain=.taboola.com;Expires=Wed, 27-Apr-2022 11:18:25 GMT;Max-Age=31536000;Secure;SameSite=None
location
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=913805e4-e215-4e15-ad8e-a1d55b44df4c-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges
bytes
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 varnish
x-served-by
cache-hhn11581-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1619522306.610823,VS0,VE58
x-vcl-time-ms
58
content-length
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame AA88
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Centwt3NTwmHLC0I-8EyOQ%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
8 KB
8 KB
Image
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 21 Oct 2020 18:57:29 GMT
Server
Apache/2.2.15 (CentOS)
ETag
"1300708-1f78-5b232eb4914bb"
Vary
Accept-Encoding
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
max-age=61029
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/html; charset=UTF-8
Content-Length
2654
Expires
Wed, 28 Apr 2021 04:15:34 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
mw
mwzeom.zeotap.com/ Frame AA88
95 B
595 B
Image
General
Full URL
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
6467a6569b274ec7-FRA
access-control-allow-headers
*
content-length
95
cf-request-id
09b4a64a1d00004ec7de2d5000000001
info2
uipglob.semasio.net/pubmatic/1/ Frame AA88
Redirect Chain
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&sInitiator=external&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&sInitiator=external&gdpr=0&gdpr_consent=
42 B
604 B
Image
General
Full URL
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&sInitiator=external&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
77.243.60.138 Aalborg, Denmark, ASN42697 (NETIC-AS, DK),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
frontend-id
14
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
42
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
frontend-id
7
location
/pubmatic/1/info2?sType=sync&sExtCookieId=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&sInitiator=external&gdpr=0&gdpr_consent=
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT
Artemis
aud.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&gdpr=&fbounce=1
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&addseg=31
7 B
147 B
Image
General
Full URL
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&addseg=31
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.64.189.249 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:26 GMT
Connection
keep-alive
Content-Length
7
Content-Type
text/plain; charset=utf-8

Redirect headers

date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&addseg=31
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
135
Pug
image2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MDlFOUVEQzItRERDRC00RjA5LTg3MkMtMkQwOEZCQzEzMjM5&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
505 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug013:0:494
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKFzA5X7OrjpCNzKN0XUgSQ&google_cver=1
42 B
855 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKFzA5X7OrjpCNzKN0XUgSQ&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug016:0:417
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEKFzA5X7OrjpCNzKN0XUgSQ&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame AA88
43 B
609 B
Image
General
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.253.128.188 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),
Reverse DNS
bc.80.fd9f.ip4.static.sl-reverse.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:25 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Mon, 26 Apr 2021 11:18:25 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:01306087-f2fc-4400-a3a4-d1b195914b19&gdpr=0&gdpr_consent=
42 B
946 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:01306087-f2fc-4400-a3a4-d1b195914b19&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:28 GMT
X-lat
lhrpug017:0:334
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Date
Tue, 27 Apr 2021 11:18:31 GMT
Server
MT3 3660 495c301 master zrh-pixel-x5
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:01306087-f2fc-4400-a3a4-d1b195914b19&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 27 Apr 2021 11:18:30 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7395524573033724106
42 B
801 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7395524573033724106
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug002:0:475
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=7395524573033724106
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=09affd61-1009-4498-b9f0-e2daea690cf0
42 B
882 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=09affd61-1009-4498-b9f0-e2daea690cf0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug006:0:643
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=09affd61-1009-4498-b9f0-e2daea690cf0
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
image2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
42 B
769 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug002:0:603
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:22 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.142:80
AN-X-Request-Uuid
d3ec579f-76d1-4c94-8ffa-77c8a8895c1b
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
09E9EDC2-DDCD-4F09-872C-2D08FBC13239
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame AA88
43 B
192 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/09E9EDC2-DDCD-4F09-872C-2D08FBC13239?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wS8idTNE2uWYovjDh5.DWRZWzS7qmHI-~A&gdpr=0&gdpr_consent=
0
418 B
Image
General
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wS8idTNE2uWYovjDh5.DWRZWzS7qmHI-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
Cache-Control
no-store, no-cache, private
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wS8idTNE2uWYovjDh5.DWRZWzS7qmHI-~A&gdpr=0&gdpr_consent=
Connection
keep-alive
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://ws.rqtrk.eu/pull?redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D193%26user_id%3D%24BROWSER_ID%26expires%3D1%26ssp%3D%24bidswitch_ssp_id&return-unstable=true&eb=&bidswitch_ssp_id=p...
  • https://x.bidswitch.net/sync?dsp_id=193&user_id=&expires=1&ssp=pubmatic
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=193&user_id=&expires=1&ssp=pubmatic
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f5702e91-6ee1-4d71-b858-3d19dba24411&gdpr=&gdpr_consent=&gdpr_pd=
1 B
745 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f5702e91-6ee1-4d71-b858-3d19dba24411&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:26 GMT
X-lat
lhrpug011:0:327
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=f5702e91-6ee1-4d71-b858-3d19dba24411&gdpr=&gdpr_consent=&gdpr_pd=
date
Tue, 27 Apr 2021 11:18:25 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT
42 B
894 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug015:0:389
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=WF-7VAhd5QdDV7dWWlquUgtf5VFDCeAFD16bo7HT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
1 B
727 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:22 GMT
X-lat
lhrpug020:0:413
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2426560690372709837&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 27 Apr 2021 11:18:21 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfy-gAAgIhwiQAC&gdpr=0&gdpr_consent=&_test=YIfy-gAAgIhwiQAC
1 B
809 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfy-gAAgIhwiQAC&gdpr=0&gdpr_consent=&_test=YIfy-gAAgIhwiQAC
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug005:0:574
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:22 GMT
via
1.1 varnish
server
Varnish
x-timer
S1619522303.894787,VS0,VE0
x-served-by
cache-hhn4047-HHN
x-cache
HIT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfy-gAAgIhwiQAC&gdpr=0&gdpr_consent=&_test=YIfy-gAAgIhwiQAC
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:2b8d3ea0-23a9-4fa0-aaa1-29da3cae996d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
505 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:2b8d3ea0-23a9-4fa0-aaa1-29da3cae996d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug001:0:446
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:2b8d3ea0-23a9-4fa0-aaa1-29da3cae996d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Tue, 27 Apr 2021 11:18:23 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Pug
image2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7979cd4d-4dc3-43a1-9093-4fdbc7bdc4b5-6087f2ff-4348&gdpr=0&gdpr_consent=
42 B
800 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7979cd4d-4dc3-43a1-9093-4fdbc7bdc4b5-6087f2ff-4348&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:23 GMT
X-lat
lhrpug010:0:328
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:23 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=7979cd4d-4dc3-43a1-9093-4fdbc7bdc4b5-6087f2ff-4348&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
current
pubmatic-match.dotomi.com/match/bounce/ Frame AA88
0
104 B
Image
General
Full URL
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=09E9EDC2-DDCD-4F09-872C-2D08FBC13239&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:16::1370 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:23 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
42 B
505 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug016:0:249
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:25 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.40:80
AN-X-Request-Uuid
5207b46d-8aa9-49fe-9878-1c016861323a
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame AA88
Redirect Chain
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_53f81292-2a29-4145-8af2-4a0cd10fae10
42 B
790 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_53f81292-2a29-4145-8af2-4a0cd10fae10
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:24 GMT
X-lat
lhrpug016:0:489
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_53f81292-2a29-4145-8af2-4a0cd10fae10
date
Tue, 27 Apr 2021 11:18:24 GMT
p3p
CP="This is not a P3P policy"
server
nginx
timing-allow-origin
*
content-length
0
content-language
en-US
sodar
pagead2.googlesyndication.com/getconfig/ Frame B0B5
9 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210422&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f6104ebb4af3aea3497aca400434c903afad22ec84e5f74910665ae72a25890f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6941
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 6DCB
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1616005470650935"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6437
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:22 GMT
6c55e9aa0c09bc5e56c7275711c6fe52.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
12 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/6c55e9aa0c09bc5e56c7275711c6fe52.svg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b2b7f8d3f7fccfacd0344799b159a67cc2ad569a503ede790773a9a857411a2c
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
age
187549
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3285
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Sun, 25 Apr 2021 07:12:33 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 25 Apr 2022 07:12:33 GMT
f81bd1330ca7bff0f5dd5d37fc922548.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
3 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/f81bd1330ca7bff0f5dd5d37fc922548.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8c2d5dbb5a6910cb00918521f6d4ca582293596387400ddeee9daf50bd771a17
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
561915
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2583
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Tue, 20 Apr 2021 23:13:07 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 20 Apr 2022 23:13:07 GMT
20c5d5cae832e80ee1423e734b4aa4a1.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
11 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/20c5d5cae832e80ee1423e734b4aa4a1.svg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
641c9502f6f057a197d9789f59f3390916d07d5e0edf5a307dd67cd754d74fb2
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
age
389593
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2730
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Thu, 22 Apr 2021 23:05:09 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Apr 2022 23:05:09 GMT
58f7e48637d3c940a1466795b527cb53.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
12 KB
4 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/58f7e48637d3c940a1466795b527cb53.svg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
438c1d56d29b52caa642e07fba1d58fd6b74e5462959ccad09f0b1131c79829b
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
age
416401
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3579
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Thu, 22 Apr 2021 15:38:21 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Apr 2022 15:38:21 GMT
22a24a20d38719888ccaa620bb79c783.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
6 KB
6 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/22a24a20d38719888ccaa620bb79c783.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
90c9c545b067e4bca12f881cc9a8884a47626c29b1a8770c05bc03de4defc29d
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
529505
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6358
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Wed, 21 Apr 2021 08:13:17 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 21 Apr 2022 08:13:17 GMT
94025b7097faa653ac7b166f6f7e5ab4.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
3 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/94025b7097faa653ac7b166f6f7e5ab4.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ec9b8a887b3978ba0236efa75a01b4263ee187cb35a760ac8693155e102ffd9b
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
416401
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3339
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Thu, 22 Apr 2021 15:38:21 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Apr 2022 15:38:21 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame B0B5
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1616005470650935"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6437
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:22 GMT
async_usersync
ib.adnxs.com/ Frame AA02
0
752 B
Script
General
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:23 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.235:80
AN-X-Request-Uuid
a79f4b49-0b85-4121-8d88-69105a93ff90
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
tweet
cdn.syndication.twimg.com/ Frame 12B1
2 KB
1 KB
XHR
General
Full URL
https://cdn.syndication.twimg.com/tweet?features=tfw_experiments_cookie_expiration%3A1209600%3Btfw_horizon_tweet_embed_9555%3Ahte&id=1386413655659479043&lang=en
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.modules.5e1e58de5d2ab2585a55.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
tsa_f / Express
Resource Hash
0de58cb8983c30b1af8a59db4ad7cdb59a77933ac003ddb55005554115eee5ff
Security Headers
Name Value
Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding
gzip
etag
W/"62d-DbNhyHyy51OGE4t8OUs9uqaFLtc"
x-powered-by
Express
access-control-allow-methods
GET
strict-transport-security
max-age=631138519
x-xss-protection
0
x-response-time
146
server
tsa_f
x-frame-options
SAMEORIGIN
date
Tue, 27 Apr 2021 11:18:23 GMT
vary
Origin, Accept-Encoding
x-tw-cdn
VZ, VZ
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=60
access-control-allow-credentials
true
x-connection-hash
30f225ca86d8808c04e0f73710f16e7a
x-content-type-options
nosniff
access-contol-allow-origin
platform.twitter.com
async_usersync
ib.adnxs.com/ Frame F20B
0
750 B
Script
General
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:23 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.8:80
AN-X-Request-Uuid
97ada0e5-4e36-4e33-bb79-9ef3a76893b4
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 5441
0
752 B
Script
General
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:23 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.247:80
AN-X-Request-Uuid
af8c86b0-ab4a-4239-b39f-af4e602161cd
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 77D0
0
751 B
Script
General
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.91 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:23 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.36:80
AN-X-Request-Uuid
dedb4220-fbb8-4d12-9475-f5779089b65d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
c857a53e07e772ec1d654998ba6e12cc.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/ Frame 84BD
3 KB
1 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/media/c857a53e07e772ec1d654998ba6e12cc.svg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/2423676608385193032/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cc9f1b710b66cc709f285876aea76f3b4bba684114a51a5454de52d0ab53f36
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding
gzip
x-content-type-options
nosniff
age
101609
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1057
x-xss-protection
0
last-modified
Wed, 23 Dec 2020 03:31:42 GMT
server
sffe
date
Mon, 26 Apr 2021 07:04:53 GMT
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Apr 2022 07:04:53 GMT
truncated
/ Frame 84BD
524 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
af62727dc358a15c36620483f006a59a2e344e329763126932e7157a73620155

