www.bleepingcomputer.com Open in urlscan Pro
104.20.59.209  Public Scan

14 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

• https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
• https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en

Request Chain 105

• https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1584518990144&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c8=&c9=&cs_ucfr=0 HTTP 302
• https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1584518990144&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c8=&c9=&cs_ucfr=0

Request Chain 134

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978

Request Chain 135

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978

Request Chain 136

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978

Request Chain 137

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978

Request Chain 138

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978

Request Chain 139

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978

Request Chain 140

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978

Request Chain 141

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978

Request Chain 142

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978

Request Chain 143

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978

Request Chain 144

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978

Request Chain 145

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978

Request Chain 146

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978; HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978

Request Chain 158

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978

Request Chain 159

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978

Request Chain 160

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978

Request Chain 161

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978

Request Chain 162

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978

Request Chain 163

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978

Request Chain 164

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978

Request Chain 165

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978

Request Chain 166

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978

Request Chain 167

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978

Request Chain 168

• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 HTTP 302
• https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978

Request Chain 274

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 278

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 317

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

Request Chain 318

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 319

• https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
• https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 320

• https://eb2.3lift.com/sync HTTP 302
• https://eb2.3lift.com/sync?&ld=1

316 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
11 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/	76 KB 17 KB	3986ms 3958ms	Document text/html	104.20.59.209 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.59.209 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f5d2381219db638b88a48a530561445f311455bef53c8177387bfb3711f4cd64 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.bleepingcomputer.com :scheme https :path /news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Wed, 18 Mar 2020 08:09:45 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dcbf4c1168f33344802a208c4dac580061584518985; expires=Fri, 17-Apr-20 08:09:45 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; SameSite=Lax; Secure session_id=345913c9a0c58f1ff3f91bc2623538e0; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=7935; expires=Fri, 17-Apr-2020 08:09:45 GMT; Max-Age=2592000; path=/;Secure content-security-policy upgrade-insecure-requests; x-frame-options SAMEORIGIN cache-control no-cache, no-store, must-revalidate pragma no-cache expires 0 last-modified Fri, 13 Mar 2020 13:29:51 GMT vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 575d7928cc2bbdd7-AMS content-encoding br
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	16ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2dda7ea92135dcf21660d4d79391d303fc38f6a6524ae74bbe2986f1d2e990d5 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 08:09:49 GMT server ESF date Wed, 18 Mar 2020 08:09:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 08:09:49 GMT
GET H2	200	bootstrap.css www.bleepstatic.com/css/redesign/	111 KB 17 KB	95ms 40ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/bootstrap.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e7c74d95df84ef3a6be5c4fcde54fae313a04a9bd611059e6a97a23ff09f26f Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 1563454 cf-polished origSize=137522 status 200 cf-bgj minify last-modified Fri, 23 Sep 2016 14:33:06 GMT server cloudflare etag W/"2184297232" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79423bdae5a7-MAN expires Sat, 04 Apr 2020 05:52:15 GMT
GET H2	200	main.css www.bleepstatic.com/css/redesign/	51 KB 9 KB	91ms 36ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c9e727b37a735a7983ea8bdad06a38b246261c239bb80b86cc0ff3663c910adb Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 4126 cf-polished origSize=60842 status 200 cf-bgj minify last-modified Thu, 16 Aug 2018 15:28:40 GMT server cloudflare etag W/"4249134023" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79423bdee5a7-MAN expires Thu, 15 Aug 2019 16:08:29 GMT
GET H2	200	home.css www.bleepstatic.com/css/redesign/	12 KB 3 KB	112ms 57ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/home.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3498f138f5418bd58413e79e4c0969e618d6f2fee2d9d98c0f4e70a6cbd04ad Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 5791 cf-polished origSize=14998 status 200 cf-bgj minify last-modified Sat, 24 Mar 2018 16:18:00 GMT server cloudflare etag W/"2402535603" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79423be0e5a7-MAN expires Thu, 15 Aug 2019 16:08:14 GMT
GET H2	200	news.css www.bleepstatic.com/css/redesign/	27 KB 5 KB	90ms 35ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/news.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d44b93a0af159f0d547d7ec89e9227a5667ce1171bc630e6fbf79dae0e596e2d Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 4726 cf-polished origSize=32905 status 200 cf-bgj minify last-modified Tue, 26 Nov 2019 02:56:16 GMT server cloudflare etag W/"400467278" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79423bdce5a7-MAN expires Fri, 03 Jan 2020 17:52:02 GMT
GET H2	200	jquery-1.11.1.min.js Show response www.bleepstatic.com/js/redesign/	94 KB 32 KB	96ms 42ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT last-modified Thu, 23 Apr 2015 12:36:44 GMT server cloudflare age 1474919 etag W/"3647451394" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 575d79423be2e5a7-MAN access-control-allow-origin * expires Sun, 05 Apr 2020 06:27:50 GMT
GET H2	200	news.js Show response www.bleepstatic.com/js/redesign/	183 B 533 B	89ms 34ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/news.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 2180 cf-polished origSize=247 status 200 cf-bgj minify last-modified Wed, 16 Dec 2015 15:41:46 GMT server cloudflare etag W/"4218930423" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79423be3e5a7-MAN expires Thu, 15 Aug 2019 16:08:14 GMT
GET H2	200	connatix.renderer.infeed.min.js Show response cdn.connatix.com/min/	957 B 1 KB	27ms 7ms	Script application/javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 45a3f5d0135ab059ea2ad9f75b800440db8c2c98ae88afacf19cd3366a71f010 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT via 1.1 varnish server Varnish age 0 x-cache HIT content-type application/javascript status 200 x-referer-host bleepingcomputer.com cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1584518989.113894,VS0,VE0 content-length 957 retry-after 0 x-served-by cache-hhn4064-HHN
GET H2	200	qc-consent.js Show response www.bleepstatic.com/js/qc-consent/	3 KB 1 KB	57ms 54ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/qc-consent/qc-consent.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 1456418 cf-polished origSize=3848 status 200 cf-bgj minify last-modified Thu, 07 Feb 2019 13:49:44 GMT server cloudflare etag W/"3981350888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d7942ad3ce5a7-MAN expires Sun, 05 Apr 2020 11:36:10 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	75 KB 28 KB	16ms 14ms	Script application/javascript	2a00:1450:4001:800::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 025e7e180ec38cee031546ed3a613dc266575a90fb028db4572236863b185c70 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br status 200 strict-transport-security max-age=31536000; includeSubDomains alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 28648 x-xss-protection 0 last-modified Wed, 18 Mar 2020 06:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 18 Mar 2020 08:09:49 GMT
GET H2	200	logo.png www.bleepstatic.com/images/site/	1 KB 1 KB	31ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/logo.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 483099 cf-polished origFmt=png, origSize=1882 status 200 content-disposition inline; filename="logo.webp" cf-bgj imgq:85 content-length 1152 last-modified Sat, 04 Mar 2017 04:12:00 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ad3ee5a7-MAN expires Sat, 11 Apr 2020 17:58:10 GMT
GET H2	200	brand Show response cse.google.com/coop/cse/ Redirect Chain https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en	3 KB 2 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:816::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software pfe / Resource Hash 4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 07:59:38 GMT content-encoding gzip x-content-type-options nosniff server pfe age 611 x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control public, max-age=1800 content-disposition attachment; filename="f.txt" alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 1181 x-xss-protection 0 expires Wed, 18 Mar 2020 08:29:38 GMT Redirect headers date Wed, 18 Mar 2020 08:09:49 GMT x-content-type-options nosniff server sffe location https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 266 x-xss-protection 0
GET H2	200	Coronavirus4.jpg www.bleepstatic.com/content/hl-images/2020/03/12/	158 KB 159 KB	41ms 39ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2020/03/12/Coronavirus4.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e9a167b532caeaa3c48944f4f4530e984b6ec39768230357def63aa1b495ec99 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 173148 cf-polished degrade=85, origSize=191071, status=webp_bigger status 200 cf-bgj imgq:85 content-length 162089 last-modified Thu, 12 Mar 2020 15:10:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ad40e5a7-MAN expires Wed, 15 Apr 2020 08:04:00 GMT
GET H2	200	fake-wisecleaner-site.jpg www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/	87 KB 87 KB	36ms 33ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/fake-wisecleaner-site.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4561c146bea153c201042b8e4cfeb8210742b15593d1215e4f3bc0118f156a17 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 173148 cf-polished qual=85, origFmt=jpeg, origSize=199479 status 200 content-disposition inline; filename="fake-wisecleaner-site.webp" cf-bgj imgq:85 content-length 88794 last-modified Thu, 12 Mar 2020 15:14:42 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ad41e5a7-MAN expires Wed, 15 Apr 2020 08:04:00 GMT
GET H2	200	downloaded-files.jpg www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/	35 KB 35 KB	57ms 55ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/downloaded-files.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0deb6e6fdc2f68c2d234afd645de88e99b8c3c136e37813fa3faa7a8606077a Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 173148 cf-polished qual=85, origFmt=jpeg, origSize=71918 status 200 content-disposition inline; filename="downloaded-files.webp" cf-bgj imgq:85 content-length 35454 last-modified Thu, 12 Mar 2020 15:14:42 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ad44e5a7-MAN expires Wed, 15 Apr 2020 08:04:01 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	106 KB 38 KB	27ms 25ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1aed87072b3ad1e8bede086e65fddd450a76628f35c7c6e3e14bac16ebd2d50d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 38653 x-xss-protection 0 server cafe etag 3682008271491073185 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 18 Mar 2020 08:09:49 GMT
GET H2	200	twitter.png www.bleepstatic.com/images/site/login/	282 B 447 B	31ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login/twitter.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 552593 cf-polished origFmt=png, origSize=475 status 200 content-disposition inline; filename="twitter.webp" cf-bgj imgq:85 content-length 282 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ad45e5a7-MAN expires Fri, 10 Apr 2020 22:39:56 GMT
GET H2	200	bootstrap.js Show response www.bleepstatic.com/js/redesign/	44 KB 10 KB	34ms 32ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bootstrap.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e5e0f326458e8b8ed839d42a0cf6892df80bf26d7dc7e4f8276a65c41582ab85 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 1389621 cf-polished origSize=65813 status 200 cf-bgj minify last-modified Thu, 23 Apr 2015 12:36:43 GMT server cloudflare etag W/"3930092018" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d7942ad46e5a7-MAN expires Mon, 06 Apr 2020 06:09:27 GMT
GET H2	200	blazy.min.js Show response www.bleepstatic.com/js/blazy/	5 KB 2 KB	34ms 34ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/blazy/blazy.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT last-modified Thu, 16 Aug 2018 21:06:19 GMT server cloudflare age 1474919 etag W/"753357888" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 575d79427cb7e5a7-MAN access-control-allow-origin * expires Sun, 05 Apr 2020 06:27:49 GMT
GET H2	200	bleep.js Show response www.bleepstatic.com/js/redesign/	3 KB 765 B	57ms 54ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/bleep.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 4126 cf-polished origSize=3600 status 200 cf-bgj minify last-modified Mon, 01 Oct 2018 12:47:57 GMT server cloudflare etag W/"2696894447" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d7942ad47e5a7-MAN expires Thu, 15 Aug 2019 16:08:15 GMT
GET H2	200	jquery.fancybox.js Show response www.bleepstatic.com/js/redesign/fancybox/	31 KB 9 KB	40ms 38ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 2180 cf-polished origSize=48706 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"327140449" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d7942ad48e5a7-MAN expires Thu, 15 Aug 2019 16:08:09 GMT
GET H2	200	fixto.min.js Show response www.bleepstatic.com/js/fixto/	8 KB 3 KB	36ms 36ms	Script text/javascript	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/fixto/fixto.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT last-modified Sat, 13 Jun 2015 21:34:42 GMT server cloudflare age 5791 etag W/"1740214911" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=3024000 cf-ray 575d79427cb8e5a7-MAN access-control-allow-origin * expires Thu, 15 Aug 2019 16:09:18 GMT
GET H2	200	addthis_widget.js Show response s9.addthis.com/js/300/	349 KB 113 KB	106ms 30ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s9.addthis.com/js/300/addthis_widget.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Tue, 21 Jan 2020 20:57:37 GMT server nginx/1.15.8 etag "5e2765c1-57446" vary Accept-Encoding x-distribution 99 content-type application/javascript status 200 cache-control public, max-age=600 date Wed, 18 Mar 2020 08:09:49 GMT x-host s9.addthis.com content-length 114924
GET H2	200	pubfig.min.js Show response a.pub.network/bleepingcomputer-com/	440 KB 117 KB	45ms 28ms	Script application/javascript	2606:4700:20::681a:8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/bleepingcomputer-com/pubfig.min.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a2539dc15986b9b35d8bfb45cd0afd56f1a946f18d21e7da3bd8193bb55109e3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 17 status 200 x-guploader-uploadid AEnB2UrXgNm0OKSMsZtBb02mfh5p1wXdAzHSNMhM2R63CnpngVbC5s55KUONWf1X1KXAV3XPxz9m7YiYcJq03wHM6Bd9mhlzDA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity last-modified Tue, 17 Mar 2020 22:05:15 GMT server cloudflare etag W/"f08464270a5460e6b9ae203ad0c9057a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=AN1klA==, md5=8IRkJwpUYOa5riA60MkFeg== content-type application/javascript x-goog-generation 1584482715941725 cache-control public, max-age=1800 x-goog-stored-content-length 450302 cf-ray 575d7942b9030ebb-FRA expires Wed, 18 Mar 2020 08:10:32 GMT
GET H/1.1	200 OK	fab.js Show response ecdn.analysis.fi/static/js/	4 KB 2 KB	132ms 37ms	Script application/javascript	212.71.236.117 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://ecdn.analysis.fi/static/js/fab.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 212.71.236.117 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS nb-212-71-236-117.london.nodebalancer.linode.com Software nginx/1.12.2 / Resource Hash affd87461f2babd57a2f7aec75e9193e8e71a377e8249a02c95a5f43326e289e Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 08:16:02 GMT Content-Encoding gzip Last-Modified Wed, 15 Jul 2015 00:00:00 GMT Server nginx/1.12.2 ETag "55a5a280-560" Content-Type application/javascript Cache-Control max-age=3600 Connection close Content-Length 1376 Expires Wed, 18 Mar 2020 09:16:02 GMT
GET H2	200	login_bg.png www.bleepstatic.com/images/site/	126 B 376 B	34ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/login_bg.png Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 488313 cf-polished origFmt=png, origSize=187 status 200 content-disposition inline; filename="login_bg.webp" cf-bgj imgq:85 content-length 126 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942bd5ee5a7-MAN expires Sat, 11 Apr 2020 16:31:15 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1725763 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 31 Jan 2020 00:50:19 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 4087170 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11020 x-xss-protection 0 expires Sat, 30 Jan 2021 00:50:19 GMT
GET H2	200	connatix.renderer.infeed.min_dc.js Show response cdns.connatix.com/p/1911/min/ Frame 4883	725 KB 191 KB	8ms 7ms	Script application/x-javascript	151.101.114.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Requested by Host: cdn.connatix.com URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 180ef002784b30cbe662cc5e8cde9b65da0adca8a993371fbb9bfa9a990182e4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip age 565550 x-cache HIT, HIT status 200 content-length 194812 via 1.1 varnish, 1.1 varnish x-served-by cache-dca17731-DCA, cache-hhn4064-HHN last-modified Wed, 11 Mar 2020 19:03:09 GMT x-timer S1584518989.228968,VS0,VE0 etag "ff3bcb0ad90321a624e17d47c9d54127" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31557600 accept-ranges bytes x-cache-hits 1, 171326
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	nav_bg.png www.bleepstatic.com/images/site/	72 B 257 B	37ms 36ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/nav_bg.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 549219 cf-polished origFmt=png, origSize=83 status 200 content-disposition inline; filename="nav_bg.webp" cf-bgj imgq:85 content-length 72 last-modified Sat, 04 Mar 2017 07:57:02 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942cda3e5a7-MAN expires Fri, 10 Apr 2020 23:36:10 GMT
