heise.de

[casaper]

Suggested filter:

Code: Select all

! 9/16/2018, 6:15:11 PM heise.de
||heise.de/avw-bin/ivw/CP/barfoo/ho/*/*.gif?d=*$image,domain=heise.de

Site with the pixel:

Code: Select all

https://www.heise.de/newsticker/

CURL of the request for the pixel:

Code: Select all

curl 'https://www.heise.de/avw-bin/ivw/CP/barfoo/ho/4147629/0.gif?d=1878527336' -H 'Pragma: no-cache' -H 'DNT: 1' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,de-CH;q=0.7,de;q=0.6' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.183 Safari/537.36 Vivaldi/1.96.1147.64' -H 'Accept: image/webp,image/apng,image/*,*/*;q=0.8' -H 'Referer: https://www.heise.de/newsticker/' -H 'Cookie: POPUPCHECK=1537200949946; wt3_sid=%3B288689636920174; __gads=ID=42ddd80554618f3b:T=1537114550:S=ALNI_MYvgfCoiol8yb7wxVmcoy3uXTHgyg; _cb_ls=1; _cb=D7QeApBnbFVfDrRNH2; _cb_svref=null; _chartbeat2=.1537114550909.1537114613651.1.BIdw6bQyTbCDITNFFD2NYvqnz510.5; wt3_eid=%3B288689636920174%7C2153116021821122532%232153711461866772506; wt_rla=288689636920174%2C12%2C1537114550381; _chartbeat4=t=C0fJgACYQtMKCJ897e8yRYbB52-jp&E=0&x=0&c=0.08&y=13653&w=909' -H 'Connection: keep-alive' -H 'Cache-Control: no-cache' --compressed

The image is a gif 1x1 px in size. So no doubt what it's about.

The inline script placing the tracking image:

Code: Select all

                <script type="text/javascript">
                <!--//--><![CDATA[//><!--
                    (function (){
                        var AVW = '<' + 'img id="avw_pixel_intern" src="/avw-bin/ivw/CP/barfoo/ho/4147629/0.gif?d=_ORD_" width="1" height="1" alt="">'.replace('_ORD_', Math.floor(Math.random()*1000000000)+1000000000);
                        document.write(AVW);
                    })();
                //--><!]]>
                </script>

Have got to ad another 1x1 px image that seems to be tightly related to this

Code: Select all

||heise.de/ivw-bin/ivw/CP/newsticker/$image,domain=heise.de