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=UTF-8
runner.html
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 3DF1
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/222/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5022
date
Tue, 27 Apr 2021 10:51:47 GMT
expires
Wed, 27 Apr 2022 10:51:47 GMT
last-modified
Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1595
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
si
googleads.g.doubleclick.net/pagead/drt/ Frame 1FDF
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1575911585432548&output=html&h=90&slotname=3157381981&adk=141025852&adf=1480696129&pi=t.ma~as.3157381981&w=728&lmt=1619522300&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%3Futm_campaign%3Demotet-global-uninstall%26utm_medium%3Drss%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-8j8fur3FntRFbveRfvS_b5Uf93gDF-rwPbAmYxYVrLNk4LSJl7X_OrZif__imrMahc6sJ1hMPYywVUq_ewNd-S-Mpuf_uhX0qu_JxUty5jtO3LzA0%26utm_source%3Drss&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1619522300150&bpp=13&bdt=278&idt=403&shv=r20210422&cbv=r20190131&ptt=5&saldr=sa&correlator=6279825362846&frm=21&ife=1&pv=1&ga_vid=1566432631.1619522301&ga_sid=1619522301&ga_hid=1170699287&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=518&biw=1600&bih=1200&isw=728&ish=90&ifk=1732373333&scr_x=0&scr_y=0&eid=21068109&oid=3&pvsid=1384264952977891&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.p8xo7isce40e&fsb=1&xpc=RIqdIq8ZPX&p=https%3A//securityaffairs.co&dtd=431
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUl_6yoV1eeg_E7iIdBWomvYo9UPXGC_DZo9qvFqMlM-WkyIs0hMzHH0a_2etFw
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 27 Apr 2021 11:18:23 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Tue, 27-Apr-2021 12:18:23 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Tue, 27 Apr 2021 11:18:23 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Tue, 27 Apr 2021 11:18:23 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
runner.html
tpc.googlesyndication.com/sodar/sodar2/222/ Frame C4FF
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/222/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5022
date
Tue, 27 Apr 2021 10:51:47 GMT
expires
Wed, 27 Apr 2022 10:51:47 GMT
last-modified
Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1596
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
pagead2.googlesyndication.com/bg/ Frame 84BD
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 06:58:38 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 08 Apr 2021 09:18:00 GMT
server
sffe
age
15585
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5710
x-xss-protection
0
expires
Wed, 27 Apr 2022 06:58:38 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 97A8
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssm5etLOud8CzrC9Tf7rz75HVkKfE4RuM47r2_LpokyK6S0w_AZV5uwPeNn3PR1DGVuCu-0NGyHP0pqpnWs-vhhfETSMkWyUEfbENx587gd1HHWeWNtlLK5G07xng&sai=AMfl-YQx3qZSnYAPxsThDcY4U8Dg884AqZ0PXCcw4cZNc7pnjm-wYmmcX-uGwgc9HvNK51hudeImwxJgPrcR&sig=Cg0ArKJSzD6s0csGwxjgEAE&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210423&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=141025852&rs=2&met=mue&la=0&cr=0&osd=1&vs=4&rst=1619522300582&dlt=594&rpt=337&isd=0&msd=0&r=v&fum=1
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:23 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
jot
syndication.twitter.com/i/ Frame 12B1
43 B
454 B
Image
General
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1619522303146%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22ff2e7cf%3A1618526400629%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22securityaffairs%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22securityaffairs%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%225fe8eff%3A1618352504577%22%2C%22item_ids%22%3A%5B%221386413655659479043%22%5D%2C%22item_details%22%3A%7B%221386413655659479043%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
116
pragma
no-cache
last-modified
Tue, 27 Apr 2021 11:18:23 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d343a46a41174ef57826b9be56b4b582
x-transaction
007302cd006131bf
expires
Tue, 31 Mar 1981 05:00:00 GMT
Evny_ARy_normal.jpg
pbs.twimg.com/profile_images/1357383079174656002/ Frame 12B1
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1357383079174656002/Evny_ARy_normal.jpg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67BE) /
Resource Hash
2f03a0fce12e515a3318277bd9f8ecfc043ae01f232e018c1a317d11abd30282
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:23 GMT
x-content-type-options
nosniff
age
405554
x-cache
HIT
content-length
2035
x-response-time
122
surrogate-key
profile_images profile_images/bucket/5 profile_images/1357383079174656002
last-modified
Thu, 04 Feb 2021 17:36:39 GMT
server
ECS (frb/67BE)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b8cf6b4e3f020c1aeefd9144f0790ae6
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
Ez2HwPwVkAEmkWP
pbs.twimg.com/media/ Frame 12B1
46 KB
46 KB
Image
General
Full URL
https://pbs.twimg.com/media/Ez2HwPwVkAEmkWP?format=jpg&name=small
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
3989516825e0741c92fa6c67f38e44239e1f6d93becc7d39d8e224a0b9a9230d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:23 GMT
x-content-type-options
nosniff
age
140548
x-cache
HIT
content-length
47316
x-response-time
125
surrogate-key
media media/bucket/0 media/1386413523232722945
last-modified
Sun, 25 Apr 2021 20:13:16 GMT
server
ECS (frb/67D4)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
8b0ef05cc394fde49bc1bc43d7fe3718
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
jot
syndication.twitter.com/i/ Frame 12B1
43 B
124 B
Image
General
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1619522303495%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22horizon%22%2C%22client_version%22%3A%22ff2e7cf%3A1618526400629%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F117238%2Fcyber-crime%2Femotet-global-uninstall.html%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22securityaffairs%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22securityaffairs%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%225fe8eff%3A1618352504577%22%2C%22item_ids%22%3A%5B%221386413655659479043%22%5D%2C%22item_details%22%3A%7B%221386413655659479043%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A2681.0850016772747%7D&dnt=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
121
pragma
no-cache
last-modified
Tue, 27 Apr 2021 11:18:23 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d343a46a41174ef57826b9be56b4b582
x-transaction
00cdda5400b81c2f
expires
Tue, 31 Mar 1981 05:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 1401
9 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210422&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b076a74ccff513583dd5f97e03e4a9be228964cdb3186ea3b8e77f979ddc1a45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 27 Apr 2021 11:18:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6966
x-xss-protection
0
wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
pagead2.googlesyndication.com/bg/ Frame 3DF1
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 06:58:38 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 08 Apr 2021 09:18:00 GMT
server
sffe
age
15585
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5710
x-xss-protection
0
expires
Wed, 27 Apr 2022 06:58:38 GMT
wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
pagead2.googlesyndication.com/bg/ Frame C4FF
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 06:58:38 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 08 Apr 2021 09:18:00 GMT
server
sffe
age
15585
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5710
x-xss-protection
0
expires
Wed, 27 Apr 2022 06:58:38 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 1401
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210422/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1616005470650935"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6437
x-xss-protection
0
expires
Tue, 27 Apr 2021 11:18:23 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6DCB
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210422&jk=4239238126509352&bg=!FhWlFVHNAAZUuIlwVLg7ACkAdvg8Wiz-vC-gsoXj7I99PPnaW0EVFIIVsmSs98BK68bIokfkInq8bgIAAAEKUgAAACpoAQcKAUNb33U96sGLH0auq5tapnwSlQ5BI-5g0nb8mlhpuAnCqsLSp3pyu24Ggzwm05K3KgPz3sYDalKMzmYvUSxdCnAt1ZtdzEfV1CGj8U_DoAGmr1HuLLvWMXkvTjdx4R4Cr1VqqFHaSiwNaW8wnFN7OjFVk7zkBxXiRDaXN_URAu56bXiKvBMmZ8I5auJB7dxpHx-C3Jj0WeyIth8n5bPj5PzkM-n-EzcF8btHcvq9lgXviX9fl25-aUSrXr1Cak1QxohoWp52Aw9R0uw9K-xz6XxgiEU19eII2_0phQfp1WPvwFhqctS1lsaxpWKVCfSZP7Gc6SHQk16Lr5Crr4aJga3Cgp2CFxzOmSXvRTfqMesuvgg_2zYggiGE_SQGIznwphugbFicJjwTtMldJoWz-GYewrp3cPPVUWVTNwzfL-LkKt1fCpkCPy95EF2jq7tXwVu1SzY63epEhZe4ZAedcv6gHHYq6aSuw_N0biRf7xQuQJpl_vbVKEt-byx4pzt_z5Y0Cv9HIWV_S5HXKBOcuHA7_RDI9Svab-7--H2Hd-VBj0QAZ5oDfK2tqWK51cSA6HYPGJhLm1t6cnuE314CB5G4GMbuuQVHG9ocr2nz3Aj-d2M5Xat3Y1frjMwCgDJIPB5ap3rGfyminF1muqxMCc8fJsL9FuMZF0mF-SGkr0BAAVFhpRpRA4vkRUSke4QwjAjrCHreg065zroR-SNsS5HkkKhucH3FYsqAypgb2PhHgjjziHKjsalSCfpUEcKyTKbUOoFUuWsbhxO3EKRYRBdQGblfxS63tmHa00cxonzQKOECG9tIpYayIHqhQT5sODRKyQPRrZIH1WFl8-Gt9LqyB38Tj3P3lv_mzCy9eWARlgb6lO9mbCeMp74kZC036gQKGW_nBKOepWm8PVqejJS6qqQCIIv5AUQ5Q0ZLyd8BEi_PP66pMpd6wdLcbo1enug_jdJOtoDohEDfp5v95aFg7Dg5DMtm3ANsVRZHTIztnMaJvgwpSGSqk9DylZe8tfrjX2SHptTeUve63sqwad5RIsEoqJxqqOoBpYOg3se9I-aXW0CH2392U-NgG3wHoxymz48WDUQJxALfy1Ig2_9KpkkTDuu4PdFtw7iNqJJErXNfszAwaUKPPGePb7xKzMnT85P7Di6p0vmK2ddXHRjSfGgeWFaGmJc8XI_zkto5Qpys57MH
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame B0B5
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210422&jk=2395319066769911&bg=!fX6lfjrNAAZUuIlwVLg7ACkAdvg8WoPnueZa2hHLbjOdggVxIKuDE2lIHwn-dGW7omXOBP1NZezo7wIAAAEvUgAAABVoAQcKAD8vwVsZ95MF2l6g8KMckXM9Iw4VlQRcC22xYh7bunLs180cwYzq8Lfz2_ZhciOmiVmtnhlKmXrSWt8VZ77SnleZAjzauJ7MS8HP8i0x317DIEx3JJXZgDi6-fcVHhotQuf-3xKw5SZsl7EYxM3V0h0nbDqxOu-mTjuaiqlyiah0wd36vD3ZPUKL6qgc3OgleNZHtCY89c_UJh-fOhOdROsmDh6KWUJgtd_YEkO4oG6-2zCsXns-GH7GzQQ8PVYG_tDOtfHxZO2JjDCAby6-G5oHM97Pqn3fTa5NM-2JRBl7zXJzOu4rLHXD4kFcQZFb69k14EXxoDPYqDqWH5WtXA7o0erR_ebSi72I0oIlGhmLcX87m9Fzfv1x3K5b6QTikzGunOPbEErfRLyuGF5m7UeHP62z60wxvKO3E7nq23J6tnsb4GyuTCXoaTE9zth_FvLOeiEsVkEInQUJ-GOoUqc0LFWd49lsAkP-I206JBsWyyGMwWqOQihuaqjPr5bIT2AoZ5CIQpxKeARbYvIHfhvWzJ1SlUKbcUl3qr7HjKMuumcqH_GsC6rIOBpcaOveVGl1jFaYJ_NJP7OKt34VjsziL0Cg3vGRAfmoVlazSo2_eXA-ma9v7fup9TfAtnfcw7obhOwlVTBHAvvS30QfnVGTbwzjaD14yVCuKannBzOA7xDfWL-wFXzEU4dG75t5-lnkSNQzgs-ysV6qhJTJfiSsGlxq9zJh2PNBE021soo9Hko79NAwHfLJDE6mzURH7Hxov36hNz_r8k2tYoA3IADs1tLMNFqtCHPci1joLhxHd_i8wb6SbkNAMiHN18-TyxhZJOBKwFRfZ3e9H4BBQg
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame AA88
0
418 B
Script
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=158127&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 10:47:58 GMT
Cache-Control
no-store, no-cache, private
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
runner.html
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 5BDC
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/222/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://securityaffairs.co/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://securityaffairs.co/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5022
date
Tue, 27 Apr 2021 10:51:47 GMT
expires
Wed, 27 Apr 2022 10:51:47 GMT
last-modified
Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1597
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
pagead2.googlesyndication.com/bg/ Frame 5BDC
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 06:58:38 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 08 Apr 2021 09:18:00 GMT
server
sffe
age
15586
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5710
x-xss-protection
0
expires
Wed, 27 Apr 2022 06:58:38 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 1401
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210422&jk=1384264952977891&bg=!19Sl1JDNAAZUuIlwVLg7ACkAdvg8WlvrG0oE3ZUTD2urLFHXYAXO9geaRmE8cH7upqCLb8utySRdMAIAAAENUgAAABpoAQcKAIbTZal3dVyIa5Wyv2N4L27xM7UAXuVZ5uJrDnLqfYrmjr3wZK0KuyeivgA4hFeHCwJfn3ppcc8DVwYrgUEMKANh7BO398DBIaUMgTLysHJ3WmO9Cle2sVMP8rc5tNefxjf8GTNYOCQM43sRZkkhpkHTHObRjS_JBNZqBgc3AXqR1Hd6-fbbNpkCOr8S5vREPbQVQrRn7cKrLUns1wVrozezGpswwEBVAsQfNNpr_Y_6psL1Lvn_hTrjhmm1uvYf1atslVjDbAucaGlGeZGG0YYsrWASHFgdVSkjxihJVSxEi1mR3cIO6iSmyQjawD9pkYK32SJY8awLyXYYzeY4ePRoIBxdcEoj3Dh08ou9w6feRQ8ZlzV-WlfR1iBtgwSNM6lA6s_ob-fLRZ4b22ZDmVtGxPA8delBXYIRxklX4Ou6Ce896VSkA5U4dYJ8TWUOpe_h07zUXkkJC6lPfuN2A9JGsRQR2cf1MdMkoqhIPeqvDzp9qBVjbpjRX3dcW26CG7bpUOULYaRArH1L1c94g2vYYwATG1NalVyJcy3kXQ_Sj__ChwboAHq0-HjM1Ct4hAJ8xDnSPWYHyOf9OjfoidUjLP6ipZ7fLzcExM5nJzBIKHdHEQQ7POesweJ3V_5roqTEVt_0j8iUoNv_u2TMGO1mPMrlz-Qqz_0wXFhPnHRbxbc6Nw3YRdo7Sepsm6oktQIgxamGZqPRbfYoybjw67Z6I8vklDWjRuFzMiZoJtZN78q46naacpJREIHSsM1oTExKReTG7UvqMNRw7QFirMaVzek7IwYYmZjxnjieljFbkQ49SqF0f7XB3cVW0kTK5phpo4dHtD3oDerFdZW8AbOEER6aDLH87FVQ0lR2AtXwYhZTwEJTA2wTfpMqAun8OaL53zzRh4k-dpDKznLPnvFRFwpuf65tAHuaLbksc83Rohvv4w
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
showad.js
ads.pubmatic.com/AdServer/js/ Frame 589C
38 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Last-Modified
Wed, 14 Apr 2021 09:18:30 GMT
ETag
"13006b6-98c2-5bfeb3aef82b4"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
14060
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=130619
Expires
Wed, 28 Apr 2021 23:35:24 GMT
Date
Tue, 27 Apr 2021 11:18:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
showad.js
ads.pubmatic.com/AdServer/js/ Frame 920F
38 KB
14 KB
Document
General
Full URL
https://ads.pubmatic.com/AdServer/js/showad.js
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564