GET H2	200	20x20-printer.png www.bleepstatic.com/images/site/	422 B 698 B	31ms 31ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/20x20-printer.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 485188 cf-polished origFmt=png, origSize=824 status 200 content-disposition inline; filename="20x20-printer.webp" cf-bgj imgq:85 content-length 422 last-modified Sat, 03 Oct 2015 03:18:32 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddb3e5a7-MAN expires Sat, 11 Apr 2020 17:23:20 GMT
GET H2	200	calendar.png www.bleepstatic.com/images/site/	86 B 455 B	30ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/calendar.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 482380 cf-polished origFmt=png, origSize=129 status 200 content-disposition inline; filename="calendar.webp" cf-bgj imgq:85 content-length 86 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddb9e5a7-MAN expires Sat, 11 Apr 2020 18:10:09 GMT
GET H2	200	clock.png www.bleepstatic.com/images/site/	252 B 415 B	31ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/clock.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 2369894 cf-polished origFmt=png, origSize=1316 status 200 content-disposition inline; filename="clock.webp" cf-bgj imgq:85 content-length 252 last-modified Fri, 29 May 2015 07:08:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddbae5a7-MAN expires Fri, 20 Mar 2020 21:51:34 GMT
GET H2	200	comment-light.png www.bleepstatic.com/images/site/	96 B 265 B	31ms 30ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/comment-light.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 1759533 cf-polished origFmt=png, origSize=1034 status 200 content-disposition inline; filename="comment-light.webp" cf-bgj imgq:85 content-length 96 last-modified Fri, 29 May 2015 07:08:28 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddbce5a7-MAN expires Fri, 27 Mar 2020 23:24:16 GMT
GET H2	200	32x32-printer.png www.bleepstatic.com/images/site/	256 B 425 B	32ms 32ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/32x32-printer.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 483442 cf-polished origFmt=png, origSize=618 status 200 content-disposition inline; filename="32x32-printer.webp" cf-bgj imgq:85 content-length 256 last-modified Fri, 02 Oct 2015 21:57:19 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddbde5a7-MAN expires Sat, 11 Apr 2020 17:52:27 GMT
GET H2	200	21beb902b545b086a90ec39f1df36b94.jpg www.bleepstatic.com/author/photos/	7 KB 8 KB	29ms 29ms	Image image/jpeg	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/author/photos/21beb902b545b086a90ec39f1df36b94.jpg Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19e1dbba639ba68ceb71cdada9621e11d0aec6edba410971f1937d6cc4935b32 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 5762 cf-polished origSize=7617, status=webp_bigger status 200 cf-bgj imgq:85 content-length 7581 last-modified Mon, 26 Oct 2015 17:15:33 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddbee5a7-MAN expires Sat, 10 Aug 2019 16:08:16 GMT
GET H2	200	before-bg.png www.bleepstatic.com/images/site/	116 B 509 B	31ms 30ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/before-bg.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ee9b2fe75e3a5637b840957e2f9aefedb394224a1846a731ad7ead76abf91d58 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 487718 cf-polished origFmt=png, origSize=1026 status 200 content-disposition inline; filename="before-bg.webp" cf-bgj imgq:85 content-length 116 last-modified Fri, 29 May 2015 07:08:06 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddc0e5a7-MAN expires Sat, 11 Apr 2020 16:41:11 GMT
GET H2	200	news-icon-01.png www.bleepstatic.com/images/site/	240 B 407 B	36ms 35ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news-icon-01.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a1af15b17fd7099b2d3a81a8b3aeffd94b26d2c1a58489c3903e11ec5a4896d3 Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 550015 cf-polished origFmt=png, origSize=1204 status 200 content-disposition inline; filename="news-icon-01.webp" cf-bgj imgq:85 content-length 240 last-modified Fri, 29 May 2015 07:09:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddc1e5a7-MAN expires Fri, 10 Apr 2020 23:22:54 GMT
GET H2	200	link-icon.png www.bleepstatic.com/images/site/comments/	494 B 660 B	32ms 31ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/comments/link-icon.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ef3d32ea9a9fa05f8170d164890b55e15ce39157bb9ae7e96b047c1996d22a8b Request headers Referer https://www.bleepstatic.com/css/redesign/news.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 548469 cf-polished origFmt=png, origSize=787 status 200 content-disposition inline; filename="link-icon.webp" cf-bgj imgq:85 content-length 494 last-modified Fri, 25 Sep 2015 17:29:04 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddc2e5a7-MAN expires Fri, 10 Apr 2020 23:48:40 GMT
GET H2	200	h4-bg.png www.bleepstatic.com/images/site/	38 B 177 B	29ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/h4-bg.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339 Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 552366 cf-polished origFmt=png, origSize=72 status 200 content-disposition inline; filename="h4-bg.webp" cf-bgj imgq:85 content-length 38 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddc5e5a7-MAN expires Fri, 10 Apr 2020 22:43:43 GMT
GET H2	200	news_email_icon.png www.bleepstatic.com/images/site/	126 B 441 B	29ms 28ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_email_icon.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a Request headers Referer https://www.bleepstatic.com/css/redesign/home.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 485188 cf-polished origFmt=png, origSize=1105 status 200 content-disposition inline; filename="news_email_icon.webp" cf-bgj imgq:85 content-length 126 last-modified Fri, 29 May 2015 07:10:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddc9e5a7-MAN expires Sat, 11 Apr 2020 17:23:21 GMT
GET H2	200	news_footer_icon.png www.bleepstatic.com/images/site/	110 B 280 B	29ms 29ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/images/site/news_footer_icon.png Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d Request headers Referer https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 484538 cf-polished origFmt=png, origSize=186 status 200 content-disposition inline; filename="news_footer_icon.webp" cf-bgj imgq:85 content-length 110 last-modified Sat, 04 Mar 2017 20:46:52 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d7942ddcbe5a7-MAN expires Sat, 11 Apr 2020 17:34:11 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 1140511 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/	11 KB 11 KB	8ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/fixto/fixto.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1141030 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	g Show response ck.connatix.com/	46 B 235 B	20ms 7ms	Script text/plain	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Full URL https://ck.connatix.com/g?callback=cnxJSONP_8dd9bbaf268c87672c861584518989321 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash 290dcc799e96f0a3a53d69fd88dccaace67d93e21973d2fba93a71d9a5c45599 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT via 1.1 varnish server Varnish age 0 x-cache HIT status 200 cache-control no-cache, no-store, must-revalidate, max-age=0 x-cache-hits 0 accept-ranges bytes x-timer S1584518989.331769,VS0,VE0 content-length 46 retry-after 0 x-served-by cache-fra19161-FRA
GET H2	200	292x176_Elephant_Donkey.jpg www.bleepstatic.com/content/hl-images/2020/03/16/thumb/	7 KB 7 KB	31ms 30ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2020/03/16/thumb/292x176_Elephant_Donkey.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d8cf9429bf3be47fe003699a30c6b81385677687e5043859b777f9054184822b Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 114977 cf-polished qual=85, origFmt=jpeg, origSize=8753 status 200 content-disposition inline; filename="292x176_Elephant_Donkey.webp" cf-bgj imgq:85 content-length 7176 last-modified Mon, 16 Mar 2020 21:54:21 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435ee2e5a7-MAN expires Thu, 16 Apr 2020 00:13:31 GMT
GET H2	200	292x176_Windows__10.jpg www.bleepstatic.com/content/hl-images/2019/05/30/thumb/	3 KB 3 KB	33ms 32ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/content/hl-images/2019/05/30/thumb/292x176_Windows__10.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ef17bf1995f4f731446456c0e56c45eda744cd59d7ef0ba91348bf16ab8b055c Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 96966 cf-polished qual=85, origFmt=jpeg, origSize=3881 status 200 content-disposition inline; filename="292x176_Windows__10.webp" cf-bgj imgq:85 content-length 2594 last-modified Thu, 30 May 2019 21:34:22 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435ee3e5a7-MAN expires Thu, 16 Apr 2020 05:13:43 GMT
GET H2	200	icon1471128781.png www.bleepstatic.com/download/product-logos/2016/08/13/	3 KB 3 KB	32ms 31ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/download/product-logos/2016/08/13/icon1471128781.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7b0ba976f51ee59161622fc7d364c35985343adca90a2f5045e1dbb227f6bd3a Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 1758531 cf-polished origFmt=png, origSize=4801 status 200 content-disposition inline; filename="icon1471128781.webp" cf-bgj imgq:85 content-length 2958 last-modified Sat, 13 Aug 2016 22:53:01 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435ee5e5a7-MAN expires Fri, 27 Mar 2020 23:40:58 GMT
GET H2	200	icon1523304226.png www.bleepstatic.com/download/product-logos/2018/04/09/	1 KB 2 KB	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/download/product-logos/2018/04/09/icon1523304226.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 326436aa8a01d063bd93a19a156330d175e2805688e03959bece5246db080ac5 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 484029 cf-polished origFmt=png, origSize=2812 status 200 content-disposition inline; filename="icon1523304226.webp" cf-bgj imgq:85 content-length 1394 last-modified Mon, 09 Apr 2018 20:03:47 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435ee7e5a7-MAN expires Sat, 11 Apr 2020 17:42:40 GMT
GET H2	200	icon1348083463.jpg www.bleepstatic.com/download/product-logos/2012/09/19/	1 KB 1 KB	35ms 34ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/download/product-logos/2012/09/19/icon1348083463.jpg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ebee3fab4fdb2f178afd3d4a64d03c44b658f81ead11e46b46a5ad5b7b16663 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 1756273 cf-polished qual=85, origFmt=jpeg, origSize=1629 status 200 content-disposition inline; filename="icon1348083463.webp" cf-bgj imgq:85 content-length 1074 last-modified Wed, 19 Sep 2012 19:37:54 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435ee8e5a7-MAN expires Sat, 28 Mar 2020 00:18:36 GMT
GET H2	200	icon1447711295.png www.bleepstatic.com/download/product-logos/2015/11/16/	3 KB 4 KB	33ms 33ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/download/product-logos/2015/11/16/icon1447711295.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d79d851441af70ad9f139807a9cd6abd7524102f211eb8d6c23a544d59b474a1 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 742182 cf-polished origFmt=png, origSize=4775 status 200 content-disposition inline; filename="icon1447711295.webp" cf-bgj imgq:85 content-length 3394 last-modified Mon, 16 Nov 2015 22:01:35 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435ee9e5a7-MAN expires Wed, 08 Apr 2020 18:00:07 GMT
GET H2	200	icon1496410975.png www.bleepstatic.com/download/product-logos/2017/06/02/	696 B 867 B	34ms 33ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/download/product-logos/2017/06/02/icon1496410975.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 49eb96ed418dbd3a27597a9ecfb6dbd296e056075736314133bee4b01817c0a4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT age 483921 cf-polished origFmt=png, origSize=1544 status 200 content-disposition inline; filename="icon1496410975.webp" cf-bgj imgq:85 content-length 696 last-modified Fri, 02 Jun 2017 13:42:55 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79435eeae5a7-MAN expires Sat, 11 Apr 2020 17:44:28 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	44 KB 18 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:814::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 06 Feb 2020 00:21:02 GMT server Golfe2 age 5777 date Wed, 18 Mar 2020 06:33:32 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 18174 expires Wed, 18 Mar 2020 08:33:32 GMT
GET H2	200	integrator.js Show response adservice.google.de/adsid/	109 B 171 B	17ms 17ms	Script application/javascript	2a00:1450:4001:821::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 171 B	15ms 15ms	Script application/javascript	2a00:1450:4001:81f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0
GET H2	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/	222 KB 83 KB	26ms 26ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 2ce2129da582125d26c643bfa3ad19f6f2532b7c2a57da274139de2c79b48af7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 84992 x-xss-protection 0 server cafe etag 12744657352742557000 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Wed, 18 Mar 2020 08:09:49 GMT
GET H2	200	zrt_lookup.html googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/ Frame 0944	0 0	6ms 5ms	Document text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20200312/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20200312/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * vary Accept-Encoding date Fri, 13 Mar 2020 05:08:45 GMT expires Fri, 27 Mar 2020 05:08:45 GMT content-type text/html; charset=UTF-8 etag 10348540741379653356 x-content-type-options nosniff content-encoding gzip server cafe content-length 4494 x-xss-protection 0 cache-control public, max-age=1209600 age 442864 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H2	200	jquery.fancybox.css www.bleepstatic.com/js/redesign/fancybox/	4 KB 1 KB	28ms 28ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 4724 cf-polished origSize=4895 status 200 cf-bgj minify last-modified Wed, 14 Oct 2015 20:25:51 GMT server cloudflare etag W/"9108074" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79439f7be5a7-MAN expires Thu, 15 Aug 2019 16:08:15 GMT
GET H2	200	font-awesome.css www.bleepstatic.com/css/redesign/	22 KB 5 KB	30ms 30ms	Stylesheet text/css	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/css/redesign/font-awesome.css Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status HIT age 2179 cf-polished origSize=26776 status 200 cf-bgj minify last-modified Tue, 03 May 2016 04:39:29 GMT server cloudflare etag W/"1700274315" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=3024000 cf-ray 575d79439f7ee5a7-MAN expires Thu, 15 Aug 2019 16:08:15 GMT
GET H2	200	cmp.js Show response quantcast.mgr.consensu.org/	225 KB 61 KB	22ms 7ms	Script text/javascript	2600:9000:21f3:a600:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://quantcast.mgr.consensu.org/cmp.js Requested by Host: www.bleepstatic.com URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:a600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 826acef37820db4f3e9b999fa220c33e40cdd0b862f9717190a775dddd38d846 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:07:50 GMT content-encoding gzip last-modified Tue, 17 Mar 2020 20:57:22 GMT server AmazonS3 age 705 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-meta-qc-ineu True x-amz-cf-pop FRA2-C2 x-amz-cf-id xy4NZebItheng8z8DlA9PDAieGSGtesKgz3VpSeOTCiWu3DfZ-QLEg== via 1.1 d6b9c7bad28b271f1e800a50d49ab8a4.cloudfront.net (CloudFront)
GET H/1.1	200 OK	cookie Show response d.pub.network/	36 B 472 B	454ms 112ms	XHR text/plain	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/cookie Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash c1844445b0d0ccd8c5c2bc540a18735957da29e53e7f57fa56376a816417a98e Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:49 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	42 KB 14 KB	42ms 41ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a519a1e5dbf70e322138ea492c71bdadae357cfab95bf924598dc708e4096da3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "459 / 201 of 1000 / last-modified: 1584453129" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14363 x-xss-protection 0 expires Wed, 18 Mar 2020 08:09:49 GMT
GET H/1.1	200 OK	gallery.js Show response freestar-io.videoplayerhub.com/	100 KB 26 KB	38ms 9ms	Script application/javascript	143.204.202.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://freestar-io.videoplayerhub.com/gallery.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.128 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-128.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 13c421211a0dab4d46d963d3dfc1e0266763f7ac2cdd93284f617adfb8dab691 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id Pqn3HZ.yob7Q8DzEleg2kh2VtSM5_7QY Content-Encoding gzip Last-Modified Fri, 13 Mar 2020 13:59:51 GMT Server AmazonS3 Age 38 Date Wed, 18 Mar 2020 08:09:13 GMT Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/javascript Via 1.1 d01ad8df731d3f120823f9e20df55147.cloudfront.net (CloudFront) Transfer-Encoding chunked X-Amz-Cf-Pop FRA53-C1 Connection keep-alive X-Amz-Cf-Id 572H6RHIKLENZfJxtaFOYQF7ROz9tivEpgOy2mvbobkb8t2jXyOPHA==
GET H2	200	prebid-analytics-3.6.2.js Show response a.pub.network/core/	350 KB 107 KB	152ms 152ms	Script text/html	2606:4700:20::681a:8b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://a.pub.network/core/prebid-analytics-3.6.2.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8bfc61f56cf987bfbf5e1c86e6746d24c7dcd6ad98806dfca9d63c6110810582 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding br cf-cache-status BYPASS status 200 x-guploader-uploadid AEnB2Uq70W41WEPE4hquuY487rMQ3Uid2qdr5xnuLmQ3vZd7zHDh-A5KH60a_c9IKSRpQEZDCxVet3yInQaUp4wgCPd9yKgoAA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 3 x-goog-stored-content-encoding identity last-modified Fri, 28 Feb 2020 20:11:08 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-goog-hash crc32c=zs10DQ==, md5=a/aOr3cetk5W0I0PmuPrIQ== content-type text/html x-goog-generation 1582920668771105 cache-control private x-goog-stored-content-length 358240 cf-ray 575d7943ec490ebb-FRA expires Thu, 18 Mar 2021 08:09:49 GMT
GET H/1.1	200 OK	location Show response d.pub.network/	49 B 496 B	455ms 112ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/location Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 84eef5f28daaf0fbd14fa4dc0c7253da3ce4635546be59f624cfefe8d3876b01 Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:49 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	200	fontawesome-webfont.woff www.bleepstatic.com/fonts/	64 KB 64 KB	118ms 45ms	Font application/octet-stream	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1 Request headers Referer https://www.bleepstatic.com/css/redesign/font-awesome.css Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:49 GMT cf-cache-status HIT last-modified Thu, 23 Apr 2015 09:36:00 GMT server cloudflare age 5789 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/octet-stream status 200 accept-ranges bytes cf-ray 575d7944acedbfde-MAN access-control-allow-origin * content-length 65452
GET H2	200	moatframe.js Show response z.moatads.com/addthismoatframe568911941483/	2 KB 1 KB	85ms 27ms	Script application/x-javascript	23.210.250.213 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/addthismoatframe568911941483/moatframe.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-250-213.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip last-modified Fri, 08 Nov 2019 20:13:52 GMT server AmazonS3 x-amz-request-id D5503D14AA2F06AA etag "f14b4e1f799b14f798a195f43cf58376" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=37037 accept-ranges bytes content-length 948 x-amz-id-2 JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