Request headers

Host
ads.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
same-origin
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/AdServer/js/showad.js
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/AdServer/js/showad.js

Response headers

Last-Modified
Wed, 14 Apr 2021 09:18:30 GMT
ETag
"13006b6-98c2-5bfeb3aef82b4"
Server
Apache/2.2.15 (CentOS)
Accept-Ranges
bytes
Content-Encoding
gzip
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length
14060
Content-Type
text/html; charset=UTF-8
Cache-Control
public, max-age=130619
Expires
Wed, 28 Apr 2021 23:35:24 GMT
Date
Tue, 27 Apr 2021 11:18:25 GMT
Connection
keep-alive
Vary
Accept-Encoding
PugMaster
image6.pubmatic.com/AdServer/ Frame 920F
8 KB
9 KB
Script
General
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
6ca1e65bd25dd4247cf00bfdf1ebecc1d021c0ff2dd546e5fb8ca6edc73c7346

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
P3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Pug
image2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECa27be77Xm2sX0giKgy2xU&google_cver=1
42 B
855 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECa27be77Xm2sX0giKgy2xU&google_cver=1
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug007:0:506
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECa27be77Xm2sX0giKgy2xU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubmatic
um.simpli.fi/ Frame 920F
43 B
609 B
Image
General
Full URL
https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.253.128.188 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),
Reverse DNS
bc.80.fd9f.ip4.static.sl-reverse.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:25 GMT
x-content-type-options
nosniff
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
43
expires
Mon, 26 Apr 2021 11:18:25 GMT
usersync.aspx
dis.criteo.com/dis/ Frame 8160
43 B
304 B
Document
General
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.0.163 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

:method
GET
:authority
dis.criteo.com
:scheme
https
:path
/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

cache-control
no-cache
pragma
no-cache
content-type
image/gif
expires
Tue, 27 Apr 2021 00:00:00 GMT
server
Microsoft-IIS/10.0
x-errorlevel
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
server-processing-duration-in-ticks
1283
date
Tue, 27 Apr 2021 11:18:26 GMT
content-length
43
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:bed76087-f304-4600-a368-6582ad2cf265&gdpr=0&gdpr_consent=
42 B
946 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:bed76087-f304-4600-a368-6582ad2cf265&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:28 GMT
X-lat
lhrpug016:0:385
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Date
Tue, 27 Apr 2021 11:18:31 GMT
Server
MT3 3660 495c301 master zrh-pixel-x27
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:bed76087-f304-4600-a368-6582ad2cf265&gdpr=0&gdpr_consent=
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 27 Apr 2021 11:18:30 GMT
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame 59BB
Redirect Chain
  • https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
42 B
769 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63; KRTBCOOKIE_1101=23040-6955795335128676493; PugT=1619522305; KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; KRTBCOOKIE_80=16514-CAESECa27be77Xm2sX0giKgy2xU&KRTB&22987-CAESECa27be77Xm2sX0giKgy2xU&KRTB&23025-CAESECa27be77Xm2sX0giKgy2xU; KRTBCOOKIE_153=1923-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&19420-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&22979-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0; KRTBCOOKIE_57=22776-3694532967942166496; KRTBCOOKIE_188=3189-d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348; KRTBCOOKIE_1074=22956-e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf; KRTBCOOKIE_22=14911-2461256698955117415; KRTBCOOKIE_218=22978-YIfzAQAAgcwJuAA4&KRTB&23194-YIfzAQAAgcwJuAA4&KRTB&23209-YIfzAQAAgcwJuAA4&KRTB&23244-YIfzAQAAgcwJuAA4; KRTBCOOKIE_466=16530-f5702e91-6ee1-4d71-b858-3d19dba24411
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:26 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_336=5844-4360478701595109786; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:26 GMT; path=/ PugT=1619522306; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:26 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:26 GMT; path=/
X-lat
lhrpug007:0:508
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=4360478701595109786
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5176658639249221789
42 B
801 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5176658639249221789
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:28 GMT
X-lat
lhrpug015:0:447
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:28 GMT
server
nginx
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=5176658639249221789
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=95e471ea-00ee-471c-a54d-85bacf63223d
42 B
882 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=95e471ea-00ee-471c-a54d-85bacf63223d
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:26 GMT
X-lat
lhrpug015:0:443
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:26 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=95e471ea-00ee-471c-a54d-85bacf63223d
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
313
Pug
image2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
42 B
769 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug016:0:512
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:25 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.220.165:80
AN-X-Request-Uuid
e588b5fe-f972-4ca7-8378-1c6e15edd140
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3694532967942166496&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
x.bidswitch.net/ul_cb/ Frame 920F
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://ums.acuityplatform.com/bum?tpid=29&uid=f5702e91-6ee1-4d71-b858-3d19dba24411&bidswitch_ssp_id=pubmatic
  • https://x.bidswitch.net/sync?dsp_id=236&user_id=575332066921&expires=30&user_group=1&ssp=Pubmatic
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=236&user_id=575332066921&expires=30&user_group=1&ssp=Pubmatic
43 B
344 B
Image
General
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=236&user_id=575332066921&expires=30&user_group=1&ssp=Pubmatic
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.230.211 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-230-211.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:29 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
43
content-type
image/gif

Redirect headers

location
https://x.bidswitch.net/ul_cb/sync?dsp_id=236&user_id=575332066921&expires=30&user_group=1&ssp=Pubmatic
date
Tue, 27 Apr 2021 11:18:29 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0
42 B
894 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug007:0:479
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame AAC5
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=9
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795335128676493
42 B
771 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795335128676493
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:25 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_1101=23040-6955795335128676493; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:25 GMT; path=/ PugT=1619522305; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:25 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:25 GMT; path=/
X-lat
lhrpug006:0:336
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:25 GMT
Transfer-Encoding
chunked
Connection
keep-alive
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Set-Cookie
UserID1=6955795335128676493; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6955795335128676493
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame 1298
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AABGak7BD-YAACmu4b_Xrw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpm%26bee_sync_current_part...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=pm&bee_sync_hop_count=1&userid=8399306420114810423
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
42 B
773 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63; KRTBCOOKIE_1101=23040-6955795335128676493; KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; KRTBCOOKIE_80=16514-CAESECa27be77Xm2sX0giKgy2xU&KRTB&22987-CAESECa27be77Xm2sX0giKgy2xU&KRTB&23025-CAESECa27be77Xm2sX0giKgy2xU; KRTBCOOKIE_153=1923-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&19420-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&22979-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0; KRTBCOOKIE_57=22776-3694532967942166496; KRTBCOOKIE_188=3189-d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348; KRTBCOOKIE_1074=22956-e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf; KRTBCOOKIE_22=14911-2461256698955117415; KRTBCOOKIE_218=22978-YIfzAQAAgcwJuAA4&KRTB&23194-YIfzAQAAgcwJuAA4&KRTB&23209-YIfzAQAAgcwJuAA4&KRTB&23244-YIfzAQAAgcwJuAA4; KRTBCOOKIE_466=16530-f5702e91-6ee1-4d71-b858-3d19dba24411; KRTBCOOKIE_336=5844-4360478701595109786; PugT=1619522306; KRTBCOOKIE_377=6810-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&22918-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&23031-95e471ea-00ee-471c-a54d-85bacf63223d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:26 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:26 GMT; path=/ PugT=1619522306; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:26 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:26 GMT; path=/
X-lat
lhrpug009:0:526
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

Date
Tue, 27 Apr 2021 11:18:26 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABGak7BD-YAACmu4b_Xrw
Server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
Content-Length
0
Connection
keep-alive
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:6617c627-e0d6-4ccb-9223-411cdfdcdbf4&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
505 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:6617c627-e0d6-4ccb-9223-411cdfdcdbf4&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug006:0:444
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:6617c627-e0d6-4ccb-9223-411cdfdcdbf4&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Tue, 27 Apr 2021 11:18:25 GMT
Server
Apache/2.4.41 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Pug
image2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348&gdpr=0&gdpr_consent=
42 B
800 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug017:0:441
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
bridge
cm.adgrx.com/ Frame 115A
43 B
408 B
Document
General
Full URL
https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.251.232.170 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
ams-mon-1.sys.adgear.com
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host
cm.adgrx.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
Content-Type
image/gif
Content-Length
43
Connection
keep-alive
server
Cowboy
X-RealServer-NX
ams-delivery-2
Cache-Control
no-cache, no-store, must-revalidate, proxy-revalidate
Pragma
no-cache
Expires
Thu, 23 Sep 2004 17:42:04 GMT
P3P
CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin
*
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame 1771
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4477411516
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4477411516
  • https://sync.1rx.io/usersync/tradedesk/95e471ea-00ee-471c-a54d-85bacf63223d
  • https://sync.targeting.unrulymedia.com/csync/RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003
42 B
849 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63; KRTBCOOKIE_1101=23040-6955795335128676493; KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; KRTBCOOKIE_80=16514-CAESECa27be77Xm2sX0giKgy2xU&KRTB&22987-CAESECa27be77Xm2sX0giKgy2xU&KRTB&23025-CAESECa27be77Xm2sX0giKgy2xU; KRTBCOOKIE_153=1923-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&19420-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&22979-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0; KRTBCOOKIE_57=22776-3694532967942166496; KRTBCOOKIE_188=3189-d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348; KRTBCOOKIE_1074=22956-e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf; KRTBCOOKIE_22=14911-2461256698955117415; KRTBCOOKIE_218=22978-YIfzAQAAgcwJuAA4&KRTB&23194-YIfzAQAAgcwJuAA4&KRTB&23209-YIfzAQAAgcwJuAA4&KRTB&23244-YIfzAQAAgcwJuAA4; KRTBCOOKIE_466=16530-f5702e91-6ee1-4d71-b858-3d19dba24411; KRTBCOOKIE_336=5844-4360478701595109786; PugT=1619522306; KRTBCOOKIE_377=6810-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&22918-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&23031-95e471ea-00ee-471c-a54d-85bacf63223d; SPugT=1619522305
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:27 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_594=17105-RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003&KRTB&17107-RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:27 GMT; path=/ PugT=1619522307; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:27 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:27 GMT; path=/
X-lat
lhrpug007:0:385
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

server
Tengine
date
Tue, 27 Apr 2021 11:18:27 GMT
content-type
text/html
set-cookie
_rxuuid=%7B%22rx_uuid%22%3A%22RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003%22%7D; path=/; expires=Wed, 27 Apr 2022 11:18:27 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-8df0828c-0649-48f9-bbf9-1a8ed93c173c-003
etag
RX8df0828c064948f9bbf91a8ed93c173c003
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
42 B
505 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug002:0:538
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

Pragma
no-cache
Date
Tue, 27 Apr 2021 11:18:25 GMT
X-Proxy-Origin
195.242.213.99; 195.242.213.99; 721.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.143:80
AN-X-Request-Uuid
f2a94227-6264-458d-bf22-aa0e674e77f6
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3694532967942166496
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Cookie set Pug
image2.pubmatic.com/AdServer/ Frame 0909
Redirect Chain
  • https://green.erne.co/pubmatic/cm?
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
42 B
775 B
Document
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Host
image2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
SPugT=1619522307; PugT=1619522308; PUBMDCID=3; KRTBCOOKIE_27=16735-uid:bed76087-f304-4600-a368-6582ad2cf265&KRTB&16736-uid:bed76087-f304-4600-a368-6582ad2cf265&KRTB&23019-uid:bed76087-f304-4600-a368-6582ad2cf265&KRTB&23114-uid:bed76087-f304-4600-a368-6582ad2cf265
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:28 GMT
Content-Type
image/gif; charset=utf-8
Content-Length
42
Connection
keep-alive
Set-Cookie
KRTBCOOKIE_409=22966-6N9RXdmVdHbiGnZh9xOIWthm; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:28 GMT; path=/ PugT=1619522308; domain=pubmatic.com; SameSite=None; secure; expires=Thu, 27-May-2021 11:18:28 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:28 GMT; path=/
X-lat
lhrpug014:0:556
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

server
openresty
date
Tue, 27 Apr 2021 11:18:28 GMT
content-length
0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
set-cookie
u=6N9RXdmVdHbiGnZh9xOIWthm; Max-Age=63072000; Domain=.erne.co; Path=/; Secure; SameSite=None
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=6N9RXdmVdHbiGnZh9xOIWthm
strict-transport-security
max-age=0; includeSubDomains;
dpe
ad4m.at/ad/ Frame 7EE1
42 B
1 KB
Document
General
Full URL
https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