GET H2	200	_ate.track.config_resp Show response v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/	2 KB 855 B	107ms 106ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software / Resource Hash 6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip etag -1659864586--gzip vary Accept-Encoding content-type application/javascript;charset=utf-8 status 200 cache-control public, max-age=13, s-maxage=86400 content-disposition attachment; filename=1.txt content-length 678
GET H2	200	pls Show response core.connatix.com/ Frame 4883	11 KB 4 KB	473ms 159ms	Script text/plain	54.152.84.52 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://core.connatix.com/pls?callback=jQuery32106016572383101992_1584518989319&token=83c6e833-8c07-474c-b10f-079d46320a80&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c_v=1911_1_0_0_0&page_guid=32415eaf620b0d9a8acf1584518989483&spp=1&_=1584518989320 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.152.84.52 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-152-84-52.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 615bbe01f452d118298d43d3387e83b70e0e51c3f6c4e0f71db34e4905f383fe Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 200 date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip server nginx/1.15.9 (Ubuntu) access-control-allow-origin *
GET H2	200	collect www.google-analytics.com/r/	35 B 101 B	14ms 13ms	Image image/gif	2a00:1450:4001:814::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1319238513&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&ul=en-us&de=UTF-8&dt=New%20CoronaVirus%20Ransomware%20Acts%20as%20Cover%20for%20Kpot%20Infostealer&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=2062323845&gjid=912171012&cid=72834780.1584518989&tid=UA-91740-1&_gid=1915267175.1584518989&_r=1&gtm=2ou3b2&z=1502233686 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:49 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 access-control-allow-origin * content-type image/gif status 200 cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	favicon.ico ad.doubleclick.net/	1 KB 456 B	23ms 7ms	Image image/x-icon	216.58.207.70 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.207.70 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s25-in-f6.1e100.net Software sffe / Resource Hash d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 19:07:05 GMT content-encoding gzip x-content-type-options nosniff age 46964 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 104 x-xss-protection 0 last-modified Tue, 08 May 2012 13:08:06 GMT server sffe vary Accept-Encoding content-type image/x-icon access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes expires Wed, 18 Mar 2020 19:07:05 GMT
GET H2	200	cmp-3pc-check.html static.quantcast.mgr.consensu.org/v31/ Frame 87B9	0 0	37ms 7ms	Document text/html	2600:9000:21f3:fa00:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v31/cmp-3pc-check.html Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:fa00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority static.quantcast.mgr.consensu.org :scheme https :path /v31/cmp-3pc-check.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 content-type text/html content-length 645 last-modified Tue, 17 Mar 2020 20:57:17 GMT x-amz-server-side-encryption AES256 accept-ranges bytes server AmazonS3 date Wed, 18 Mar 2020 08:07:22 GMT etag "55b98270d639ef0c34781d9f03cce91f" x-cache Hit from cloudfront via 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amz-cf-id 7ZCx6TNULRlLuydfpbUZxlXrZdXx-sXDZhMP5-P-bI5xJkiexY3cxg== age 639
GET H2	200	pubads_impl_2020030501.js Show response securepubads.g.doubleclick.net/gpt/	165 KB 60 KB	30ms 15ms	Script text/javascript	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software sffe / Resource Hash 8ee04e0441c9e51785d17ac835a93cf4d30d90826f87350b42ba233496a26f55 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Mar 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 61481 x-xss-protection 0 expires Wed, 18 Mar 2020 08:09:49 GMT
GET H2	200	layers.ab5cd98fe1b9a38a4a9f.js Show response s7.addthis.com/static/	263 KB 76 KB	37ms 36ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-41b9f" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Wed, 18 Mar 2020 08:09:49 GMT x-host s7.addthis.com timing-allow-origin * content-length 77528
GET H2	200	cmpui-popup.js Show response static.quantcast.mgr.consensu.org/v31/	230 KB 61 KB	7ms 6ms	Script text/javascript	2600:9000:21f3:fa00:9:46dc:4700:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:21f3:fa00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash fb182fea82c5fe2b1b8e719010edd3a5bf03d79ff97f6c4e7865a9ead22b4be0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 07:56:02 GMT content-encoding gzip last-modified Tue, 17 Mar 2020 20:57:16 GMT server AmazonS3 age 1162 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript;charset=UTF-8 status 200 x-amz-cf-pop FRA2-C2 x-amz-cf-id foZ_lwioqdeL6_mZLNpIiycPsNOR5_JghJV0FQI6nfd23cCKd8MLOg== via 1.1 debe291145dc27044f50d04bac101cd9.cloudfront.net (CloudFront)
GET H2	200	vendorlist.json Show response vendorlist.consensu.org/	95 KB 18 KB	18ms 7ms	XHR application/json	2600:9000:2057:c200:1:af78:4c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vendorlist.consensu.org/vendorlist.json Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:2057:c200:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 4b1802dd6a4184fdbda7a469f7f7258190ebe8690cbaa24cfd99a588dde61938 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 17 Mar 2020 01:13:59 GMT content-encoding gzip vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method age 111351 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 12 Mar 2020 16:00:30 GMT server AmazonS3 access-control-max-age 604800 access-control-allow-methods GET x-amz-version-id n.U3GT1Xns.dVTg6BaKcbkdHhBEeTGuK via 1.1 e0bc02299b03254b2a35b8c930f005c6.cloudfront.net (CloudFront) cache-control max-age=604800 x-amz-cf-pop FRA6-C1 content-type application/json; charset=utf-8 x-amz-cf-id 6QzoGvOjRWE2S-fkXE7dzXWLmePrluiDxOK3wbl8T24AAsiImoJ7jQ==
GET H2	200	apstag.js Show response c.amazon-adsystem.com/aax2/	87 KB 25 KB	43ms 28ms	Script application/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/aax2/apstag.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash ac2a58f9d55c4642121cfb6f7e213cbc882bbdd75ef171ca8a07ed982ef693ce Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Tue, 17 Mar 2020 22:00:55 GMT content-encoding gzip server Server age 36534 etag 1dcfbf3986ee8b9c3abbc67eb808ab43 x-cache Hit from cloudfront content-type application/javascript status 200 cache-control public, max-age=86400 x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id 1Kp7KSPv0EU-WoNVVFrL0a891HwlRP_C2545yKFHaN96ilu9xzRMAQ== via 1.1 999a435eb37a050d3de26fe63534c416.cloudfront.net (CloudFront)
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/	90 KB 20 KB	20ms 7ms	Script text/javascript	151.101.113.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 798b6f93e2620c9b9ddf54a19ab8d6b62418a9e3d4300c5c1555fddef4284a38 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 08:09:49 GMT Content-Encoding gzip Age 1334 X-Cache HIT Connection keep-alive Content-Length 19893 x-amz-id-2 tuwwvKn6WNqRDRkBZ4WKPYINnTBjP8k9cMZhLsdQMYI0RwBKvcl578Dcw35Bo+PeYiODN5FJGHE= X-Served-By cache-hhn4075-HHN Last-Modified Wed, 18 Mar 2020 07:44:34 GMT Server AmazonS3 X-Timer S1584518990.674785,VS0,VE0 ETag "adabf1ac0d566eeb6d3968db57fd9482" x-amz-request-id 59B9005DA1370B33 Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 57
GET H/1.1	200 OK	v2 Show response d.pub.network/floors/	2 KB 2 KB	300ms 113ms	XHR application/json	35.188.71.214 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://d.pub.network/floors/v2?key=535desktop Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.71.214 , United States, ASN15169 (GOOGLE, US), Reverse DNS 214.71.188.35.bc.googleusercontent.com Software / Resource Hash 1eae5f911fa3fa82c22a3714c29aa1345d48ea0a1d1e935980ec603afce3da1d Request headers Accept application/json, text/plain, */* Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:49 GMT Access-Control-Allow-Credentials true Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Transfer-Encoding chunked Content-Type application/json
GET H2	404	CookieAccess Show response api.quantcast.mgr.consensu.org/	30 B 597 B	124ms 109ms	XHR application/json	143.204.202.93 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.quantcast.mgr.consensu.org/CookieAccess Requested by Host: quantcast.mgr.consensu.org URL: https://quantcast.mgr.consensu.org/cmp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.93 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-93.fra53.r.cloudfront.net Software / Resource Hash 5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:49 GMT content-encoding gzip x-amz-cf-pop FRA53-C1 x-amzn-requestid f7d278a7-d969-4da3-bc51-2b671ec0d675 x-cache Error from cloudfront status 404 x-amz-apigw-id Jk6UKEp7oAMFR3Q= content-length 50 access-control-allow-origin https://www.bleepingcomputer.com x-amzn-trace-id Root=1-5e71d74d-93b8cf70ffed22a45086bb20;Sampled=0 vary Origin access-control-allow-methods GET, POST content-type application/json via 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront) cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Content-Type x-amz-cf-id 5npMW-qlH9exPFBBHz8RvCqbpJI2Vre4jy7empUpfIHwRkBFqJeIhQ==
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202003171135/	92 KB 32 KB	6ms 6ms	Script application/javascript	151.101.113.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 9417385feb17b55f8177d1892d3aeabbd7407cc3413769179811e4e0e1d6ee80 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 08:09:49 GMT Content-Encoding gzip Age 427 X-Cache HIT Connection keep-alive Content-Length 32010 x-amz-id-2 JHGCAGIbhWQKKWw/Ro4nS003Ddkp/3t6h9PXXg34mzQpTli4+atFBmlTBdJAg5K0MOMG9Y1eh70= X-Served-By cache-hhn4075-HHN Last-Modified Tue, 17 Mar 2020 16:09:31 GMT Server AmazonS3 X-Timer S1584518990.691819,VS0,VE0 ETag "a878d9fb9018c33e6c70ea1b30832459" x-amz-request-id 7FD0E3AEBB7BAEEF Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 431
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202003171135/	32 KB 13 KB	17ms 7ms	Script application/javascript	151.101.113.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202003171135/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/d5CEaYYEzMwqV3dGpQ3IFjCM27s/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 2a7fc4e3d27f714b2aeafc4d13994249b3305a689749e3aa389ce25c8c58f6a6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 08:09:49 GMT Content-Encoding gzip Age 333 X-Cache HIT Connection keep-alive Content-Length 12207 x-amz-id-2 miNEcQ320u071Ho3T5UBUByD++hw//TGrl6y30Wx4bV+2bRu34w04NRddT0PAYTiHgR6SNOIJ1o= X-Served-By cache-hhn4075-HHN Last-Modified Tue, 17 Mar 2020 16:09:32 GMT Server AmazonS3 X-Timer S1584518990.701780,VS0,VE0 ETag "6886dd8a2947cf22fa7f2542c3ed17e2" x-amz-request-id F2E00FA14CB53977 Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 1688
GET H2	200	aps_csm.js Show response c.amazon-adsystem.com/bao-csm/aps-comm/	6 KB 3 KB	23ms 9ms	XHR application/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 05:04:27 GMT content-encoding gzip vary Origin age 11123 x-cache Hit from cloudfront status 200 access-control-allow-origin * last-modified Thu, 05 Mar 2020 08:28:46 GMT server AmazonS3 access-control-max-age 3000 access-control-allow-methods GET content-type application/javascript via 1.1 03d509e8374e9f42668961b5e0201349.cloudfront.net (CloudFront) cache-control public, max-age=86400 x-amz-cf-pop FRA2-C2 x-amz-cf-id 4peohBoGZl-J-iRhSuhCJLbLCUTD38N0e0SAnX0LTFbZZN7ZYcubaA==
GET H2	200	beacon.js Show response ad-delivery.net/	1 KB 987 B	23ms 8ms	Script application/x-javascript	143.204.202.37 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad-delivery.net/beacon.js Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.37 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-37.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id null content-encoding gzip last-modified Tue, 31 Jan 2017 15:06:54 GMT server AmazonS3 age 2807 date Wed, 18 Mar 2020 07:23:03 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=3600 x-amz-cf-pop FRA53-C1 x-amz-cf-id XDoHL8DQdKqzbg__FY__Hc0zc9_z6eJyLjYEMeZVhOY2D0W3OI-1Gg== via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront)
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	65ms 64ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&pid=365OvD7midYEM&cb=0&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_1%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_1%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_300x250_300x600_160x600_Right_3%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:49 GMT via 1.1 999a435eb37a050d3de26fe63534c416.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id DA1__k4KYvAvZ4b_RQDCEJ19-xeYiR8tAPT3F3wGrlmm7S09kKI-2g==
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	455ms 113ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash c1844445b0d0ccd8c5c2bc540a18735957da29e53e7f57fa56376a816417a98e Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:50 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET DATA	200 OK	truncated /	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	715 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	g Show response rtb.connatix.com/	176 B 341 B	624ms 199ms	Script text/plain	52.54.227.62 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=469&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c_ivt=0&connatix_sess=jvoj6VvAGdm93CF3bUxXMYXAUm_032AtwJ82OmkCyUy7vgl4gGUlAwmvJhBrLIhCCxmtIrDKZZzGGW7EdiiXQ7ZAbqf0rFC_AzS7SA0bMaGpm6g72ykosva30Vd_zAfa-Y6M6su47h4XQEjsYxzPkMaurpGG_IMHcH1e1utq0LGz212JU_okWcBs5S1ljtqG&notServed=false&xplr=true&c_s=false&c_pl=zvRPplZQ2s7EFKVgUADKAjWq6VINOC1aMXwakKiLTQXww4NS-rrRMcMC5YYcsEcHJyP2b3z_QQr8xKDWB2UUboOib-0yIrfI80DN7X_xcDbM5cAsI0OrhQ2vCx7azLKnsu3YevQc6UVmQPD89zIFxy_CPLxwvDHjcFX9Yt7SF_v5ONq6yfcJi04yvmhk7bSAJd_nuWCy9CIy2VrZ1A5sHZwfy5ze0gderlYpkpXD4K9oR1_llbPFExUwRIrEy7nzDLPxxCrs8Dwc4AkZHPFwTQ&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=0&v=1&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-inf&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_3f2958ce8463c496095e1584518990104 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.54.227.62 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-54-227-62.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 84abb4a9f70e8ce17f3ae0078686fcd4871c8b2529b429666f57f2449adcde83 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 08:09:50 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 153
GET H2	200	420.jpg i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/	34 KB 34 KB	27ms 25ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/af391ba1-47b0-4ff1-87cb-08a6df11845f/420.jpg?mode=stretch&connatiximg=true&scale=both&height=469&width=834 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 20bb547ce6333c2668884536b83226d8812f02ab1173e13002f4eb86b182e702 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 19683 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 4, 2 accept-ranges bytes x-timer S1584518990.102824,VS0,VE0 access-control-allow-origin * content-length 34814 x-served-by cache-sjc10051-SJC, cache-fra19161-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/01d7ff40-9839-46be-bcf6-c785d715cf58/	42 KB 43 KB	9ms 7ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/01d7ff40-9839-46be-bcf6-c785d715cf58/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ce6b3baf09cef6a609616e704f9cf2ceb470c8b0d3b214756c2150af972e7e41 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 19683 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 2 accept-ranges bytes x-timer S1584518990.102409,VS0,VE0 access-control-allow-origin * content-length 43346 x-served-by cache-sjc10047-SJC, cache-fra19161-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/162da786-637c-4dce-abd7-22985fd8d99e/	32 KB 32 KB	27ms 25ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/162da786-637c-4dce-abd7-22985fd8d99e/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bc345d990d44b20fe3e327a41d7138bb63efb176a97f47dc7306a788b8205bce Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 19684 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 2 accept-ranges bytes x-timer S1584518990.102827,VS0,VE0 access-control-allow-origin * content-length 32465 x-served-by cache-sjc10029-SJC, cache-fra19161-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/7a39d4eb-993f-466e-8ee5-9a934996c204/	43 KB 43 KB	26ms 25ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/7a39d4eb-993f-466e-8ee5-9a934996c204/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash acaddabd3451c2e00db440eb34c7d6fd086cc96ce939c369728e7d67643fc5d5 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 19684 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 2, 2 accept-ranges bytes x-timer S1584518990.102845,VS0,VE0 access-control-allow-origin * content-length 43665 x-served-by cache-sjc10020-SJC, cache-fra19161-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/38b3b97a-0d39-4978-934a-614a3f42b75d/	64 KB 64 KB	20ms 18ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/38b3b97a-0d39-4978-934a-614a3f42b75d/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e488ff69d195e17b6081719b7c4b17998d00d7802382b0ef8a5ef550e30e2283 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 19683 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 2 accept-ranges bytes x-timer S1584518990.102771,VS0,VE0 access-control-allow-origin * content-length 65648 x-served-by cache-sjc10035-SJC, cache-fra19161-FRA
GET H2	200	1.jpg i.connatix.com/s3/connatix-uploads/3045fa17-76c8-4e2c-84ca-756b9bf67048/	45 KB 45 KB	20ms 19ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-uploads/3045fa17-76c8-4e2c-84ca-756b9bf67048/1.jpg?mode=crop&width=1001&height=563 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f791648f043a2acef9cc1d97148b07637884c8a543b67d0cc450f37fb2477639 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 19682 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 3, 2 accept-ranges bytes x-timer S1584518990.102795,VS0,VE0 access-control-allow-origin * content-length 45793 x-served-by cache-sjc10050-SJC, cache-fra19161-FRA
GET H2	200	bleeping-computerlogo-lg.png www.bleepstatic.com/logos/	7 KB 7 KB	29ms 28ms	Image image/webp	104.26.12.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.bleepstatic.com/logos/bleeping-computerlogo-lg.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a56e644a617b2d1e4e7d808dfc334a7ea8622979f22999dc9eccd21c61958b3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT cf-cache-status HIT age 487187 cf-polished origFmt=png, origSize=15281 status 200 content-disposition inline; filename="bleeping-computerlogo-lg.webp" cf-bgj imgq:85 content-length 7156 last-modified Wed, 07 Jan 2015 22:52:15 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept content-type image/webp access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes cf-ray 575d79483987e5a7-MAN expires Sat, 11 Apr 2020 16:50:03 GMT
GET H2	200	0_th_1.jpg i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/ Frame 4883	23 KB 23 KB	14ms 14ms	Image image/jpeg	151.101.14.217 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.connatix.com/s3/connatix-videos/af391ba1-47b0-4ff1-87cb-08a6df11845f/0_th_1.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash c3034d0370c5faa09e7a8d7b0c48925afa0371cf17e4827dde23059f56019dae Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish, 1.1 varnish age 23668027 x-cache HIT, HIT content-type image/jpeg status 200 cache-control max-age=31557600 x-cache-hits 1, 2 accept-ranges bytes x-timer S1584518990.119275,VS0,VE0 access-control-allow-origin * content-length 23507 x-served-by cache-sjc3144-SJC, cache-fra19161-FRA
GET H2	200	ads googleads.g.doubleclick.net/pagead/ Frame C62E	0 0	52ms 51ms	Document text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1584106191&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1584518989358&bpp=4&bdt=268&fdt=201&idt=201&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4030194722953&frm=20&pv=2&ga_vid=72834780.1584518989&ga_sid=1584518990&ga_hid=1319238513&ga_fc=0&iag=0&icsg=149533625425920&dssz=54&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=1887664485623289&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=765 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1584106191&plat=1%3A32776%2C2%3A16809992%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1584518989358&bpp=4&bdt=268&fdt=201&idt=201&shv=r20200312&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4030194722953&frm=20&pv=2&ga_vid=72834780.1584518989&ga_sid=1584518990&ga_hid=1319238513&ga_fc=0&iag=0&icsg=149533625425920&dssz=54&mdo=0&mso=0&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1585&bih=1200&scr_x=0&scr_y=0&oid=3&pvsid=1887664485623289&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=16&bc=31&ifi=1&uci=a!1&fsb=1&dtd=765 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 18 Mar 2020 08:09:50 GMT server cafe content-length 34 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Wed, 18-Mar-2020 08:24:50 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 expires Wed, 18 Mar 2020 08:09:50 GMT cache-control private
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	7 KB 5 KB	17ms 17ms	XHR application/json	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200312&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c480f914ed98ac52af4c96fd2291cc2508e7a125289858b546ba6cb8fe5fb5f0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Wed, 18 Mar 2020 08:09:50 GMT content-encoding gzip x-content-type-options nosniff server cafe status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5155 x-xss-protection 0
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 27 KB	42ms 42ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 909009056877bdbc198a45c7adec7d4b0615aa97d0a4d61ac493472dd0b4a97f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:50 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1584217929168357" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 27546 x-xss-protection 0 expires Wed, 18 Mar 2020 08:09:50 GMT
GET H2	200	/ Show response audit.quantcast.mgr.consensu.org/	80 B 486 B	24ms 10ms	XHR text/html	13.225.78.42 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://audit.quantcast.mgr.consensu.org/?log=;1584518990128;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F;;;;;p,off,false,,1,en,31,193,true,false,false;displayConsentUi:mandatory,;GDPR-gxcnx19fe6wtn444vv4m Requested by Host: static.quantcast.mgr.consensu.org URL: https://static.quantcast.mgr.consensu.org/v31/cmpui-popup.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.78.42 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-78-42.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 05:17:07 GMT via 1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront) vary Origin age 10364 x-cache Hit from cloudfront status 200 content-length 80 last-modified Mon, 11 Jun 2018 22:07:34 GMT server AmazonS3 etag "0614149d8033903db5de46d6c184bbfd" access-control-max-age 3000 access-control-allow-methods GET content-type text/html access-control-allow-origin * x-amz-cf-pop FRA2-C2 accept-ranges bytes x-amz-cf-id o-shInpLXGe6zE-GzZci_X-dZxCkil_O8aUIqk6F7bUI5iPo9A8UUQ==
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 362 B	312ms 99ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081150&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=469&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=50c93f1f5dc0803541e01584518990104&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:50 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H/1.1	200 OK	p2 sb.scorecardresearch.com/ Frame 4883 Redirect Chain https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=1&ns_st_sp=1&ns... https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=1&ns_st_sp=1&n...	43 B 309 B	8ms 8ms	Image image/gif	23.5.97.37 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1584518990144&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c8=&c9=&cs_ucfr=0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-5-97-37.deploy.static.akamaitechnologies.com Software / Resource Hash 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:50 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Expires Mon, 01 Jan 1990 00:00:00 GMT Connection keep-alive Content-Length 43 Content-Type image/gif Redirect headers Location https://sb.scorecardresearch.com/p2?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1584518990144&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c8=&c9=&cs_ucfr=0 Pragma no-cache Date Wed, 18 Mar 2020 08:09:50 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	g Show response rtb.connatix.com/	228 B 351 B	653ms 213ms	Script text/plain	52.54.227.62 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c_ivt=0&connatix_sess=jvoj6VvAGdm93CF3bUxXMYXAUm_032AtwJ82OmkCyUy7vgl4gGUlAwmvJhBrLIhCCxmtIrDKZZzGGW7EdiiXQ7ZAbqf0rFC_AzS7SA0bMaGpm6g72ykosva30Vd_zAfa-Y6M6su47h4XQEjsYxzPkMaurpGG_IMHcH1e1utq0LGz212JU_okWcBs5S1ljtqG&notServed=false&xplr=true&c_s=false&c_pl=zvRPplZQ2s7EFKVgUADKAjWq6VINOC1aMXwakKiLTQXww4NS-rrRMcMC5YYcsEcHJyP2b3z_QQr8xKDWB2UUboOib-0yIrfI80DN7X_xcDbM5cAsI0OrhQ2vCx7azLKnsu3YevQc6UVmQPD89zIFxy_CPLxwvDHjcFX9Yt7SF_v5ONq6yfcJi04yvmhk7bSAJd_nuWCy9CIy2VrZ1A5sHZwfy5ze0gderlYpkpXD4K9oR1_llbPFExUwRIrEy7nzDLPxxCrs8Dwc4AkZHPFwTQ&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=1&v=2&c_pt=1&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-inf&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_2cfb4fae6c712fc854141584518990147 Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.54.227.62 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-54-227-62.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash 81abd2bff1bb9c3c2cbc99534adcde4c3a7100efb8fce56936fa452acd3380b7 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 08:09:50 GMT Content-Encoding gzip Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 163
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	14 KB 5 KB	15ms 15ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20200312/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:50 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1582746470043195" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5456 x-xss-protection 0 expires Wed, 18 Mar 2020 08:09:50 GMT
GET H/1.1	200 OK	r trk.connatix.com/ Frame 4883	0 162 B	602ms 150ms	Image text/plain	3.213.93.144 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/r?connatix_sess=jvoj6VvAGdm93CF3bUxXMYXAUm_032AtwJ82OmkCyUy7vgl4gGUlAwmvJhBrLIhCCxmtIrDKZZzGGW7EdiiXQ7ZAbqf0rFC_AzS7SA0bMaGpm6g72ykosva30Vd_zAfa-Y6M6su47h4XQEjsYxzPkMaurpGG_IMHcH1e1utq0LGz212JU_okWcBs5S1ljtqG&videoID=639404&c_pl=zvRPplZQ2s7EFKVgUADKAjWq6VINOC1aMXwakKiLTQXww4NS-rrRMcMC5YYcsEcHJyP2b3z_QQr8xKDWB2UUboOib-0yIrfI80DN7X_xcDbM5cAsI0OrhQ2vCx7azLKnsu3YevQc6UVmQPD89zIFxy_CPLxwvDHjcFX9Yt7SF_v5ONq6yfcJi04yvmhk7bSAJd_nuWCy9CIy2VrZ1A5sHZwfy5ze0gderlYpkpXD4K9oR1_llbPFExUwRIrEy7nzDLPxxCrs8Dwc4AkZHPFwTQ&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-inf&c_v=1911_1_0_0_0&spp=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.93.144 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-93-144.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 08:09:50 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/209/ Frame D58A	0 0	6ms 6ms	Document text/html	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/209/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html content-length 5727 date Wed, 18 Mar 2020 07:50:15 GMT expires Thu, 18 Mar 2021 07:50:15 GMT last-modified Tue, 25 Feb 2020 17:32:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1175 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H/1.1	200 OK	jquery.color-2.1.2.min.js Show response cluster-na.cdnjquery.com/color/	95 B 359 B	574ms 140ms	Script text/javascript	54.210.139.114 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1584518990220&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%22d6aa62f6-68ef-11ea-b06e-b8c3b7d0033e%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&csVersion=1.21.46&clearThroughOptions=undefined Requested by Host: freestar-io.videoplayerhub.com URL: https://freestar-io.videoplayerhub.com/gallery.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.210.139.114 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-210-139-114.compute-1.amazonaws.com Software nginx/1.12.1 / Resource Hash 086b4791ad6a8c6039aaea2dcd4d2efcb79624cc199590c6a335bb4cefb912ba Security Headers Name Value X-Frame-Options DENY Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Wed, 18 Mar 2020 08:09:50 GMT Content-Encoding gzip Server nginx/1.12.1 ETag W/"5f-72uVVoCB7D/HD+X7VH2anryHuJs" X-Frame-Options DENY Content-Type text/javascript; charset=utf-8 Charset utf8 Connection keep-alive Content-Length 87
GET H2	200	px.gif ad-delivery.net/	43 B 385 B	7ms 7ms	Image image/gif	143.204.202.37 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ad-delivery.net/px.gif?ch=1&e=0.7704117846670326 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.37 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-37.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 15:39:11 GMT via 1.1 2d1e1e8dc0f3eb7773ec9d89a7d50ce2.cloudfront.net (CloudFront) last-modified Thu, 27 Jul 2017 18:59:05 GMT server AmazonS3 age 59440 etag "ad4b0f606e0f8465bc4c4c170b37e1a3" x-cache Hit from cloudfront x-amz-version-id null status 200 x-amz-cf-pop FRA53-C1 accept-ranges bytes content-type image/gif content-length 43 x-amz-cf-id iZYtzSiEAxjf4W9Pjnba21hzVleZZ7NM7JdsYdBudE_OJsEsZEqD_g==
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 61 B	14ms 14ms	Image image/gif	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200312&jk=1887664485623289&bg=!VValVk5YEN7ah9XPSU4CAAAAOlIAAAAKmQFkUMTbHjtp7PU2pQbxphWaavNkunXwCCTgioqbbKkVVf32lDsIis6uvMUc7v_FEwIjxEx_cjx7OHmWX6EQO-q5v8i_mxvvnwZ-znwovLmfFyjqIA6KB5BC59hZWUTPCaJ3TWwX-unnMCeWoweTLicLpELQkG1c83yqTxjAarrOVSFX0vTYN7QPFzracsan2qLGjIJh7u79u3kpVJqxEukZ0wM3I3XinnTuAKqWPnenHxxPHkJyITCmrqxeoCGwOM8Vo3ACnaXx4SWN4sp_7lB9ffbWafCeXodzNXtYs_GXMeVXGh8xndNu2p-uxkKS1TzmS6YlY-1fAeq8yqtB4v_xUNBPnOSoeAq6qV65J_XlVf67H_e5EsUkOoFQNz4mfMjPKypup66SWQxdm88o_LdOsZ_CVrdcLdT8k5f6bzAoVgkBWuQ9AwoHnl0_ewq8ge6nfHrwaJa4WfxYLOz8Vswz1SXSjCs Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:50 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame 4883	119 B 462 B	380ms 199ms	XHR text/xml	2600:1f18:612b:4264:5377:cc1:25f4:3b0b AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-bwjaw&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4264:5377:cc1:25f4:3b0b Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:50 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
GET H2	200	48.008759e9efe1c1b693dd.js Show response s7.addthis.com/static/	281 B 486 B	53ms 53ms	Script application/javascript	23.210.248.44 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-248-44.deploy.static.akamaitechnologies.com Software nginx/1.15.8 / Resource Hash f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip last-modified Wed, 18 Sep 2019 14:16:17 GMT server nginx/1.15.8 etag W/"5d823c31-119" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=86313600 date Wed, 18 Mar 2020 08:09:50 GMT x-host s7.addthis.com timing-allow-origin * content-length 246
GET H2	200	/ Show response graph.facebook.com/	310 B 419 B	57ms 45ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_yn20 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 37059f437cb8817f4cbf511a24700719226802f3b3ce0eee5a6095bf4530641c Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload content-encoding br x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Wed, 18 Mar 2020 08:09:50 GMT, Wed, 18 Mar 2020 08:09:50 GMT x-fb-rev 1001855088 alt-svc h3-27=":443"; ma=3600 content-length 217 pragma no-cache x-fb-debug vdMwMvl30mc7pnYk190xatK+WN+3bpPbqxnKcDOh6uFkqN/HccKhmswg13bG9I6fhFEf/YpGwjJl10MHs2MCnQ== x-fb-trace-id GWjDKC+TMVt etag "4b6fd8a04de8825c3747888cf46ad6c67159cec8" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id AQ-5Nw2M1QnsxAfe5wtWgVh cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 669 B	132ms 117ms	Script application/javascript	151.101.113.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&jsonp=_ate.cbs.rcb_5g3y0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash bd22316fdfbf3f73ce239402f3a9d227a7fbabcf56c70a04d7aa581cfc5692be Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-hhn4034-HHN x-moose majestic server snooserv x-timer S1584518991.557663,VS0,VE110 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	/ Show response graph.facebook.com/	149 B 606 B	49ms 37ms	Script text/javascript	2a03:2880:f02d:e:face:b00c:0:2 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://graph.facebook.com/?id=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_3oak0 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9b01f514f3a2b0b6c3ef0eda0d3a2e70f404cd20dfd0de1937ce45cbaff29f91 Security Headers Name Value Strict-Transport-Security max-age=15552000; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=15552000; preload x-app-usage {"call_count":0,"total_cputime":0,"total_time":0} status 200 date Wed, 18 Mar 2020 08:09:50 GMT, Wed, 18 Mar 2020 08:09:50 GMT x-fb-rev 1001855088 alt-svc h3-27=":443"; ma=3600 content-length 149 pragma no-cache x-fb-debug VPZF/1NnCnhGcsBNNdodG8rKMr9lfwcoEoc62bKpBvwy41KRBcZyzIdRhdjL4VktKsmwEAfR3w6iuIxcWKwSMQ== x-fb-trace-id EZbxn/XXruF etag "05b847207b957d86f235e0e4df4fea1ccc132af6" content-type text/javascript; charset=UTF-8 access-control-allow-origin * x-fb-request-id AFEFlEXTxYgjbZX0J3ORkiL cache-control private, no-cache, no-store, must-revalidate facebook-api-version v2.12 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	info.json Show response www.reddit.com/api/	126 B 260 B	134ms 120ms	Script application/javascript	151.101.113.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&jsonp=_ate.cbs.rcb_dtn40 Requested by Host: s9.addthis.com URL: https://s9.addthis.com/js/300/addthis_widget.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.140 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 84666f8e39481ccaeb2a4508d321d6a337ac1b0ac9002604f028d89199d7fa0b Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:50 GMT via 1.1 varnish x-content-type-options nosniff x-cache MISS status 200 x-cache-hits 0 strict-transport-security max-age=15552000; includeSubDomains; preload content-length 126 x-xss-protection 1; mode=block x-served-by cache-hhn4034-HHN x-moose majestic server snooserv x-timer S1584518991.557649,VS0,VE112 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-expose-headers X-Moose cache-control private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate x-ua-compatible IE=edge accept-ranges bytes expires -1
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame 4883	119 B 462 B	319ms 319ms	XHR text/xml	2600:1f18:612b:4264:5377:cc1:25f4:3b0b AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-nac38&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4264:5377:cc1:25f4:3b0b Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	514 B 705 B	40ms 14ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash f764fcdbabf97d486975e5c6a472a92a275ad823868e8e32fbab12ffd4553c6b Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 514 expires 0
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	35ms 15ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=13ffe8418b3b6b7&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	60ms 39ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=1476dabd8085b1&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	35ms 15ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=1561ee21d1b932b&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	60ms 40ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=166daae6f53ce24&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	56ms 36ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=176042b2d80ce78&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	53ms 33ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=18100cf63bc949f&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	82ms 62ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=19f3310506fef38&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	82ms 63ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=2085fad8cd8eb4a&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	36ms 17ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=2188023dfd93b6e&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	55ms 36ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=uo4nuhxJikFrr3o47oeeZPL5&bidId=2278f59eea1afa&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	56ms 37ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=6f2XVeWT9HhHNo9TDFzKK7JK&bidId=23d744924f66927&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:51 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	730 B 1 KB	66ms 39ms	XHR application/json	185.33.220.145 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 829ef40119c6e55ce49b9ba8e6167851d750f35129d7e1344b76fde7fa5022e3 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 08:09:53 GMT Content-Encoding gzip Transfer-Encoding chunked P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 83.143.245.70; 83.143.245.70; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.75:80 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 23e4c620-b2af-444f-ab60-e3842173751a Server nginx/1.13.4 Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	19 B 720 B	55ms 25ms	XHR application/json	185.33.220.145 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:53 GMT X-Proxy-Origin 83.143.245.70; 83.143.245.70; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.236:80 AN-X-Request-Uuid 66fbe9ee-e492-4a2a-876a-ac18e8210ff4 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978	0 -1 B	173ms 148ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978	0 -1 B	161ms 136ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978	0 -1 B	178ms 153ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978	0 -1 B	164ms 139ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978	0 -1 B	174ms 149ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978	0 -1 B	174ms 150ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978	0 -1 B	162ms 138ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978	0 -1 B	608ms 583ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978	0 -1 B	173ms 149ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978	0 -1 B	174ms 150ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978	0 -1 B	172ms 149ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978	0 -1 B	596ms 572ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978; https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978	0 -1 B	160ms 137ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	25 B 998 B	292ms 238ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22526d77d363de207%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2253fb6473fce54c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2254627039e8c7a48%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2255b12994507b25a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2256c3c0782133783%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2257a7f839aa23d93%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2258b8348bb819f%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2259489aceaeace6e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22607b263b17100c8%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2261060b406b6f582%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2262cea2bd671ff11%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%226386d2009cf733e%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22644f70400e01b3d%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2265ebb0384424382%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash bf244efb1b764871e62b18319e96cdfa9a8a811e6fd2d08ce076c3f6521ac467 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 45 Expires Wed, 18 Mar 2020 08:09:51 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 39 B	65ms 37ms	XHR text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 08:09:51 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d794ddda92c16-AMS access-control-allow-headers origin, content-type