:method
GET
:authority
ad4m.at
:scheme
https
:path
/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 27 Apr 2021 11:18:25 GMT
content-type
image/gif
content-length
42
set-cookie
__cfduid=d273678cfd980bf54beb39ec6599c01ab1619522305; expires=Thu, 27-May-21 11:18:25 GMT; path=/; domain=.ad4m.at; HttpOnly; SameSite=Lax; Secure
report-to
{"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires
0
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
content-security-policy
block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy
same-origin
pragma
no-cache
surrogate-control
no-store
x-fastcgi-cache
BYPASS
x-backend-server
adsrv-wmp3
via
1.1 google
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-request-id
09b4a655eb00004dfa30370000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6467a6697e9b4dfa-FRA
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf
42 B
790 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug008:0:511
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf
date
Tue, 27 Apr 2021 11:18:25 GMT
p3p
CP="This is not a P3P policy"
server
nginx
timing-allow-origin
*
content-length
0
content-language
en-US
i.match
s.tribalfusion.com/z/ Frame 40B4
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
412 B
Document
General
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method
GET
:authority
s.tribalfusion.com
:scheme
https
:path
/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
ANON_ID=adno6TuyTYUBErvc0qfIYyXn3l2oTR3xYGFyIsIW
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Tue, 27 Apr 2021 11:18:25 GMT
content-type
image/gif; charset=utf-8
content-length
43
set-cookie
__cfduid=d23c02e27ee47f7e4f3d5fd50cc2a02af1619522305; expires=Thu, 27-May-21 11:18:25 GMT; path=/; domain=.tribalfusion.com; HttpOnly; SameSite=Lax ANON_ID=aNnseFyg6AarA7u8QGNusqGqTFn34BL7VtVrdNLTdQYHM72RXw3GtvZb76yeacSevlqZc3rP5ev948mCFpn5p3; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:25 GMT; SameSite=None; Secure; ANON_ID_old=aNnseFyg6AarA7u8QGNusqGqTFn34BL7VtVrdNLTdQYHM72RXw3GtvZb76yeacSevlqZc3rP5ev948mCFpn5p3; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:25 GMT;
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
302
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
cf-cache-status
DYNAMIC
cf-request-id
09b4a656ca00004e8c1d280000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6467a66ade004e8c-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Tue, 27 Apr 2021 11:18:25 GMT
content-type
text/html
set-cookie
__cfduid=d23c02e27ee47f7e4f3d5fd50cc2a02af1619522305; expires=Thu, 27-May-21 11:18:25 GMT; path=/; domain=.tribalfusion.com; HttpOnly; SameSite=Lax ANON_ID=adno6TuyTYUBErvc0qfIYyXn3l2oTR3xYGFyIsIW; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:25 GMT; SameSite=None; Secure; ANON_ID_old=adno6TuyTYUBErvc0qfIYyXn3l2oTR3xYGFyIsIW; path=/; domain=.tribalfusion.com; expires=Mon, 26-Jul-2021 11:18:25 GMT;
p3p
CP="NOI DEVo TAIa OUR BUS"
x-function
206
x-reuse-index
8397
cache-control
no-cache private
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status
DYNAMIC
cf-request-id
09b4a655c900004e8cb137b000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6467a6694afe4e8c-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
Cookie set Pug
simage2.pubmatic.com/AdServer/ Frame 07AD
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%%
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Qg2Cu6d51QGd&pid=557219
1 B
463 B
Document
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Qg2Cu6d51QGd&pid=557219
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Host
simage2.pubmatic.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://ads.pubmatic.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PUBMDCID=3; KADUSERCOOKIE=605EF0B8-63D4-4571-99B7-A458D04E89AD; chkChromeAb67Sec=1; DPSync3=1620691200%3A201_227_226_221; SyncRTB3=1620691200%3A54_3_176_7_55_222_161_8_166_81_165_56_99_88_230_231_220_13_22_204_189_21_71%7C1620086400%3A2_67_15_223%7C1620777600%3A35%7C1622073600%3A203%7C1620345600%3A63; KRTBCOOKIE_1101=23040-6955795335128676493; KRTBCOOKIE_699=22727-AABGak7BD-YAACmu4b_Xrw; KRTBCOOKIE_80=16514-CAESECa27be77Xm2sX0giKgy2xU&KRTB&22987-CAESECa27be77Xm2sX0giKgy2xU&KRTB&23025-CAESECa27be77Xm2sX0giKgy2xU; KRTBCOOKIE_153=1923-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&19420-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0&KRTB&22979-TyXlGh8m7RxUI7waSyTwSR0tuxtULOpJGiwMeZV0; KRTBCOOKIE_57=22776-3694532967942166496; KRTBCOOKIE_188=3189-d369bb97-bbf3-40fe-b32c-0df542297e85-6087f301-4348; KRTBCOOKIE_1074=22956-e_b0b9ff8c-efb4-4c9e-a394-117f500b9edf; KRTBCOOKIE_22=14911-2461256698955117415; KRTBCOOKIE_218=22978-YIfzAQAAgcwJuAA4&KRTB&23194-YIfzAQAAgcwJuAA4&KRTB&23209-YIfzAQAAgcwJuAA4&KRTB&23244-YIfzAQAAgcwJuAA4; KRTBCOOKIE_466=16530-f5702e91-6ee1-4d71-b858-3d19dba24411; KRTBCOOKIE_336=5844-4360478701595109786; PugT=1619522306; KRTBCOOKIE_377=6810-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&22918-95e471ea-00ee-471c-a54d-85bacf63223d&KRTB&23031-95e471ea-00ee-471c-a54d-85bacf63223d; SPugT=1619522305
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

Server
nginx
Date
Tue, 27 Apr 2021 11:18:27 GMT
Content-Type
text/html; charset=utf-8
Content-Length
1
Connection
keep-alive
Set-Cookie
PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Mon, 26-Jul-2021 11:18:27 GMT; path=/
X-lat
lhrpug002:0:392
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private

Redirect headers

p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server
bh-deployment-7c488d4f5b-r57dl
cache-control
private, max-age=0, no-cache, no-store
expires
-1
content-language
en-US
set-cookie
V=Qg2Cu6d51QGd;Version=0;Secure;Path=/;Domain=.contextweb.com;Expires=Fri, 22-Apr-2022 11:18:27 GMT;Max-Age=31104000;SameSite=None INGRESSCOOKIE=6081447eb2009b81; path=/; HttpOnly; Secure; SameSite=None
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=Qg2Cu6d51QGd&pid=557219
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
141
match.deepintent.com/usersync/ Frame 6B59
0
39 B
Document
General
Full URL
https://match.deepintent.com/usersync/141?redir=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=${DI_USER_ID}&gdpr=0&gdpr_consent=
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.deepintent.com
:scheme
https
:path
/usersync/141?redir=https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=${DI_USER_ID}&gdpr=0&gdpr_consent=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

content-length
0
date
Tue, 27 Apr 2021 11:18:24 GMT
server
b
rtb-h
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame FF26
Redirect Chain
  • https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
  • https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...
0
52 B
Document
General
Full URL
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by
Host: image6.pubmatic.com
URL: https://image6.pubmatic.com/AdServer/PugMaster?kdntuid=1&rnd=14372492&p=158127&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&sec=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
match.taboola.com
:scheme
https
:path
/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ads.pubmatic.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
t_gid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

server
nginx
accept-ranges
bytes
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 varnish
x-served-by
cache-hhn11581-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1619522306.765287,VS0,VE8
content-length
0

Redirect headers

server
nginx
set-cookie
t_gid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881;Version=1;Path=/;Domain=.taboola.com;Expires=Wed, 27-Apr-2022 11:18:25 GMT;Max-Age=31536000;Secure;SameSite=None
location
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=8a903901-2beb-4842-9b3f-f750a7b0ecf7-tuct7817881&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges
bytes
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 varnish
x-served-by
cache-hhn11581-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1619522306.610770,VS0,VE58
x-vcl-time-ms
58
content-length
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 920F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YF7wuGPURXGZt6RY0E6JrQ%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
8 KB
8 KB
Image
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-233-180.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 21 Oct 2020 18:57:29 GMT
Server
Apache/2.2.15 (CentOS)
ETag
"1300708-1f78-5b232eb4914bb"
Vary
Accept-Encoding
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
max-age=61029
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/html; charset=UTF-8
Content-Length
2654
Expires
Wed, 28 Apr 2021 04:15:34 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
mw
mwzeom.zeotap.com/ Frame 920F
95 B
596 B
Image
General
Full URL
https://mwzeom.zeotap.com/mw?zpartnerid=1384&env=mWeb&gdpr=0&gdpr_consent=&cid=605EF0B8-63D4-4571-99B7-A458D04E89AD
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
image/png
access-control-allow-origin
https://ads.pubmatic.com
access-control-allow-credentials
true
cf-ray
6467a669faed4a92-FRA
access-control-allow-headers
*
content-length
95
cf-request-id
09b4a6563d00004a92eda6d000000001
info2
uipglob.semasio.net/pubmatic/1/ Frame 920F
Redirect Chain
  • https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=605EF0B8-63D4-4571-99B7-A458D04E89AD&sInitiator=external&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=605EF0B8-63D4-4571-99B7-A458D04E89AD&sInitiator=external&gdpr=0&gdpr_consent=
42 B
603 B
Image
General
Full URL
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=605EF0B8-63D4-4571-99B7-A458D04E89AD&sInitiator=external&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
77.243.60.138 Aalborg, Denmark, ASN42697 (NETIC-AS, DK),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:24 GMT
frontend-id
7
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
image/gif
content-length
42
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:23 GMT
frontend-id
8
location
/pubmatic/1/info2?sType=sync&sExtCookieId=605EF0B8-63D4-4571-99B7-A458D04E89AD&sInitiator=external&gdpr=0&gdpr_consent=
p3p
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
access-control-allow-origin
*
uip-response-status
Ok
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
routing-server-id
-1
expires
Sat, 01 Jan 2011 12:00:00 GMT
Artemis
aud.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&gdpr=
  • https://visitor.fiftyt.com/p.gif?ev=sync&p=pm&pm_uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&gdpr=&fbounce=1
  • https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=605EF0B8-63D4-4571-99B7-A458D04E89AD&addseg=31
7 B
147 B
Image
General
Full URL
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=605EF0B8-63D4-4571-99B7-A458D04E89AD&addseg=31
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.64.189.249 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:26 GMT
Connection
keep-alive
Content-Length
7
Content-Type
text/plain; charset=utf-8