POST H2	204	v1 Show response dmx.districtm.io/b/	0 447 B	62ms 34ms	XHR text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 08:09:51 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d794dddab2c16-AMS access-control-allow-headers origin, content-type
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 577 B	175ms 160ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=5d16feb5-70e2-4e73-b07b-f7554ed01565%2C6d84192e-fd1f-4a48-8881-e759e46cffa9%2C53ccd04a-62c7-48d5-b1f7-f7ac2c1af930%2C47a78024-6265-49e9-8d4c-dd04f418e8ad%2C85effd91-8d1a-4765-9c8b-d24d14912d6f%2C22198e4d-e722-4922-8a2a-ffba6663d121&nocache=1584518990983&pubcid=a4a35cdd-89a5-41b8-b3a3-94e4676a5257&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C300x250%2C300x600%7C300x250%2C300x600%7C728x90%7C300x250%2C300x600&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&auid=540959250%2C540959250%2C540959250%2C540959250%2C540959250%2C540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash fb676e7ea9eb22dccfe6c5632fec97ef8fc7fdd93d7a3b99188170073f5e90e7 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT content-encoding gzip server OXGW/16.179.0 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 164 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 482 B	497ms 229ms	XHR application/json	35.158.187.234 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.158.187.234 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-158-187-234.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 2 KB	123ms 99ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=5d16feb5-70e2-4e73-b07b-f7554ed01565&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.20673675741361897 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 2484723e33e1d3a84474b6a45b97379661cca1d3b8fcd390ffbf7030e9c5eafb Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=453 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 2 KB	123ms 93ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=6d84192e-fd1f-4a48-8881-e759e46cffa9&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.45113279097982995 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash bcd911f02a76ac1c3506321c74a5b7fde1010dea17635f712410aa4d70facca3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=485 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	11 KB 8 KB	160ms 129ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=53ccd04a-62c7-48d5-b1f7-f7ac2c1af930&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5212206556449754 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 4738759d7dadfaa24185bf772b94c0c26f5968f791d32ffba2a67fb514570900 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Content-Encoding gzip Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=186 Content-Length 6165 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	11 KB 7 KB	134ms 103ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=47a78024-6265-49e9-8d4c-dd04f418e8ad&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.07823048629021767 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 00eb1ebe8aef9e39523994c577fa0d107542a2c3eb202f14376e9d28ffb5a252 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Content-Encoding gzip Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=157 Content-Length 6019 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	240 B 2 KB	137ms 100ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=85effd91-8d1a-4765-9c8b-d24d14912d6f&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.4341043225893133 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash b773fccb0918d86d85a64d25e4e7de801a4e6647c7987cda19eab05a90ecfd34 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=461 Content-Length 240 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	11 KB 7 KB	308ms 185ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=15&alt_size_ids=10&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=22198e4d-e722-4922-8a2a-ffba6663d121&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.974999727095939 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash a83ed63226c8ad5d93051804b3e5f79edd5295bb9e41b0e1b0f58bd4ba5fd89b Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Content-Encoding gzip Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=261 Content-Length 6020 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H2	302	ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1...	0 -1 B	152ms 152ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1...	0 -1 B	151ms 150ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1...	0 -1 B	152ms 152ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1...	0 -1 B	140ms 140ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1...	0 -1 B	138ms 138ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1...	0 -1 B	141ms 140ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1...	0 -1 B	153ms 152ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1...	0 -1 B	152ms 152ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1...	0 -1 B	140ms 140ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1...	0 -1 B	151ms 151ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	302	ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ Redirect Chain https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1...	0 -1 B	150ms 150ms	XHR	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx access-control-allow-origin https://www.bleepingcomputer.com location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" status 302 cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT Redirect headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 302 location https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-length 0 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	100ms 100ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081146&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=47f7960a200d56ad5e5b1584518991165&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	tag Show response slckg-phfiv.ads.tremorhub.com/ad/ Frame 4883	119 B 462 B	173ms 172ms	XHR text/xml	2600:1f18:612b:4264:5377:cc1:25f4:3b0b AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://slckg-phfiv.ads.tremorhub.com/ad/tag?adCode=slckg-wc2tk&playerWidth=834&playerHeight=470&playerPosition=1&mediaTitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaDesc=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&mediaId=639404&mediaUrl=&srcPageUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentLength=30&gdpr=1&gdpr_consent=&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f18:612b:4264:5377:cc1:25f4:3b0b Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Apache-Coyote/1.1 / Resource Hash 5616a6e1823b43919f7d1a33817cccfa1d9f30c9f10f2deb00d9c3671f91d5f0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT content-encoding gzip server Apache-Coyote/1.1 status 200 vary accept-encoding p3p CP='This is not a P3P policy. See https://telaria.com/privacy-policy/' access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true x-tremorvideo-status NO_AD content-type text/xml;charset=UTF-8
GET H2	200	ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	945 B 1 KB	204ms 203ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79992e4-68ef-11ea-8c8b-12dcd5311714;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=112490b80ce5704d;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 26abecfd5dbf9e5b19142e213a35a429ed693afab08cc6853125bd0d5cb6fd68 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true accept-ranges bytes content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	945 B 1 KB	203ms 197ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;apid=1Ad79b07f0-68ef-11ea-9842-127f7115e3c4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=10943bdd7bd5eb2d;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 2dc28b1d41b68a015911953acfce6733db00b32943530bf10c13d85630512948 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	944 B 1 KB	207ms 202ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79b147a-68ef-11ea-aff2-12ff01cc4d58;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=121642545620812c;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash cac55298e83f4c88c96b5bc2b99ee0a04314e2c767bd67d2e611c5cf0699e740 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 944 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	945 B 1 KB	210ms 205ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79b0714-68ef-11ea-815e-123ff9725662;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=110b98bf74e37d22;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 7e2e92d669159358b107556c9b86ff5b1ba35d5b1e935d79ac7a40db0b1714bd Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	944 B 1 KB	195ms 191ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79b14d4-68ef-11ea-a8c2-12495d14311c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=115814a2fbc9b57f;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 57d3744daa3e4a97d7a162739c5f5070d46a3b6fa4531a0ac50fb2b699cd1596 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 944 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	944 B 1 KB	197ms 194ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b44b8-68ef-11ea-b1f1-1204ea82ed4e;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=1191814f910787c3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash b04057e174f96d7a10e9c91bcaf697faeb07068f12c02f725090242a060e6e0f Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 944 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	943 B 1 KB	197ms 195ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79b607e-68ef-11ea-8e71-12b295be6374;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1147a07fe2c183a3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash c417f490d2646b2083154ee5a4955903eb7b599f68b67e7ea2a0d4addd2d26e3 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true accept-ranges bytes content-type application/json content-length 943 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	944 B 1 KB	214ms 214ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;apid=1Ad79d1644-68ef-11ea-81e7-12e7f4d03460;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1180fcbe0559b8e7;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 5ee8f3313ec01016fe30dd7d34016c47c59f5734c21c963b8d61f53188fe435a Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 944 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	945 B 1 KB	183ms 183ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;apid=1Ad79d0316-68ef-11ea-97f4-12dc2d808526;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=1179fe36f48980f1;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 0c4441edaf7db525fe9784cae8092e98a269fed4a0ad9770b120b9cbb0be7265 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	945 B 1 KB	198ms 198ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;apid=1Ad79d1086-68ef-11ea-ab88-12d220623a1c;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=113250055f740b14;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 002c969385f199e96b50bf99698fdfab46f3bc5befd3bc54878fd2b919c47264 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	945 B 1 KB	183ms 182ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;apid=1Ad79d65b8-68ef-11ea-8ab8-122675b00be4;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=11197abe2db3b7e3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 9b01d7aeaf0e520e0cedbedb5135f38daf1d6a0d6ca75878d0196a034468dbf9 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	389 KB 77 KB	583ms 582ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1887664485623289&correlator=1157366033287841&output=ldjh&impl=fifs&adsid=NT&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200318&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_300x250_300x600_160x600_Right_1%2Cbleepingcomputer_300x250_300x600_160x600_Right_2%2Cbleepingcomputer_728x90_320x50_InContent_1%2Cbleepingcomputer_1x1%2Cbleepingcomputer_300x250_300x600_160x600_Right_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C300x250%7C300x600%2C300x250%7C300x600%2C728x90%2C1x1%2C300x250%7C300x600&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1584106191&dt=1584518991371&dlt=1584518989090&idt=555&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C1082%2C1082%2C268%2C800%2C1082&adys=146%2C11958%2C327%2C1136%2C9998%2C12464%2C2126&adks=960084856%2C976516616%2C771041174%2C2389526111%2C4047242158%2C2635258439%2C523518761&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&dssz=59&icsg=598134501679104&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120%7C1200x90%7C306x250%7C306x250%7C834x90%7C1600x12465%7C306x250&msz=1170x90%7C1170x90%7C306x250%7C306x250%7C834x90%7C1600x1%7C306x250&ga_vid=72834780.1584518989&ga_sid=1584518990&ga_hid=1319238513&fws=4%2C4%2C4%2C4%2C4%2C4%2C516&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash 03ed7aaaead80cc55baa6e62769bafa0e9d9c21dda2c8161a0fe2803e393c4bf Security Headers Name Value Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14991935873534135823/Index_300x600.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14991935873534135823/Index_300x600.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COmsgJ3Jo-gCFUEFiwodYrEMvw&gqi=&layout=/sadbundle/%24csp%253Der3%24/14991935873534135823/Index_300x600.html X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14991935873534135823/Index_300x600.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14991935873534135823/Index_300x600.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COmsgJ3Jo-gCFUEFiwodYrEMvw&gqi=&layout=/sadbundle/%24csp%253Der3%24/14991935873534135823/Index_300x600.html content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2 google-creative-id -1,-2,-1,-1,-1,138241540478,-1 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 78003 x-xss-protection 0 google-lineitem-id -1,-2,-1,-1,-1,4769125089,-1 pragma no-cache server cafe google-mediationtag-id -2 date Wed, 18 Mar 2020 08:09:51 GMT content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_rendering_2020030501.js Show response securepubads.g.doubleclick.net/gpt/	69 KB 25 KB	16ms 15ms	Script text/javascript	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software sffe / Resource Hash ffdc18ac8f47bcd50dd9c33532c334e7073717a62b367d95b9cb1561048547dc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:51 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Mar 2020 14:08:10 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 25689 x-xss-protection 0 expires Wed, 18 Mar 2020 08:09:51 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	6ms 6ms	Other text/html	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers
GET H/1.1	200 OK	p sb.scorecardresearch.com/ Frame 4883	43 B 309 B	8ms 8ms	Image image/gif	23.5.97.37 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/p?c1=2&c2=17958079&ns_ap_an=ConnatixWeb&ns_ap_bi=*null&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1584518990143&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=1259&ns_st_cl=30000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=v_639404&ns_st_pt=1259&ns_st_dpt=1259&ns_st_ipt=1259&ns_st_et=1259&ns_st_det=1259&ns_st_upc=1259&ns_st_dupc=1259&ns_st_iupc=1259&ns_st_upa=1259&ns_st_dupa=1259&ns_st_iupa=1259&ns_st_lpc=1259&ns_st_dlpc=1259&ns_st_lpa=1259&ns_st_dlpa=1259&ns_st_pa=1259&ns_ts=1584518991403&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc11&ns_st_ge=*null&ns_st_st=*null&ns_st_ce=*null&ns_st_ia=*null&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Connatix&ns_st_ti=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c8=&c9=&cs_ucfr=0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.5.97.37 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-5-97-37.deploy.static.akamaitechnologies.com Software / Resource Hash 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:51 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Expires Mon, 01 Jan 1990 00:00:00 GMT Connection keep-alive Content-Length 43 Content-Type image/gif
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	100ms 99ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081151&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=357ce5c55698ed7d34f41584518991465&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/	944 B 1 KB	194ms 193ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185823/0/0/ADTECH;cfp=1;rndc=1584518991;v=2;cmd=bid;cors=yes;alias=120cd35dfb5d59a3;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash 1204020f24011a5053f839b72109464614d38de09c2f172f5c46c74787f6bf40 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 944 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	99ms 99ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081148&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=a4e969afe5388f98e6a21584518991576&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978 Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/	944 B 1 KB	213ms 212ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185820/0/0/ADTECH;cfp=1;rndc=1584518990;v=2;cmd=bid;cors=yes;alias=116bae55a8351ed2;misc=1584518990978 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash f759886266b70c809fa9b0e52c4a191fd2133249cacc5bb86f1cd34121df0823 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:51 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 944 expires Mon, 15 Jun 1998 00:00:00 GMT
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	99ms 98ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081149&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=224165b0daebb21fc7d61584518991686&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	101ms 98ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081147&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=191e4b768a4f35a12b991584518991795&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:51 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	112ms 111ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash b6b0ceec4fbd2369ad56ccb7aa8e37a71c866eb4d259e65d369780049ead1da7 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:51 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H/1.1	200 OK	514171 Show response vid.springserve.com/vast/ Frame 4883	2 KB 2 KB	134ms 35ms	XHR application/xml	54.171.35.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid.springserve.com/vast/514171?w=640&h=480&cb=&url=bleepingcomputer.com/&schain= Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.35.33 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-35-33.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash 7900c9f3deeaa274a8056acb023ed7a45294de118c7cc79c973725a68a00a9a6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 18 Mar 2020 08:09:52 GMT Content-Encoding gzip Server nginx Content-Type application/xml;charset=UTF-8 Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 909