Redirect headers

date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 google
p3p
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location
https://aud.pubmatic.com/AdServer/Artemis?dpid=431&userid=605EF0B8-63D4-4571-99B7-A458D04E89AD&addseg=31
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
content-type
text/html; charset=utf-8
alt-svc
clear
content-length
135
Pug
image2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjA1RUYwQjgtNjNENC00NTcxLTk5QjctQTQ1OEQwNEU4OUFE&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
505 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug006:0:396
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif; charset=utf-8
Content-Length
42

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
605EF0B8-63D4-4571-99B7-A458D04E89AD
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 920F
43 B
837 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/605EF0B8-63D4-4571-99B7-A458D04E89AD?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 27 Apr 2021 11:18:25 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
SPug
image4.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&redir=true&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=605EF0B8-63D4-4571-99B7-A458D04E89AD&redir=true&gdpr=0&gdpr_consent=&verify=true
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-yxBT1EpE2uX6S8nhRF7wid5YM0wMbrA-~A&gdpr=0&gdpr_consent=
0
418 B
Image
General
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-yxBT1EpE2uX6S8nhRF7wid5YM0wMbrA-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
Cache-Control
no-store, no-cache, private
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 27 Apr 2021 11:18:26 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-yxBT1EpE2uX6S8nhRF7wid5YM0wMbrA-~A&gdpr=0&gdpr_consent=
Connection
keep-alive
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2461256698955117415&gdpr=0&gdpr_consent=&us_privacy=
1 B
727 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2461256698955117415&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug012:0:288
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2461256698955117415&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 920F
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfzAQAAgcwJuAA4&gdpr=0&gdpr_consent=&_test=YIfzAQAAgcwJuAA4
1 B
809 B
Image
General
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfzAQAAgcwJuAA4&gdpr=0&gdpr_consent=&_test=YIfzAQAAgcwJuAA4
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:25 GMT
X-lat
lhrpug019:0:413
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
via
1.1 varnish
server
Varnish
x-timer
S1619522306.903398,VS0,VE0
x-served-by
cache-hhn4047-HHN
x-cache
HIT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YIfzAQAAgcwJuAA4&gdpr=0&gdpr_consent=&_test=YIfzAQAAgcwJuAA4
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
current
pubmatic-match.dotomi.com/match/bounce/ Frame 920F
0
103 B
Image
General
Full URL
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=605EF0B8-63D4-4571-99B7-A458D04E89AD&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:16::1370 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 27 Apr 2021 11:18:25 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
ptmd
dt.clnmde.com/
70 B
331 B
Image
General
Full URL
https://dt.clnmde.com/ptmd?t=161952229724831650617761_N4IgLgDghiBcDaiCMAaADAXSykAzGCAzAOwBsAHGqQJyEBM5KSaja67bnHKpALN10w58AZzikcAC0lx4dNnSQZhuOHRwBXDWsLlqwgG5wQIHAEsjsRiBFgoYDWIS91dAKxNqykAC8CqEAgAc2MjHABTADtLQNMQIJlYECRSJGo3OkzqYjpeckIUtyokYjIkOLAnZJdqSmJeUnc3cjiDKtIAOjQO3jQ6OKgAGzhCYQBjOABaAPCwMzgUtIysiRswENg2GwBrY0X0zLpqUgB9eTcC92IkJF5qOPCzCD30jty6N6RCDup7iI1-Jp5psIgZhghQJEoABbcLGABGZgAJkjwgAnE7IuJI+wEUCIlHozFIuCRDSDQY4AxmYl7VIHLJuUiEZrEag1EAAX05KEhMLhSQJqIxWJwOLscHxyOFtNgZIpVJpWKS+2WRzczGIbmIaDQxBa3N5IChsIR0qJopA4rxICFFpJcvJlJA1NlyXpavSSHc5AYvtIXJ5fNNgvNIpJYtxkttYdl8udruV7qWh3ShHS5CQvrQ9253hEg1sdJTWRyurig1UsACiYdyYZ6vTzSz8j+IDGjjAbvIAGEAKpuABCABFSABRADqcSCE2rHsyhDQbjuWwAjgKArhgWhOUA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 27 Apr 2021 11:18:26 GMT
x-powered-by
Express
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
image/gif
ptmdP
dt.clnmde.com/
7 B
328 B
Ping
General
Full URL
https://dt.clnmde.com/ptmdP
Requested by
Host: pxlclnmdecom-a.akamaihd.net
URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU5BD6EW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.238.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-238-194.compute-1.amazonaws.com
Software
/ Express
Resource Hash
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Request headers

Referer
https://securityaffairs.co/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 27 Apr 2021 11:18:27 GMT
vary
Accept-Encoding
x-powered-by
Express
etag
W/"7-Jgyp3YpFd/wAt71YECmAdg"
access-control-max-age
1800
access-control-allow-methods
GET,PUT,POST,DELETE,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Bafp-Eg, Bafp-Ec, Bafp-Eg-T, Bafp-Ec-T
content-length
7
SPug
simage4.pubmatic.com/AdServer/ Frame 920F
0
418 B
Script
General
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=158127&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/showad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 27 Apr 2021 11:18:27 GMT
Cache-Control
no-store, no-cache, private
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=7a4684187a2478c1cdbb1d579c9362f3
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=7a4684187a2478c1cdbb1d579c9362f3
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=7a4684187a2478c1cdbb1d579c9362f3
Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=7a4684187a2478c1cdbb1d579c9362f3
Domain
api.rlcdn.com
URL
https://api.rlcdn.com/api/identity/envelope?pid=c2d18b01-4905-4aba-a83e-e41eac932694

Verdicts & Comments Add Verdict or Comment

169 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| google_tag_manager object| dataLayer string| em_version boolean| em_track_user string| em_no_track_reason string| disableStr function| __gtagTrackerIsOptedOut function| __gtagTrackerOptout function| gaOptout function| __gtagTracker object| google_tag_data string| GoogleAnalyticsObject function| ga function| gtag function| __gaTracker object| _wpemojiSettings object| exactmetrics_frontend function| ExactMetrics object| ExactMetricsObject undefined| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| mnetCustomerData function| dynamicallyInjectMnetAdHandlerScript function| injectMnetScript object| _mNHandle string| medianet_versionId object| stlib boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus boolean| sop_pview_logged string| stWidgetVersion object| stLight boolean| st_showing object| st object| __stdos__ function| __sharethis__docReady object| __sharethis__ object| icwp_wpsf_vars_lpantibot object| iCWP_WPSF_LoginGuard_Gasp boolean| cli_flush_cache object| _mN object| _mNSrv function| setup string| _mN_Idf number| _mN_ctr string| _mN_ctrM object| mnjs object| _mNDetails function| _cmL1Require function| _cmL1Define boolean| _mNVideoInjection object| _mNX number| medianetTimer object| _mNadPrvLog object| __twttrll object| twttr object| __twttr object| FB object| gaplugins object| gaGlobal object| gaData object| twemoji object| wp object| WPCOM_sharing_counts object| click_object object| Main object| BrowserDetect object| mejs function| onYouTubePlayerAPIReady function| onYouTubePlayerReady function| MediaElement function| MediaElementPlayer function| $j function| imagePreview object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| _stq function| st_go function| linktracker_init object| wpcom function| _mNRequireX function| _mNDefineX object| displayPlacement_PF_script boolean| pixfuture_environment_started function| init_____display____pixfuture string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed number| eti object| hs string| cp string| pd object| ad_regex string| adod string| sdod string| sdodi number| templateId string| customerId string| noCookies number| cstSmpPer string| dl string| esi_ip string| esi_ua number| staging function| browserfp object| sppx number| bfObjLdCnt string| endTime boolean| isPending string| prebid_file function| findCMP_PixFuture function| pbjs_pixChunk object| pbjs_pix object| _pbjsGlobals object| google_reactive_ads_global_state object| google_ad_modifications number| google_global_correlator object| google_prev_clients object| google_jobrunner

9 Cookies

Domain/Path Name / Value
.pxlclnmdecom-a.akamaihd.net/ Name: bfp_sn_td_2a17fb019fa8803fcc76a437c68e2235
Value: 1619522296_205312571149_2a17fb019fa8803fcc76a437c68e2235
.pxlclnmdecom-a.akamaihd.net/ Name: bfp_sn_t_8b2087b102c9e3e5ffed1c1478ed8b78
Value: 1619522296_205312571149_8b2087b102c9e3e5ffed1c1478ed8b78
securityaffairs.co/ Name: pbjs-unifiedid
Value: %7B%22TDID%22%3A%2209affd61-1009-4498-b9f0-e2daea690cf0%22%2C%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222021-04-27T11%3A18%3A19%22%7D
securityaffairs.co/ Name: _lr_retry_request
Value: true
securityaffairs.co/ Name: _pubcid
Value: ff2a363b-8c9e-48fb-a301-c88d5efb735a
securityaffairs.co/ Name: _lr_env_src_ats
Value: false
.pxlclnmdecom-a.akamaihd.net/ Name: bfp_sn
Value: 1619522296_205312571149
.securityaffairs.co/ Name: _pubcid
Value: ff2a363b-8c9e-48fb-a301-c88d5efb735a
securityaffairs.co/ Name: _pbjs_userid_consent_data
Value: 3524755945110770

38 Console Messages

Source Level URL
Text
console-api debug URL: https://info.silobreaker.com/e2t/tc/MWg6HwwvXVDN6ztkwLxctrlW8_npSB4qW1Z7N1c6srm3hkBGV1-WJV7CgFs-W3Zbh6w5vqdpyW5QhbCc3tlVylW43cGkW3Jfx4lW6MXDM76nstfcN11yrl1L2Z8VW6yQZ5l14D6FkW2sKgYt2RQZStW1kwywv26xrxRW5QXnTK5h89FFW8B-qX57P0wGNN2Nh_20phwKKN13Rf1y_KR47N81NvMKW-r1NW1C7rYt1qJ4z6W4QysV74f-x2kVxgnnP4w_26FW2dJcT270kT4PW8phxz87H6MCCN2B9RJj7Fr9vN7RmrH98k_2xVdSTyl5WdNLWW34B61n2Dhl06W3HHmtK94BC0HW52SH0q6dhLCWW5KWKZt3V5Kv-W5cKw8N52bD5bW8VQXw54KBsbwW8C5JCg6HVwlT3jSx1(Line 13)
Message:
toS
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 69)
Message:
JQMIGRATE: Migrate is installed with logging active, version 3.3.2
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.blur() event shorthand is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.focus() event shorthand is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.load() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.hover() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.isArray is deprecated; use Array.isArray
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.click() event shorthand is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.submit() event shorthand is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.unload() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.scroll() event shorthand is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.trim is deprecated; use String.prototype.trim
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: 'jQuery.easing.swing' should use only one argument
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://cdn.pixfuture.com/hb_v2.js(Line 3)
Message:
CMP IS NOT FOUND!!!
console-api warning URL: https://cdn.pixfuture.com/hb_v2.js(Line 3)
Message:
CMP IS NOT FOUND!!!
console-api warning URL: https://cdn.pixfuture.com/hb_v2.js(Line 3)
Message:
CMP IS NOT FOUND!!!
console-api warning URL: https://cdn.pixfuture.com/hb_v2.js(Line 3)
Message:
CMP IS NOT FOUND!!!
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.isFunction() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.isWindow() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.bind() is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.offset() requires a valid DOM element
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace
console-api warning URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100)
Message:
JQMIGRATE: jQuery.fn.change() event shorthand is deprecated
console-api log URL: https://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102)
Message:
console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
aa.agkn.com
acdn.adnxs.com
ad.turn.com
ad4m.at
ads.playground.xyz
ads.pubmatic.com
adservetx.media.net
adservice.google.com
adservice.google.de
apex.go.sonobi.com
api.rlcdn.com
aud.pubmatic.com
bh.contextweb.com
btlr.sharethrough.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
c1.adform.net
c2shb.ssp.yahoo.com
cdn.pixfuture.com
cdn.syndication.twimg.com
cm.adgrx.com
cm.g.doubleclick.net
cm.smadex.com
connect.facebook.net
contextual.media.net
d5p.de17a.com
dis.criteo.com
dsp.adfarm1.adition.com
dt.clnmde.com
dt6.clnmde.com
eu-u.openx.net
fonts.googleapis.com
google-analytics.com
googleads.g.doubleclick.net
graph.facebook.com
green.erne.co
gum.criteo.com
hbopenbid.pubmatic.com
i0.wp.com
i1.wp.com
i2.wp.com
ib.adnxs.com
id.sharedid.org
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
info.silobreaker.com
l.sharethis.com
lg3.media.net
match.adsby.bidtheatre.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.taboola.com
maxcdn.bootstrapcdn.com
mug.criteo.com
mwzeom.zeotap.com
navvy.media.net
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pbs.twimg.com
pixel-sync.sitescout.com
pixel.quantserve.com
pixel.wp.com
pixfuture2-d.openx.net
platform-api.sharethis.com
platform.twitter.com
pm.w55c.net
pr-bh.ybp.yahoo.com
pubmatic-match.dotomi.com
pxlclnmdecom-a.akamaihd.net
qsearch-a.akamaihd.net
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb.openx.net
s.tribalfusion.com
secure.adnxs.com
secure.gravatar.com
securityaffairs.co
served-by.pixfuture.com
simage2.pubmatic.com
simage4.pubmatic.com
ssc-cms.33across.com
ssc.33across.com
stats.wp.com
sync-tm.everesttech.net
sync.1rx.io
sync.go.sonobi.com
sync.mathtag.com
sync.targeting.unrulymedia.com
syndication.twitter.com
tpc.googlesyndication.com
trc.taboola.com
uipglob.semasio.net
um.simpli.fi
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
visitor.fiftyt.com
ws.rqtrk.eu
ws.sharethis.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
api.rlcdn.com
fonts.googleapis.com
104.108.144.24
104.244.42.136
13.224.111.76
142.250.186.162
142.250.186.66
151.101.114.49
154.59.122.79
159.253.128.188
159.65.197.210
169.197.150.7
178.162.133.149
178.162.133.150
178.250.0.157
178.250.0.163
18.133.35.94
18.156.0.31
18.195.177.11
185.29.133.199
185.33.221.91
185.64.189.112
185.64.189.114
185.64.189.249
185.64.190.78
185.64.190.80
185.64.190.81
185.86.137.110
192.0.76.3
192.0.77.2
193.0.160.129
198.148.27.140
199.232.137.44
199.60.103.2
2.16.186.67
2.18.232.130
2.18.233.180
2.18.235.93
2001:678:cb4:bbbb::11
2001:8d8:100f:f000::289
213.155.156.168
213.19.147.44
23.32.238.131
23.62.140.165
2600:9000:20c8:7200:c:abe:f440:93a1
2600:9000:20c8:8000:3:c04e:c780:93a1
2600:9000:20c8:bc00:1c:8a07:5e80:93a1
2600:9000:20c8:d800:c:a9b7:ddc0:93a1
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:10::ac43:db6
2606:4700:20::681a:bd1
2606:4700:20::ac43:4671
2606:4700::6812:bcf
2606:4700::6812:d05
2620:116:800d:21:5a23:9c4e:e774:96c1
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1288:110:c305::8000
2a00:1450:4001:800::2002
2a00:1450:4001:803::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:811::2002
2a00:1450:4001:811::2004
2a00:1450:4001:813::2008
2a00:1450:4001:82b::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::200e
2a02:2638::1c
2a02:fa8:8806:16::1370
2a03:2880:f01c:800e:face:b00c:0:2
2a03:2880:f01c:8012:face:b00c:0:3
2a04:fa87:fffe::c000:4902
3.122.26.231
3.122.57.214
3.127.88.255
34.102.149.62
34.200.78.134
34.251.173.19
34.98.107.212
34.98.64.218
35.157.246.167
35.186.253.211
35.201.96.126
37.157.6.241
51.75.146.159
52.2.238.194
52.208.69.189
52.209.246.140
52.35.237.254
52.51.173.5
52.57.230.211
63.251.232.170
66.155.71.150
67.202.110.23
68.183.31.14
77.243.60.138
85.114.159.118
87.98.128.108
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
052c3758457b2abb2b7bd45b689f01539224b55711adb21fe74900e46c05c1b5
05e5f220a85ec07d4e923a8ba2c348b4fd63a88859526594e1e080659814a3a5
064cb9385a8624022be834ed02c72dbd81a40d6d23c4869a31e962b71e9ff05b
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
097ff5abf1b173df0136910cfdf6d91972114b236ee79bece66454ff1efe4be4
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0a9165c4937548f326c7645147ebcaf8db5b7ac785be183777faba05ebed39d6
0ab269f8658efd475e4074334f27c5140c558bb4133488c38855ff21c26e6519
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0cdc6e956294d2e2352f1c0a62b2ba989108b6e04338e0d24a14b452335697a6
0de58cb8983c30b1af8a59db4ad7cdb59a77933ac003ddb55005554115eee5ff
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
120e20231af224a0e57b733f1626d69d3d35a080eee8e341b202f4aa3fa33e7c
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
144bf8fa1ed44cf8536d60c5ff4a34d5482161a976b3b100663b6a165f27beec
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1993569ff040835df84202bc0ac9a9b0162f0c6d7fd10cc6108f4d3202a3411f
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1b11f2c81cddaa0d12147ff5fbecdec023a921b64088411da37f81915b8b4b40
1cc9f1b710b66cc709f285876aea76f3b4bba684114a51a5454de52d0ab53f36
1f2061d1369363691d5fd23795c4d91c6f88edddda1e6beec14cf824a4f45345
1ffc2b137c2505247b353f0906f6928b7f38a6e23365a5340006e34bc7634382
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
23ab24068005cf42a22a5196da7fbc74827d5f60a6d537a7909ed80d16a0e07a
240c0dd6c0dc6775702a4c436f4e1db94c533e7e83ce346fd93bf26b7d2f56df
29e81df2e6a12f9a88533c12d164d616714579f8e1b9f059dba1e9f5c56a8ead
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2ed8c54f0caceb98b619e37178c2a8c5e8ba731d31b7d62c8d01b3a2770e3d23
2f03a0fce12e515a3318277bd9f8ecfc043ae01f232e018c1a317d11abd30282