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 54CF	200 KB 55 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 54CF	200 KB 55 KB	37ms 17ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 54CF	16 KB 6 KB	37ms 16ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49657 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 54CF	92 KB 29 KB	28ms 8ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45957 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 54CF	3 KB 1 KB	35ms 15ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49662 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 54CF	46 KB 15 KB	33ms 14ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45840 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET DATA	200 OK	truncated / Frame 54CF	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 990601b0a517f7b937f74c0d5af585289762d40bbdb76c08b0569343afcab6f1 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-host-v0.js Show response cdn.ampproject.org/rtv/012003031842100/	20 KB 7 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-host-v0.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7fa58b512176de3de4ee84324c9cb545d4ee79937b6a3518af6ed1a5e61378db Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 6411 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 7159 x-xss-protection 0 server sffe date Wed, 18 Mar 2020 06:23:01 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "8d5b3500a9fa769d" accept-ranges bytes timing-allow-origin * expires Thu, 18 Mar 2021 06:23:01 GMT
GET H2	200	bid Show response c.amazon-adsystem.com/e/dtb/	23 B 376 B	48ms 47ms	XHR text/javascript	13.225.86.250 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&pid=ljGOhiOBe6P6B&cb=1&ws=1600x1200&v=7.47.00&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D Requested by Host: c.amazon-adsystem.com URL: https://c.amazon-adsystem.com/aax2/apstag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-86-250.fra2.r.cloudfront.net Software Server / Resource Hash 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:52 GMT via 1.1 999a435eb37a050d3de26fe63534c416.cloudfront.net (CloudFront) server Server x-amz-cf-pop FRA2-C2 status 200 vary User-Agent x-cache Miss from cloudfront content-type text/javascript;charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true timing-allow-origin * content-length 23 x-amz-cf-id Y711gK6ZjAmTZqaCK3TBkL_L0Drt63JJfWv-8ryvM1wcQ_4Cd9fhhA==
GET H2	200	10939549166170857332 tpc.googlesyndication.com/simgad/ Frame 54CF	20 KB 20 KB	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/10939549166170857332?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qndsJ-MCY-0csOVa2j_lQ-kI3BXlQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4f70b518b84ec5f7931e26270620a671e43a25e0a66ae340df079cac07848eaa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 09:18:19 GMT x-content-type-options nosniff last-modified Wed, 17 Jan 2018 15:33:56 GMT server sffe age 1896692 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 20459 x-xss-protection 0 expires Wed, 24 Feb 2021 09:18:19 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54CF	2 KB 3 KB	7ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30963 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54CF	295 B 401 B	7ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36991 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 54CF	0 0	14ms 13ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRmJFEp_QdndYikym2nZgKJ7XO7LL5KIo7Sb0X63Sfkz-S0tznL9hOPQUPPzecWAplTCtLP2NK9FgA7RzAUQyd5m15WbQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 54CF	0 0	18ms 18ms	Image text/html	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CjaC7T9dxXtLFG8GKrATi4rL4C5Tcvo5QoZWvsusGwI23ARABINrXxTlglfrwgYwHoAHti-jrA8gBAuACAKgDAcgDCKoEsgJP0KJDrNO2mHPUSNqTle_YNFJT_iwdlzPcOhvuK8uP4K2bwVXwe4FcEHNYpunS87aqETy4iJbsV6Qzc63qZJrwkoHdAzFFrxQSc48fOAt1eswY6rapE_297ZqU7e6cLUZzlxnQSi83n9IyfnRekTxzqth7Xt5mQY3cVTrP4iPkGrIPvjRMZTLpPigTeMwkuk3tHIGAohmXGMq6q4GmNPdVcrF9fkKAthSXVU9GrMZ_n0s2VQm0OU44njizXGCWfDjAqeK251Pkfskhpq_BntQSt6-D-EtL3z7FEtXVvLnbUnTWJXtgQUJ-6B2IerUZ6ZMvAmaHBQEhkucafsJm7Lo3wUaG2qLqf5mcj3WgW-9pOzasbRmr_VoSKO_7rlEdWKig1cTLkqtZuduknUZRuMc1difABJXT16G9AeAEAZIFBAgEGAGSBQQIBRgEoAYCgAfrz9w2qAeOzhuoB9XJG6gHk9gbqAef2xuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQp6cH0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi0xNzQyMjQ5NjAzMjg5MDgzgAoDyAsB2BMM&sigh=Bt2MW-2dKCY&tpd=AGWhJmtRtDGG4ez3hOshCo4mdlMLlefdkq1F5oRUaPJRWTrY7w Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/ Frame 65C1	0 0	9ms 6ms	Document text/html	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /safeframe/1-0-37/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 2973 date Wed, 18 Mar 2020 07:50:12 GMT expires Thu, 18 Mar 2021 07:50:12 GMT last-modified Thu, 21 Nov 2019 16:01:11 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1180 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame DC00	200 KB 55 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame DC00	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame DC00	16 KB 6 KB	14ms 13ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49657 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame DC00	92 KB 28 KB	11ms 11ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45957 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-animation-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame DC00	104 KB 29 KB	10ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-animation-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b7135b2e9e5637f54cd24526faa3ebc1372d5456df5a2fb9cfa25fe453f19ab0 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 463096 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 29125 x-xss-protection 0 server sffe date Thu, 12 Mar 2020 23:31:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "b778deb48226ddb2" accept-ranges bytes timing-allow-origin * expires Fri, 12 Mar 2021 23:31:36 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame DC00	3 KB 1 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49662 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame DC00	46 KB 15 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45840 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame DC00	2 KB 3 KB	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame DC00	295 B 360 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame DC00	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7dec68e9e714d4f684486292e1137df0d749a915f5abc4afd759f0b7ec4f4c14 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 27CB	200 KB 55 KB	9ms 5ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame 27CB	200 KB 55 KB	12ms 8ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 27CB	16 KB 6 KB	10ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49657 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 27CB	92 KB 28 KB	9ms 5ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45957 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 27CB	3 KB 1 KB	13ms 10ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49662 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame 27CB	46 KB 15 KB	12ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45840 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame 27CB	7 KB 824 B	18ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700 Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash d0cbfb1ab0f94123834567e32df7ec74a1c210793f797368d41a4b4c2732d4a0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 08:09:52 GMT server ESF date Wed, 18 Mar 2020 08:09:52 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 08:09:52 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27CB	2 KB 3 KB	10ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27CB	295 B 355 B	9ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	10861403702499226783 tpc.googlesyndication.com/daca_images/simgad/ Frame 27CB	15 KB 15 KB	10ms 7ms	Image image/jpeg	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/10861403702499226783 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f00a90f19032b0e91e9970c42bdda0179f45fe0c090f8ffe72b2f386f560ab12 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 16:29:59 GMT x-content-type-options nosniff age 747593 x-dns-prefetch-control off status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 15282 x-xss-protection 0 last-modified Tue, 09 Apr 2019 19:03:46 GMT server sffe content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 09 Mar 2021 16:29:59 GMT
GET DATA	200 OK	truncated / Frame 27CB	206 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 76ebd2a7078570fa9f6a50855b4ade57c6b558cca7c95801b2b247406b274975 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated / Frame 27CB	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 377636bc2cd33d0923b30bc949c2e08c36c992f57f9ade4ea89ae10960437c98 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame 3942	0 0	18ms 18ms	Fetch image/gif	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJv8pBx3_lwjbGVU-yhryMOb45LyZJdK8Lzc4X1_qn4Um8GKegSoekydOCj0t1HVnum2iWDGfON_lM5hDxoAQfOSKGeFfHCUp1ZLwhEJed-ugrdwUxrbzt6DLjYamEw5l87_2P-q3GJh3vDlb3xO1fAf0-5xvOwqxrUURiqh2Q_29YRjlOZYuhC75TXrUZfSMM4M-vQGtjHjqUZCy6UM1JClCc1PzXLfXQjcn0rO58HwaVaYms3R24PFNzpgwx80hxGd42c2YWzHMvvta37oehcemAE6aVDlqR&sig=Cg0ArKJSzAcUtGTuZoaLEAE&urlfix=1&adurl= Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest empty Response headers timing-allow-origin * date Wed, 18 Mar 2020 08:09:52 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 0 x-xss-protection 0
GET H2	200	native-loader.js Show response video.unrulymedia.com/native/ Frame 3942	8 KB 3 KB	35ms 10ms	Script application/javascript	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/native/native-loader.js Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 752ef1a6345b85e0fb251fe23288cc437a3d33956c3839f731864943c9b3fec4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:01:03 GMT content-encoding gzip x-amz-expiration expiry-date="Sat, 06 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" last-modified Fri, 06 Mar 2020 10:48:02 GMT server AmazonS3 age 541 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript status 200 cache-control max-age=600 x-amz-cf-pop FRA2-C1 x-amz-cf-id is3pC-ZlWMorzvKZUJ7k4n_gPnwjJ0Q5v22JmRF2s5Os0VUj-5Wpow== via 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 3942	73 KB 28 KB	44ms 38ms	Script text/javascript	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1d7fe0f9bb86a16f6cdbca71a61b250ec61d838cb0cdb2bdd061ee0247783183 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:52 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1584217929168357" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28078 x-xss-protection 0 expires Wed, 18 Mar 2020 08:09:52 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame F7C4	200 KB 55 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp4ads-v0.js Show response cdn.ampproject.org/rtv/012003031842100/ Frame F7C4	200 KB 55 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash be3e6a42b3069b41fa545824978a0b601b4de059253749ad57c8fd1b6bddf45e Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45956 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 55795 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:56 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a96964b23e387b31" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:56 GMT
GET H2	200	amp-ad-exit-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame F7C4	16 KB 6 KB	12ms 12ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-ad-exit-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43ed58a47eaa7134ec3300ded45afc01af073084130eb90beeb389da9814deec Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49657 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5727 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "73b8fa958135ca02" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:15 GMT
GET H2	200	amp-analytics-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame F7C4	92 KB 28 KB	10ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-analytics-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eaad8e5b3abc10a8518e1f8dae5ecea96dc45db3c7461113c9b5f06902e0c50a Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45957 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 28323 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:23:55 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "c55fc50a3cb141e2" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:23:55 GMT
GET H2	200	amp-fit-text-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame F7C4	3 KB 1 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-fit-text-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b3f9cc6b1e1cd02649447c72d77f9cef2fc81cfdea5b47a20f507eed6483a31 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 49662 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1392 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 18:22:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "d4f783c5765ebbae" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 18:22:10 GMT
GET H2	200	amp-form-0.1.js Show response cdn.ampproject.org/rtv/012003031842100/v0/ Frame F7C4	46 KB 15 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012003031842100/v0/amp-form-0.1.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8ad1368b0463703245ec260353fb66da9b8bef31a2468f8392c8eeea6a55cdda Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 45840 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 14845 x-xss-protection 0 server sffe date Tue, 17 Mar 2020 19:25:52 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "688737a9eb3f24de" accept-ranges bytes timing-allow-origin * expires Wed, 17 Mar 2021 19:25:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame F7C4	5 KB 718 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 08:09:52 GMT server ESF date Wed, 18 Mar 2020 08:09:52 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 08:09:52 GMT
GET H2	200	css fonts.googleapis.com/ Frame F7C4	5 KB 718 B	16ms 16ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 x-xss-protection 0 last-modified Wed, 18 Mar 2020 08:09:52 GMT server ESF date Wed, 18 Mar 2020 08:09:52 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 18 Mar 2020 08:09:52 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame F7C4	2 KB 3 KB	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame F7C4	295 B 355 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202003171135/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET DATA	200 OK	truncated / Frame F7C4	216 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c20c03491dccf8f0ae5efc007634df15fbcdec70f4651a454e2281f887aa1eaf Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	204	l www.google.com/ads/measurement/ Frame DC00	0 0	17ms 16ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaS8I72iIy9GHm3tdkYex1Ije7izlFHUlcw8eWyDgCjNCQlyB4iD7_LHrr9_JRo6uzyFafoCyYCQW0SkoZZm2Nh7QXXU5Q Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame DC00	0 0	18ms 17ms	Image text/html	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CbwfLT9dxXo3LG8GKrATi4rL4C7PtkYVcioDfxsILgqbv_74aEAEgx4P8AWCV-vCBjAegAZuI0Z8DyAEJqQKAKwU4rXSyPuACAKgDAcgDCKoEvQJP0JwmvQUSFhdK-Mdp9SJU-6Gi_B3M1DdQyqDflYTdH4fgNLAj1RtDIz_TAW-BS0kMKUmWa2agWRo-5z8izXYDBNzySRwADCuKJffuzo1uywwLlMo7c2UFI1JZUJgLEMernRoxqnpiWki-rCWHaBCld3JlZIDSQeCCiJI9cDgmHf4-07vnSBxLcSh3S5qQFC0KMqjC4Ae4qgPnYrgwWZOXtqhMcn7QuqMhgYfss0TAQaDtVkHXwG0p1NbGL9OqctnkgD93SMk1nTqd79nHLfRjCdzMqJ6Dk8slaOfwVuzhXOCRgAwu4kV6Mxp8r6ZWaWTavHxtr2AJOGLJPoVpuBb5Uf42mtDXZpuexazs5N8efy2X8zPo4CVC3Yqxw7RAA570TRWKsDmwn15G6XJTR-awLgIdrInMcA4jVhEoicAEi5fx4fEC4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB833rmCoB47OG6gH1ckbqAeT2BuoB5_bG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAPIHBBCHmwfSCAkIgOGAEBABGB2ACgHICwHYEww&sigh=2GCtunm8Jw0&template_id=419&tpd=AGWhJmuBWimQATlylEQzrlmREGbwcsACo-RSWJZAWv1C0vyohQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame 27CB	0 0	20ms 19ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaTSuuehegNbH5Rc3WLanU0oPkzCmlUKORA3RatMpXBAceGA8kD6h5yI7dvUXQ-Cw32GTQlJIa3zGK3LkpnoGa2X595iZA Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame 27CB	0 0	19ms 18ms	Image text/html	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CYrr4T9dxXvPMG8GKrATi4rL4C6_8nKlR28Lo1PYGr4G649cCEAEg2tfFOWCV-vCBjAegAZbXhr4DyAEJ4AIAqAMByAMKqgS6Ak_QnF5Pb0N6YOAuqOmmI_iHGqmxilTcJbAxT-7_ndGAx-t77q9LTVH4vxggdWi-IXF4hxMlWVCkL6tAl3AKRUXzPxrI-uhoULijBrgj0s5l_Hzkm2hzGrYMtwvKeuUE1HK_sCKYKXw9UCGgqZWaBgN2I0Rpm1MUXaVbfO88H3x6RiWcOr5_bE38TGPonxzQsgSZEbPm7ktt3WubAZ1kuWFN8aBSNQOwQu_NUzVsCiL01w1aK4ws2zxqgizdaxJHiRV-AH5FxoidUMzEE7dDS_Q6WILbMCIy7Zyly04locrGZUDB62mRwNRucLu61qO9dqR0DG67B14ZkIB7OscYg2zR10sttvdiAt7UDqBR3sg6rVwY3C11NpGrv_AYbwqIq2ZbRnFq0n6G1hrvFISAnyv20_rOB-lhOwmdwATQiM69xgHgBAGSBQQIBBgBkgUECAUYBKAGLoAH0qj5QagHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcA8gcEEL-9BNIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTDA&sigh=-aw0JQp_Z7o&template_id=484&tpd=AGWhJmtOyBeEdolcRYouoZNlVyx9ZeZqrKL-8a-PsAJJsugchA Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/9529452242800146654/ Frame F7C4	12 KB 12 KB	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/9529452242800146654/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgBEhQNAACAPxUAAIA_HQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qmhjUmlxUpBtaDv8yC4GbPGbP-Tyg Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4d3f13f2d30815939159bac675c1a4dd673fc3e0a58b2e312f2aa4fda22109ca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 00:28:54 GMT x-content-type-options nosniff last-modified Mon, 11 Nov 2019 15:34:03 GMT server sffe age 1928458 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11879 x-xss-protection 0 expires Wed, 24 Feb 2021 00:28:54 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/3305498147769900326/ Frame F7C4	78 KB 78 KB	9ms 8ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/3305498147769900326/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgBEhQNAACAPxUAAIA_HQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmi4AOSlwxC5o8BdVYqw-KuHservQ Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c0a3b0af98c293e5d1c1c86e1e7db2c7370748411e774468bb8ccc71aa226846 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 05 Mar 2020 00:19:35 GMT x-content-type-options nosniff last-modified Mon, 11 Nov 2019 15:34:03 GMT server sffe age 1151417 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 79994 x-xss-protection 0 expires Fri, 05 Mar 2021 00:19:35 GMT
GET H2	200	adview securepubads.g.doubleclick.net/pagead/ Frame F7C4	0 0	19ms 18ms	Image text/html	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CGD4xT9dxXq_OG8GKrATi4rL4C429mo9cm-vp9OQK7dORjNsYEAEg2tfFOWCV-vCBjAegAZSOrI0DyAEG4AIAqAMByAMKqgS9Ak_Qhr9Bn4dO0-8PIJbGgkHoPUg0imtUa52B76DeXY6k0dyteCDoV5IOc8cumg-wnuU8dNyEgH8ucNJbLaa1PSK1pilTBhuQi5RpkiE1lMzpQfwESK5-GrAQ6Pg9n7J9T5aVYAnLjSwXaOMw7-PvY8eiCDAlvTomIcl65dB7qOpdC_ZpusuFsn346K_gJ1eTOPQgJTE_5rgOavvhMiRMJgw0Pkk4XjKWBVfKPNVHzR21DDOHuEi3B9-twhTpQUXDPj33ETR4YidbCLOmPBG9L_ULr68PUzuoJQYdP5Fh7FcY2a7tqSwDtHT2eurJ37Bz5QnfO8uzSNmRM5Ro93NuEv6Twv_1aWohEMYDnDveDKEnPZN9at8GSOwvv0bP2kL8U-Q8repceRmlYdacR30v-QBV4nKcE-HFpkb8FmKiwASdqpvtwgLgBAGSBQQIBBgBkgUECAUYBKAGN4AH1PHTcqgHjs4bqAfVyRuoB5PYG6gHn9sbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEKC_B9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA8gLAdgTAogUAw&sigh=zvaDz3ddfhw&template_id=492&tpd=AGWhJmuhdl58cqcLhkoagFHuEMLq3ov9h8K8gH3AHXzmxZrnjw Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame F7C4	0 0	20ms 19ms	Image text/html	2a00:1450:4001:824::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRK_AyzpmXCGI46CJV1bLFRdUGnYuJXl9qdRMTmIy2EbRnqWcbr0S_bN8VrwSo2gc8DbztkrlRnxkCUSylxxJ6hBskA5A Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 27CB	11 KB 11 KB	52ms 52ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 31 Jan 2020 00:50:19 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:58 GMT server sffe age 4087173 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11020 x-xss-protection 0 expires Sat, 30 Jan 2021 00:50:19 GMT
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 27CB	11 KB 11 KB	52ms 52ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92606bd38901e67d069f2ef883715b6e5ae07d72ae3bead3ad92346528374afc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700 Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:21:18 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:52 GMT server sffe age 1140514 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11180 x-xss-protection 0 expires Fri, 05 Mar 2021 03:21:18 GMT
POST H2	200	auction Show response tlx.3lift.com/header/	19 B 482 B	120ms 120ms	XHR application/json	35.158.187.234 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tlx.3lift.com/header/auction?lib=prebid&v=3.6.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tmax=1200 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.158.187.234 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-158-187-234.eu-central-1.compute.amazonaws.com Software / Resource Hash 0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:52 GMT status 200 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true content-type application/json; charset=utf-8 content-length 19 x-xss-protection 0 expires Thu, 15 Oct 1992 20:10:00 GMT
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	24ms 24ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=WLM6GiL3zdSZQxjuNieepuQJ&bidId=135ff124ecfe1e67&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:52 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
GET H2	204	v1 Show response btlr.sharethrough.com/WYu2BXv1/	0 119 B	35ms 35ms	XHR text/plain	35.157.40.103 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=bDraMWgeoLM4KHJBzFQ8heMv&bidId=1360c2b396223af7&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=3.6.0&strVersion=3.2.0&secure=true&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.40.103 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-40-103.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers status 204 date Wed, 18 Mar 2020 08:09:52 GMT access-control-allow-credentials true access-control-allow-origin https://www.bleepingcomputer.com vary Origin
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	146 B 1 KB	37ms 37ms	XHR application/json	185.33.220.145 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 10fe941259558c7895c17bfb09a55d17764617021eb6b9a9732cc9789ed6f377 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:54 GMT X-Proxy-Origin 83.143.245.70; 83.143.245.70; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.71:80 AN-X-Request-Uuid a2afcec6-8747-43fb-9614-58060710ab50 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 146 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/	194 B 384 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash 3fa5c27d717f5649e02cf1aab9a9ff4546b470b3bbffe32663021eaf45fb80ac Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:52 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 194 expires 0
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	139 B 995 B	18ms 18ms	XHR application/json	185.33.220.145 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 87c8ab98a86b85ec16c265a3531725b7eabc7b085e2f8beb59f39c24bdd69d05 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:54 GMT X-Proxy-Origin 83.143.245.70; 83.143.245.70; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.52:80 AN-X-Request-Uuid e13fa066-8644-4d3d-a494-9be8f35699ac Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 139 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	cygnus Show response as-sec.casalemedia.com/	26 B 1 KB	132ms 132ms	XHR application/json	23.210.249.164 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2214388056e762851b%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22144d4bb7e9dc77d6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22145fbe1a74ebf339%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22146d8304deed5075%22%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.io%22%2C%22sid%22%3A%22535%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-210-249-164.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 4419eb51646399e904d3fdf8c2b154b004ec4fa5881ac0f4586ee1412da902d4 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:52 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json Content-Length 46 Expires Wed, 18 Mar 2020 08:09:52 GMT
GET H2	200	arj Show response freestar-d.openx.net/w/1.0/	175 B 367 B	120ms 120ms	XHR application/json	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.1&dddid=8d38083d-a2e0-4bea-8799-9ddf1f0881b2&nocache=1584518992173&pubcid=a4a35cdd-89a5-41b8-b3a3-94e4676a5257&schain=1.0%2C1!freestar.io%2C535%2C1%2C%2C%2C&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=540959250& Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash 453016537ccdfc8591f9c3384b2a04b9f4e6ee04443dfb81a19a0c1521a3fd7e Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:52 GMT content-encoding gzip server OXGW/16.179.0 status 200 vary Accept, Accept-Encoding p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin https://www.bleepingcomputer.com cache-control private, max-age=0, no-cache access-control-allow-credentials true content-type application/json alt-svc clear content-length 164 via 1.1 google expires Mon, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	fastlane.json Show response fastlane.rubiconproject.com/a/api/	263 B 1 KB	98ms 97ms	XHR application/json	69.173.144.140 RUBICONPROJECT
General Check archive.org Show headers Download Go to Full URL https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!freestar.io,535,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&tk_flint=pbjs_lite_v3.6.0&x_source.tid=8d38083d-a2e0-4bea-8799-9ddf1f0881b2&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5351661548268516 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US), Reverse DNS Software RAS 2.4 / Resource Hash 810c8ed6ed0764a999b58d4bd90697c3c797a331351347a80830cb8104965636 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:52 GMT Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, max-age=0, must-revalidate Access-Control-Allow-Credentials true Connection Keep-Alive Content-Type application/json Keep-Alive timeout=5, max=266 Content-Length 263 Expires Wed, 17 Sep 1975 21:32:10 GMT
POST H2	204	v1 Show response dmx.districtm.io/b/	0 168 B	31ms 31ms	XHR text/plain	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dmx.districtm.io/b/v1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers date Wed, 18 Mar 2020 08:09:52 GMT cf-cache-status DYNAMIC server cloudflare status 204 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary origin, Accept-Encoding access-control-allow-methods OPTIONS, POST access-control-allow-origin https://www.bleepingcomputer.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 575d7955195a2c16-AMS access-control-allow-headers origin, content-type
GET H2	200	ADTECH;v=2;cmd=bid;cors=yes;alias=1574ce1598636786;misc=1584518992174; Show response adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/	945 B 1 KB	187ms 187ms	XHR application/json	152.199.21.89 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185819/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1574ce1598636786;misc=1584518992174; Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.21.89 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Adtech Adserver / Resource Hash eb5aefa45530123fa479a81b8baa281125e70d5f9d8a271743e5931b4be407e9 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:52 GMT server Adtech Adserver status 200 access-control-allow-methods POST,GET,HEAD,OPTIONS p3p CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" access-control-allow-origin https://www.bleepingcomputer.com cache-control no-store, no-cache access-control-allow-credentials true content-type application/json content-length 945 expires Mon, 15 Jun 1998 00:00:00 GMT
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=1581cc47db24bc1f;misc=1584518992174; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/	0 0
GET		ADTECH;v=2;cmd=bid;cors=yes;alias=159c7fd572fb0b61;misc=1584518992174; adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/	0 0
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame F7C4	11 KB 11 KB	8ms 7ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 08:47:06 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 1725766 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11016 x-xss-protection 0 expires Fri, 26 Feb 2021 08:47:06 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame F7C4	11 KB 11 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Origin https://www.bleepingcomputer.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:12:39 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 1141033 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11056 x-xss-protection 0 expires Fri, 05 Mar 2021 03:12:39 GMT
GET H2	200	et_v1.0.1608-0-g3152f12.js Show response video.unrulymedia.com/native/ Frame 6513	3 KB 2 KB	21ms 8ms	Script application/javascript	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/native/et_v1.0.1608-0-g3152f12.js Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/native-loader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash dbaf1aee9cd4d1556ca39ce2172af33571ffd8ee3daa91054d5f5ddacd590e96 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 07:06:00 GMT content-encoding gzip age 3833 x-cache Hit from cloudfront status 200 access-control-max-age 3000 via 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront) x-amz-expiration expiry-date="Thu, 04 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" last-modified Wed, 04 Mar 2020 15:05:53 GMT server AmazonS3 vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET content-type application/javascript access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=63072000 access-control-allow-credentials true x-amz-cf-pop FRA2-C1 x-amz-cf-id HREnbccSPsTFQfgSfesB7sHveuztvqRnFokk174iil3q62ZdcihshQ==
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.1.1/ Frame 6513	85 KB 30 KB	17ms 6ms	Script text/javascript	2a00:1450:4001:817::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/native-loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 25 Feb 2020 01:12:47 GMT content-encoding gzip x-content-type-options nosniff age 1925825 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 30244 x-xss-protection 0 last-modified Tue, 20 Dec 2016 18:17:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 24 Feb 2021 01:12:47 GMT
GET H/1.1	200 OK	blank.gif stats3.unrulymedia.com/ Frame 3942	43 B 346 B	2129ms 2023ms	Image image/gif	34.249.205.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://stats3.unrulymedia.com/blank.gif?t=pp_tag_imp&app=native&pid=1101818&id=843570118&d=1584518992217&in_iframe=true&h=v1.0.1608-0-g3152f12&compat=CSS1Compat&pageLoadId=841550114&supplyMode=direct&unr.site.env=html&ts=2020-03-18T08%253A09%253A52.249-%252B01%253A00 Requested by Host: www.bleepingcomputer.com URL: https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 34.249.205.129 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-249-205-129.eu-west-1.compute.amazonaws.com Software nginx/1.4.2 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Wed, 18 Mar 2020 08:09:52 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx/1.4.2 X-Unruly-Server stats3n-eu-075.unrulymedia.com P3P CP="CUR IVDo OUR IND" Cache-Control no-store,no-cache Connection keep-alive Content-Type image/gif Content-Length 43
GET DATA	200 OK	truncated / Frame 3942	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8ac84abed33dd2cfb83b8fdebda0273ecc5a8c7ad496d80e4c7c4e580e415010 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 54CF Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	40ms 40ms	Image text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Wed, 18 Mar 2020 08:09:52 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	10939549166170857332 tpc.googlesyndication.com/simgad/ Frame 54CF	20 KB 20 KB	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/10939549166170857332?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qndsJ-MCY-0csOVa2j_lQ-kI3BXlQ Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4f70b518b84ec5f7931e26270620a671e43a25e0a66ae340df079cac07848eaa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 09:18:19 GMT x-content-type-options nosniff last-modified Wed, 17 Jan 2018 15:33:56 GMT server sffe age 1896693 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 20459 x-xss-protection 0 expires Wed, 24 Feb 2021 09:18:19 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54CF	2 KB 3 KB	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 54CF	295 B 361 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame F7C4 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	39ms 39ms	Image text/html	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers date Wed, 18 Mar 2020 08:09:52 GMT x-content-type-options nosniff server safe location https://googleads.g.doubleclick.net/pagead/drt/si content-type text/html; charset=UTF-8 status 302 cache-control private alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 246 x-xss-protection 0
GET H2	200	native_v1.0.1608-0-g3152f12.js Show response video.unrulymedia.com/native/ Frame 6513	57 KB 16 KB	2052ms 2051ms	Script application/javascript	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/native/native_v1.0.1608-0-g3152f12.js Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/native-loader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash a39e7150295a3599bcf0064c6a61e8f90817586d1bc975df2d4e5a7244a247b5 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 07:06:01 GMT content-encoding gzip age 3834 x-cache Hit from cloudfront status 200 access-control-max-age 3000 via 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront) x-amz-expiration expiry-date="Thu, 04 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" last-modified Wed, 04 Mar 2020 15:05:52 GMT server AmazonS3 vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET content-type application/javascript access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=63072000 access-control-allow-credentials true x-amz-cf-pop FRA2-C1 x-amz-cf-id v041QzQx_FhUsz1C6wd0i0h69dKFzcqkqjyVrqbxnjuyU-gJ0rwDWQ==
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame DC00	2 KB 3 KB	6ms 5ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame DC00	295 B 361 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27CB	2 KB 3 KB	7ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27CB	295 B 361 B	6ms 6ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/9529452242800146654/ Frame F7C4	12 KB 12 KB	11ms 10ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/9529452242800146654/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgBEhQNAACAPxUAAIA_HQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qmhjUmlxUpBtaDv8yC4GbPGbP-Tyg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4d3f13f2d30815939159bac675c1a4dd673fc3e0a58b2e312f2aa4fda22109ca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 25 Feb 2020 00:28:54 GMT x-content-type-options nosniff last-modified Mon, 11 Nov 2019 15:34:03 GMT server sffe age 1928458 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 11879 x-xss-protection 0 expires Wed, 24 Feb 2021 00:28:54 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/3305498147769900326/ Frame F7C4	78 KB 78 KB	8ms 8ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/3305498147769900326/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgBEhQNAACAPxUAAIA_HQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qmi4AOSlwxC5o8BdVYqw-KuHservQ Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c0a3b0af98c293e5d1c1c86e1e7db2c7370748411e774468bb8ccc71aa226846 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Thu, 05 Mar 2020 00:19:35 GMT x-content-type-options nosniff last-modified Mon, 11 Nov 2019 15:34:03 GMT server sffe age 1151417 content-type image/png status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 79994 x-xss-protection 0 expires Fri, 05 Mar 2021 00:19:35 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame F7C4	2 KB 3 KB	8ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 23:33:48 GMT x-content-type-options nosniff content-type image/png server cafe age 30964 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2502 x-xss-protection 0 expires Wed, 18 Mar 2020 23:33:48 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame F7C4	295 B 361 B	7ms 7ms	Image image/png	2a00:1450:4001:81c::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012003031842100/amp4ads-v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 17 Mar 2020 21:53:20 GMT x-content-type-options nosniff content-type image/png server cafe age 36992 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control public, max-age=86400 timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 295 x-xss-protection 0 expires Wed, 18 Mar 2020 21:53:20 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	36 B 344 B	2055ms 2055ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash b6b0ceec4fbd2369ad56ccb7aa8e37a71c866eb4d259e65d369780049ead1da7 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:54 GMT Access-Control-Allow-Credentials true Content-Length 36 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers Content-Type text/plain;charset=utf-8
GET H2	200	vpaid_029b7bdf.js Show response vpaid.springserve.com/production/ Frame 4CC9	448 KB 98 KB	3026ms 27ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://vpaid.springserve.com/production/vpaid_029b7bdf.js Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software AmazonS3 / Resource Hash 015bfce79477b14313fe8b5cfb94c2786af83ec5be508e134973d6203eb439a8 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 18 Mar 2020 08:09:55 GMT content-encoding gzip last-modified Tue, 10 Mar 2020 16:23:34 GMT server AmazonS3 x-amz-request-id 8DEF5E227B8BBD32 etag "14a7eef185ed247664c008dbbb503421" x-hw 1584518995.dop009.wa1.t,1584518995.cds007.wa1.hn,1584518995.cds009.wa1.c content-type application/javascript status 200 cache-control max-age=1968259 accept-ranges bytes access-control-allow-origin * content-length 100182 x-amz-id-2 6AblH8nkVE+rqM9XZVfCsSPhEB1dFdTc36wTGyyPGwoX4hk9reFspz8cYoTJN0036G3+olv/6p4=
GET H2	200	activeview pagead2.googlesyndication.com/pcs/ Frame 54CF	42 B 118 B	40ms 39ms	Image image/gif	2a00:1450:4001:815::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss-DRbEtq3fgGlzDhMqbWwA9ZlO1_DjB628GeINwI5mhS_uIcKyIInOmMxN7hIhRLuY7_KXMDxA4Aa_-7JWp6U80LyneHf8YCWnbWicf1qNyhd1lrLRMjg8tZkeUw&sai=AMfl-YRC5xZskF-MCXzkaoeLDY-vC9nv8I4KFDYQRjGeEBgcwGy1LKT2wA8KHeAkvANW_iXHi1jcja4FcLSLKLULPQuzo0f-EX_uAeR-_f3J_HTNk6ijUw7zjmdNTnC6&sig=Cg0ArKJSzPFrpao5SRW-EAE&cid=CAASF-RoCMqWjOQT9dGPgtGcaIMC-hLIP2Nf&id=ampim&o=315,146&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=236&tls=1236&g=100&h=100&tt=1236&r=v&adk=960084856&avms=ampa Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:53 GMT x-content-type-options nosniff content-type image/gif server cafe access-control-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, must-revalidate timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 240 B	846ms 846ms	XHR text/plain	172.217.16.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1887664485623289&correlator=1157366033287841&output=ldjh&impl=fifs&adsid=NT&vrg=2020030501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200318&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie=ID%3Ddf8fb30c4c52e8de%3AT%3D1584518991%3AS%3DALNI_MbYWxNqtE2imUZK9h9TuBgfqAJniA&cookie_enabled=1&bc=31&abxe=1&lmt=1584106191&dt=1584518993703&dlt=1584518989090&idt=555&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=11958&adks=976516616&ucis=8&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&dssz=55&icsg=598134501679104&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1200x90&msz=1170x90&psts=ABP-KfSglyILSHloR944wA4uKI_oMhxsM4ofjpyumtwbiWQ2cuhCJHMkdtxgHkaEdHc2SU_6aJhqcogmTL1Y&ga_vid=72834780.1584518989&ga_sid=1584518990&ga_hid=1319238513&fws=4&ohw=1600 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020030501.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f2.1e100.net Software cafe / Resource Hash 771469d08a2d082ff2d4c8a987dc6883bc9936b935e563b2b050551d1473a421 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:54 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000 content-length 151 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	202ms 112ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:54 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	skin-1101818.json Show response video.unrulymedia.com/native/skins/ Frame 6513	347 B 941 B	376ms 375ms	XHR application/json	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/native/skins/skin-1101818.json Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash ffd88402bd7da213453634115d1872431f2ff6132e2a7c6aa38644606b3de809 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:55 GMT via 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront) vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method x-amz-cf-pop FRA2-C1 x-cache Miss from cloudfront status 200 content-length 347 x-amz-expiration expiry-date="Wed, 17 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" last-modified Tue, 17 Mar 2020 19:44:32 GMT server AmazonS3 etag "09362ea19ef8bf59029394bda9399b2f" access-control-max-age 3000 access-control-allow-methods HEAD, GET content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=3600 access-control-allow-credentials true accept-ranges bytes x-amz-cf-id vAfZMnMsfkHieay9VuH5y-_HQRAp_qI8RT5gPjoSY7yolX1LznuWQg==