30b2b5ab9321d17dfd840a476719b420adf4891c0389c2129717e1d3b8f3a07d
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347
33938ee3fe7dbc6101db61d8597f832b0ca164ebc25e6734acb5fedef900f84f
34ce52b168df48076692a035a102d06407c39c9568772987f586f05a8c56f385
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
36e02a28249d89da88030611b1fc17b5cbff522a8f0a95b3721805e5c8b6c458
38c288b893b166348ca23e242921ba2f260e3444cb2027e0c844304a894f0bbe
39474cc8e88ee91fb383bbe856d0b6c1a579ec557351fe3f2b48f31fc3be31b0
3989516825e0741c92fa6c67f38e44239e1f6d93becc7d39d8e224a0b9a9230d
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
40bc46248d8f8d5fbea7678bd0c0031327e206daaf99f3bf6723b9a70f665f7f
438c1d56d29b52caa642e07fba1d58fd6b74e5462959ccad09f0b1131c79829b
439ab67fa3c312bb442bed574ea79be834dbd92f3bd7d2288b6f3fce4d0afb0c
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
456910543c2e9ce455f37cc1baea1aa87f54e959a327717a055442b43953d66a
4634b94630896f1a23c5ce01f743d720847c5f4dd28fb549ed503cb2df4f8e87
474776eb17d0e4ca038f4994076ede6f4017ecdf91eff0d3d074c3b7bb6a5a97
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4c1f9a8c62c06c10300bb008f0ea06d0451df268662d7f97545c2c3b48d5ec04
4c6b4ef22f4c5dd8fd6e17ab6706d8c55d236824c20b3d8dcd310f7de744def6
4cdecc62f5b2c8e9f7cf7b14b9fd42e0c4787d912c1b71426cdfbe0144cede46
4d3858fd6875118f687ea5fd972b3e88f1cbec0b84539bfe33585b6ea282af27
4d8630043c804695825ad3c6c60b41d9150da761a6be49279284ba87b43f8943
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4f556e6dcd6db86ce3ff56602776728fe931ed954a51e43f9be28dfea091f27b
501ed6f37588ea4083347c8c1b9fd9bfbc560f8f9977aa2847749e0977063f6c
508a8b73dfefe6e9998cca8a66aef5f7b9b5a8b24b35ae0e6e8a02f37d4a2c93
516442279e5c3a73f7c76bd737a2041170ab522f7cac591dd5ce68cba05c3f9b
5380b726c841b4b99b09a4ac9fd0f79d2d41b1a5742aa572c4f5f999d3bbf0b7
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
5bdc333309db55d266aa2ae9a439d940399e1d843c91f6155b87a3b8095120a5
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74
5cf118e6f30d488d438172ad5d9b103700dfef7681c1dc405674d21d295d3d37
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3
6251b4b4525b9007511a48a6cda9a168f07ff77ccc4dd75759486af624a13301
641c9502f6f057a197d9789f59f3390916d07d5e0edf5a307dd67cd754d74fb2
650868ebc4c00b2ea4ea72747f655f8a0552ba53c9b5b55defd9457be75f1aa9
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a
675b45306cade1b57845cf6cab7e45f6c186949815f7eb7cb3078dff766513e9
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
69d6e2037b85dfa5cbb86bd06d71c8134a27d3a7f55d70c24bb45099d0bd1571
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c4e5b013fca4f66b566c8c6b036fc2423c82a426bab0753134ec995e62ad679
6ca1e65bd25dd4247cf00bfdf1ebecc1d021c0ff2dd546e5fb8ca6edc73c7346
6d295e91ed4fa70edc4008a2e4e0ef1ab329f81feee29097691744d9895ed360
6eecd264fecac0f3baa1c6514ba5c2b44557158f352515de6e803656ed979948
6f83d6d161d5d98ac0a6305e882cbf211c330178f30bac4095f967b5475c0e92
7014d55ece110a38ebbf87acfe487f95f1b78a9575a12291da5463ec13d1074f
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
76d35c700a1d819d2ab5bdeeaa17c7e4a2291f5ca1bdfafa6398e8bd49ad943a
76f434fcf8e5fef0f5b0ec5c88907b9202caa133a7f2b224dcc95c9c2fd39d22
78a2c9f2dce8aa318ebbcbea82b64c926f5415fc085cbf05226d783cf6919a92
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
800cc6f76e053ece29647974c1a229508463db5017d841cdec7ba5ec7d396d00
815b535e0883ba9b247dc7f4c38b1c191ec799fa44b587d86126a5722405da36
82f1fbe95dbd4e1128a973db542bf50ab7ac8fbf35bfefca2e782b0a0572e564
85c45aac951a3920e5884ede0f38fff5e2ec09e820e763765ba3ced1c159e175
86f937a29eaee70aaf9935799a414bea46c62fb136cc0465f63f9d6820cf4982
88439e057d6f2cea06eb1cf5fa51382fe8d9656581737de141c04aed92bc2f17
88f04831d85910e359a49cfe0d2edcf51289dc52273ca75c5374eecd7c601248
8c2d5dbb5a6910cb00918521f6d4ca582293596387400ddeee9daf50bd771a17
8c8c2e3e0af8248c66e02fd3901558e969a7b0f35cf1fe0da4872e01f77e2ebd
8d4570b2b8803c64031c94f91a07cae12023846878b51161251d92553f63f6a7
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
90c9c545b067e4bca12f881cc9a8884a47626c29b1a8770c05bc03de4defc29d
9643378d0de9a9e186c9148a2b31c554615ef6e7e4bb8e2137008c42f6660b48
99b18d9efbee1415f204f8d1a7b87c1dd213beafe9adfc3bdf00b7938d447993
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a
9c3e46acc558842843584b7618dc8418cee95aeb5c9e98eae29fd2d379604eb1
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5c96c91c4ab2c0572ec8371c0f49d9f722eb71ae47224f29eabadf59f5fabe8
a5cb642ef22434a24612329870579fbb272cb9fa7475360035596ea56fb0431a
a65012694be912cc64f8dd5931d6c5e2170b5becaa24e4145153b67267395c9e
a82fb0df229ab511ba5e585874443b97a62bfbd76c369a6944ed9e0750ebf698
ac0271c0baa09b72774a933539b0a0c6dc0497a2ccc9ff2f7a045b4ee0222316
ac84513c4c5ea7e4458e91c46e33ba71b56e19fabf93cc079ffcb01a975c2e3d
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae49b391a9533843055fe35edb45acf2eae13eb607fc3449c1f80323c7e4c273
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
af62727dc358a15c36620483f006a59a2e344e329763126932e7157a73620155
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc
b03511f3e0771658bf172f4ede71ce85d15ff8ccb7af3cdea0dd3e60ea0ff512
b076a74ccff513583dd5f97e03e4a9be228964cdb3186ea3b8e77f979ddc1a45
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b26d782d43592764b4638a4b605300848539a14adb2495340f5ac12c0e6aee51
b2b7f8d3f7fccfacd0344799b159a67cc2ad569a503ede790773a9a857411a2c
b7387d4c7ecb9d2443950a8ca1f318b2666d1c3e1bc727a9b955ea69a7e3c50e
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80
b97d80b9eedfeb29936f0d7f89afbdd425ef8d930d09fa1f98030ceb8b26cabd
ba5d4ad2291eb8531da85d9f1f58db9e7e78bae8515efb10c52ad65cc3deaec6
ba716187f8cc8c54806f5b9de46d1d94bec574ddf31c82f68532cd181e242b7f
bc1e0462ef5111f5dffc2c78abc3f4fd40ee735b7595d4dd212337d26f0007b7
bc29c34d0738c5cb3f96585219667566799d9e142699e982f9406d5b04fa9794
bf16e6ade9d4222955aa5451361fa645183c42b3f525ddf73f4f27178f43c8ce
bf69a04d849896ab74ab589a4ff019d93cca4c7735748e31aec8620e7e48758b
bfa21f286e3bc68b8a86de420a49b5b1e45321fd241004a6b35dba7ff807c1ce
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
c414cd0e204de974f73753c7e28d7638e7b3691bb8b1a2bab6b25bb7fed7ce77
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c683924ef457e6a840aaea2cccafe8fa49da504e7e2d990aa59f59205ddbe510
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
c8817bacfc84fd39e4daec4096011ed3d117c7fe8b3c55fdd22af47c299099bc
cd89793d4187a24ac1bd06f10b9e2b7ac586973a9b4efe4830bdde5096b44b95
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
ced34f591157438ef47695f979ac95f8758408e8d9b88e63aee8b382ec975785
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d18c6d6e59f6af6b08174e8d3d0ed661b985715fe3949c4170a0af1546995b79
d27910197214323c01182b91f3674aafd20260f85ab8ef54b6358be6e453ca8e
d490f2efc64637640a21c5282a89dd22344e58974641bc7bbbfa4c7e4dc8648e
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d76c09ea49a67623c581149d87ec821d813b9302aea4f871df16156cd1d28a53
d7926a6fbca4745b90dcce9532cae06d4c4c6bfc3c6bf634cb30b6dbce23cf76
d8e21f9d683d7086b778d75d17252cc0dc3296a258b2487c29bae2680663b084
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
d9ac862518df3efb07d7cecda391ab683489cf26fa04d62e179ba60869dd69bb
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddc78e9e2feea12596546c5e257470607ea6f7f237a87578e160e11dc237e41a
e18842300c8239d22719f8161d7ad518fa927d037998280965b2c248dcff7998
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6
e79e6faa3cd5efeb8e62b036549ade82272b2ad89c2e7cbb490cdea7c88a6504
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
e98cd00e7be004c4360ad0c38471911312d74a117babcc29f239935afc80c8cb
e9f3358441fb5f83ee3575f81df787bbade8b416b009cbdcbd3b71c8b6f560e0
ec9b8a887b3978ba0236efa75a01b4263ee187cb35a760ac8693155e102ffd9b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4d4eda42f85c6ccbbb5de2aff596085b3b1d380c8585464f2e53df2cad66f8e
f6104ebb4af3aea3497aca400434c903afad22ec84e5f74910665ae72a25890f
f76b46135fa81747d8b937a43278410e8d9e322e78190b1cd17cf838d9766dec
f8284365ba340253ee9c71cfb5efcc37f10a23e8b8b5dd134ec7bbab05073845
f9552fd4fdded6f095a9d4953389e0e9b116fe4b2eaeee7c4fb8b10bb48b8480
f9bd7f14c93030136ee29d6da6e45317acec75c6b878fc2305842af6fe4e06d5
fa7c2db6bad4dc8040c7ac9f9ba9966750660e29addaf9b95b65b2ce97ad02f9