GET H2	200	third-party-iframes.html video.unrulymedia.com/iframes/ Frame 03DD	0 0	8ms 7ms	Document text/html	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/iframes/third-party-iframes.html?h=v1.0.1608-0-g3152f12&siteId=1101818 Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/native_v1.0.1608-0-g3152f12.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash Request headers :method GET :authority video.unrulymedia.com :scheme https :path /iframes/third-party-iframes.html?h=v1.0.1608-0-g3152f12&siteId=1101818 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 content-type text/html content-length 466 date Wed, 18 Mar 2020 08:02:21 GMT last-modified Fri, 06 Mar 2020 10:48:04 GMT x-amz-expiration expiry-date="Sat, 06 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" etag "1c7c0e83e17976fce9500ac342797757" cache-control max-age=600 accept-ranges bytes server AmazonS3 x-cache Hit from cloudfront via 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id gCYe-smPHSl7tKLr-cnoH9ziyWmlvnMETCuTg_PFNHjo9C-pb-tysA== age 454
GET H2	200	chunk-vendors~populatePlacement-2084315d3ad5dab2be56.js Show response video.unrulymedia.com/native/chunks/ Frame 6513	111 KB 30 KB	11ms 10ms	Script application/javascript	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/native/chunks/chunk-vendors~populatePlacement-2084315d3ad5dab2be56.js Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/native_v1.0.1608-0-g3152f12.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash fa7998903339f4a860d696c2be9494f9c14f2abcf35f8485b2a5c7b4381a0bd6 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 07:06:03 GMT content-encoding gzip age 3832 x-cache Hit from cloudfront status 200 access-control-max-age 3000 via 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront) x-amz-expiration expiry-date="Sat, 06 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" last-modified Fri, 06 Mar 2020 10:48:00 GMT server AmazonS3 vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET content-type application/javascript access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=63072000 access-control-allow-credentials true x-amz-cf-pop FRA2-C1 x-amz-cf-id N5XBQQvpAIamfemLYUv-R5RuvIPxCzOEJqh8YXkgClZ3WDTkcFDtZg==
GET H2	200	chunk-populatePlacement-f4ef79eab565c749186c.js Show response video.unrulymedia.com/native/chunks/ Frame 6513	80 KB 22 KB	17ms 17ms	Script application/javascript	13.224.192.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/native/chunks/chunk-populatePlacement-f4ef79eab565c749186c.js Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/native_v1.0.1608-0-g3152f12.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.192.221 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-192-221.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash d09a9bdcc1d22e0db832f5bba526387f3ab990e26c1a4e737155a5e83903fecb Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 07:06:03 GMT content-encoding gzip age 3832 x-cache Hit from cloudfront status 200 access-control-max-age 3000 via 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront) x-amz-expiration expiry-date="Sat, 06 Mar 2027 00:00:00 GMT", rule-id="Delete after 7 years" last-modified Fri, 06 Mar 2020 10:48:00 GMT server AmazonS3 vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET content-type application/javascript access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=63072000 access-control-allow-credentials true x-amz-cf-pop FRA2-C1 x-amz-cf-id vM7oMjkDnG5eNp22lKSOsinUy4qaQXNr6PNUMaTPSiwnceTg03L_kA==
GET H/1.1	200 OK	blank.gif stats3.unrulymedia.com/ Frame 6513	43 B 346 B	29ms 29ms	Image image/gif	34.249.205.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://stats3.unrulymedia.com/blank.gif?t=pp_adcall&site.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&site.domain=www.bleepingcomputer.com&placementName=bleepingcomputer.com%20-%20In-Article&adf=inarticle&imp%5B0%5D.placement=3&supplyMode=direct&app=native&pid=1101818&isMobile=false&pageLoadId=841550114&unr.site.env=html&ts=2020-03-18T08%253A09%253A54.871-%252B01%253A00&perf_consent_start=1584518994445&perf_corejs_start=1584518992217&perf_corejs_end=1584518994446&perf_skin_start=1584518994448&perf_skin_end=1584518994829&perf_adAge_start=1584518994870&id=843570118&d=1584518994871&h=v1.0.1608-0-g3152f12 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 34.249.205.129 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-249-205-129.eu-west-1.compute.amazonaws.com Software nginx/1.4.2 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Wed, 18 Mar 2020 08:09:54 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx/1.4.2 X-Unruly-Server stats3n-eu-075.unrulymedia.com P3P CP="CUR IVDo OUR IND" Cache-Control no-store,no-cache Connection keep-alive Content-Type image/gif Content-Length 43
GET H2	204	2.2 targeting.unrulymedia.com/openrtb/ Frame 6513	0 0	101ms 39ms	Fetch	52.31.26.221 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://targeting.unrulymedia.com/openrtb/2.2?uuid=2e4df11b-0c63-4b2b-88bf-2b5b7002021d&site.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&site.domain=www.bleepingcomputer.com&video_width=834&video_height=469&allowDisplay=false&imp%5B0%5D.placement=3&unr.site.env=html&h=v1.0.1608-0-g3152f12 Requested by Host: video.unrulymedia.com URL: https://video.unrulymedia.com/native/chunks/chunk-populatePlacement-f4ef79eab565c749186c.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.31.26.221 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-31-26-221.eu-west-1.compute.amazonaws.com Software / Resource Hash Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 date Wed, 18 Mar 2020 08:09:54 GMT access-control-allow-credentials true x-unruly-server c7-unrulyx-eu-31c371.unrulymedia.com access-control-allow-origin https://www.bleepingcomputer.com p3p CP="CUR IVDo OUR IND"
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	116ms 116ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:54 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H/1.1	200 OK	blank.gif stats3.unrulymedia.com/ Frame 6513	43 B 346 B	28ms 28ms	Image image/gif	34.249.205.129 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://stats3.unrulymedia.com/blank.gif?t=no_ads&placementName=bleepingcomputer.com%20-%20In-Article&adf=inarticle&imp%5B0%5D.placement=3&supplyMode=direct&message=Empty%20VAST%20Response&app=native&pid=1101818&isMobile=false&pageLoadId=841550114&unr.site.env=html&ts=2020-03-18T08%253A09%253A54.976-%252B01%253A00&perf_consent_start=1584518994445&perf_corejs_start=1584518992217&perf_corejs_end=1584518994446&perf_skin_start=1584518994448&perf_skin_end=1584518994829&perf_adAge_start=1584518994870&perf_vast_0_start=1584518994873&id=843570118&d=1584518994977&h=v1.0.1608-0-g3152f12 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_CBC Server 34.249.205.129 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-249-205-129.eu-west-1.compute.amazonaws.com Software nginx/1.4.2 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Wed, 18 Mar 2020 08:09:54 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx/1.4.2 X-Unruly-Server stats3n-eu-075.unrulymedia.com P3P CP="CUR IVDo OUR IND" Cache-Control no-store,no-cache Connection keep-alive Content-Type image/gif Content-Length 43
GET H2	200	oath-viewability-sdk.js Show response cdn-ssl.vidible.tv/prod/client-utils/js/ Frame 4CC9	29 KB 8 KB	87ms 16ms	Script application/javascript	2a00:1288:f03d:1fa::2000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://cdn-ssl.vidible.tv/prod/client-utils/js/oath-viewability-sdk.js Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ee927c0f8febd54d8dc95a7f74b6aafc749477b15872f5b303162dc477269e34 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Sat, 07 Mar 2020 22:03:45 GMT content-encoding gzip x-content-type-options nosniff age 900371 status 200 strict-transport-security max-age=15552000 content-length 7868 x-amz-id-2 FsR/KfBu2X9p0M0BnqSdQXgEVafSZIXbpwHucf81bniysY/AxwpZ5KDR0mnVgHSLaPulUKXZhjk= referrer-policy no-referrer-when-downgrade last-modified Tue, 23 Jan 2018 04:39:44 GMT server ATS etag "f89c71522a28b573b7e8c681892779ce-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding access-control-allow-methods GET x-amz-request-id E6D2FF7C322D181D access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=1209600 x-amz-version-id MuMCHfak_fz.RiQjb8ttinJCtw0a9HGU accept-ranges bytes content-type application/javascript
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 4CC9	19 B 719 B	25ms 25ms	XHR application/json	185.33.220.145 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:57 GMT X-Proxy-Origin 83.143.245.70; 83.143.245.70; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.83:80 AN-X-Request-Uuid 17f8b772-f076-4da7-b6be-5a3f7a28060c Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 19 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/ Frame 4CC9	160 B 861 B	16ms 16ms	XHR application/json	185.33.220.145 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.145 , Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash 6f9594b2e1540cd9b2955802e07891bc4d25d761cdc4be4dd720273185595b94 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:57 GMT X-Proxy-Origin 83.143.245.70; 83.143.245.70; 623.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.84:80 AN-X-Request-Uuid b0b1ea72-08dc-4a87-bd8a-410d9dc670e3 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 160 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
POST H2	200	24 Show response web.hb.ad.cpe.dotomi.com/s2s/header/ Frame 4CC9	150 B 340 B	14ms 13ms	XHR application/json	2a02:fa8:8806:13::1460 VCLK-EU-
General Check archive.org Show headers Download Go to Full URL https://web.hb.ad.cpe.dotomi.com/s2s/header/24 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:fa8:8806:13::1460 , Sweden, ASN41041 (VCLK-EU-, SE), Reverse DNS Software nginx / Resource Hash fd204c2eb18b046b9dc5fc9fb29daa625a8d330b149a018b1087e2965a2e49c8 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 18 Mar 2020 08:09:55 GMT server nginx status 200 content-type application/json access-control-allow-origin https://www.bleepingcomputer.com cache-control no-cache access-control-allow-credentials true content-length 150 expires 0
GET H/1.1	200 OK	trinity.json Show response apex.go.sonobi.com/ Frame 4CC9	44 B 667 B	64ms 24ms	XHR application/json	178.162.133.150 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://apex.go.sonobi.com/trinity.json?key_maker={%22987830ae%22:%225923ef4d1eab65890133|640x480|f=4%22}&ref=https%3A%2F%2Fbleepingcomputer.com%2F&s=987830ae-cf98-4c08-a671-c411bd26553e&pv=987830ae-cf98-4c08-a671-c411bd26553e&vp=tablet&lib_name=prebid&lib_v=pbjs_lite_v1.25.0&us=0 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS ams-1-apex.go.sonobi.com Software sonobi-go / Resource Hash 2f2565ec8a0afc877e0be4ce3ae15ccdeb969ec7803203c496e86010f65cd6dc Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 18 Mar 2020 08:09:55 GMT Content-Encoding gzip Server sonobi-go Vary negotiate,Accept-Encoding X-Go-Server apex-ams-1-6-8 P3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Access-Control-Allow-Origin https://www.bleepingcomputer.com Cache-Control no-cache, no-store, private Access-Control-Allow-Credentials true Tcn Choice Content-Type application/json Content-Length 72 X-Xss-Protection 0 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	bc2 Show response bc-rtb-dub.springserve.com/ Frame 4CC9	20 B 320 B	252ms 113ms	XHR application/json	52.18.86.70 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bc-rtb-dub.springserve.com/bc2?r=987830ae-cf98-4c08-a671-c411bd26553e-s.514171-d.528021-dc.73340&aid=962&det_d=www.bleepingcomputer.com&det_w=834 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.18.86.70 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-18-86-70.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash b6bdeec47f3b08de017d399bca661bc9c08745f752079597a7e9f3abcf749dad Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Date Wed, 18 Mar 2020 08:09:55 GMT Server nginx Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type application/json Access-Control-Allow-Origin https://www.bleepingcomputer.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 20
POST H/1.1	200 OK	i Show response vid-io.springserve.com/vd/ Frame 4CC9	0 217 B	131ms 31ms	XHR text/plain	52.17.64.209 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vid-io.springserve.com/vd/i?suuid=987830ae&ps_id=514171&batch=1 Requested by Host: vpaid.springserve.com URL: https://vpaid.springserve.com/production/vpaid_029b7bdf.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.17.64.209 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-17-64-209.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:55 GMT Access-Control-Allow-Credentials true Server nginx Connection keep-alive Content-Length 0
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	100ms 100ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081150&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=6e7f4149338bc670b3cc1584518995982&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:56 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H/1.1	200 OK	tracking.png trk.connatix.com/ Frame 4883	0 162 B	149ms 148ms	Image text/plain	3.213.93.144 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://trk.connatix.com/tracking.png?c_rpobidMeta=[{id:15447,c_wt:3558,c_mt:%22application%2Fjavascript%22,c_rs:%222_%2522NO_FILL%2522_undefined%22}]&cb=6be1d4be47413a456df81584518996105&c_pl=zvRPplZQ2s7EFKVgUADKAjWq6VINOC1aMXwakKiLTQXww4NS-rrRMcMC5YYcsEcHJyP2b3z_QQr8xKDWB2UUboOib-0yIrfI80DN7X_xcDbM5cAsI0OrhQ2vCx7azLKnsu3YevQc6UVmQPD89zIFxy_CPLxwvDHjcFX9Yt7SF_v5ONq6yfcJi04yvmhk7bSAJd_nuWCy9CIy2VrZ1A5sHZwfy5ze0gderlYpkpXD4K9oR1_llbPFExUwRIrEy7nzDLPxxCrs8Dwc4AkZHPFwTQ&c_v=1911_1_0_0_0&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-inf&xplt=false&spp=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.213.93.144 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-213-93-144.compute-1.amazonaws.com Software nginx/1.15.9 (Ubuntu) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Access-Control-Allow-Origin * Date Wed, 18 Mar 2020 08:09:56 GMT Server nginx/1.15.9 (Ubuntu) Connection keep-alive Content-Length 0
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	99ms 98ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081146&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=2dd42d544f2199e7ad6d1584518996096&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:56 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	2 B 118 B	98ms 97ms	XHR application/json	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081151&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=e0762216ce0b9429081b1584518996218&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Wed, 18 Mar 2020 08:09:56 GMT server nginx access-control-allow-origin * content-length 2 access-control-max-age 0 content-type application/json
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	98ms 98ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081148&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=ee16f5e658028a5740fe1584518996324&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:56 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	99ms 98ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081149&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=a73d932f48cf937973551584518996430&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:56 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
GET H2	200	ad Show response ssp.lkqd.net/ Frame 4883	168 B 361 B	99ms 99ms	XHR application/xml	146.20.128.101 RACKSPACE
General Check archive.org Show headers Download Go to Full URL https://ssp.lkqd.net/ad?pid=593&sid=1081147&output=svpaid&support=html5&execution=any&placement=&playinit=auto&volume=0&width=834&height=470&dnt=[do_not_track]&gdpr=1&gdprcs=&ip=83.143.245.70&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&pageurl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&contentid=[content_id]&contenttitle=BleepingComputer%20Highlights%20Feed%20-%20Daily%20Highlights&contentlength=30&contenturl=[content_url]&rnd=2011080901040581340b1584518996538&schain=1.0,1!connatix.com,102734,1,,,, Requested by Host: cdns.connatix.com URL: https://cdns.connatix.com/p/1911/min/connatix.renderer.infeed.min_dc.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.20.128.101 San Antonio, United States, ASN27357 (RACKSPACE, US), Reverse DNS Software nginx / Resource Hash 0863882f1d6ce836e3dcf7123e95e2c188fd7d4eda775c696ded7e1d82c61080 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Mar 2020 08:09:56 GMT server nginx status 200 content-type application/xml; charset=UTF-8 access-control-allow-origin https://www.bleepingcomputer.com cache-control max-age=0, no-cache, no-store access-control-allow-credentials true content-length 168
POST H/1.1	200 OK	c Show response c.pub.network/	0 267 B	112ms 112ms	XHR text/plain	35.226.36.58 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://c.pub.network/c Requested by Host: a.pub.network URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.226.36.58 , United States, ASN15169 (GOOGLE, US), Reverse DNS 58.36.226.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Origin https://www.bleepingcomputer.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.bleepingcomputer.com Date Wed, 18 Mar 2020 08:09:56 GMT Access-Control-Allow-Credentials true Content-Length 0 Vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET H2	200	index.html cdn.districtm.io/ids/ Frame 81EC	0 0	119ms 118ms	Document text/html	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 date Wed, 18 Mar 2020 08:09:57 GMT content-type text/html set-cookie __cfduid=d93cdf611e48a778b9e307687ea814a361584518997; expires=Fri, 17-Apr-20 08:09:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 575d79785c8f2c16-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H2	200	sync eb2.3lift.com/ Frame 95C4 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	8ms 8ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=247683223926493924 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 date Wed, 18 Mar 2020 08:09:57 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQz87E5Y4uCgoI4gEQz87E5Y4uCgoI5gEQz87E5Y4uCgkICRDPzsTlji4KCgipARDPzsTlji4KCQg5EM_OxOWOLgoJCDoQz87E5Y4uCgkICxDPzsTlji4KCgjOARDPzsTlji4KCQgfEM_OxOWOLg==; Max-Age=7776000; Expires=Tue, 16 Jun 2020 08:09:57 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=247683223926493924; Max-Age=7776000; Expires=Tue, 16 Jun 2020 08:09:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Wed, 18 Mar 2020 08:09:57 GMT content-length 0 set-cookie tluid=247683223926493924; Max-Age=7776000; Expires=Tue, 16 Jun 2020 08:09:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame 7FE0 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	21ms 21ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US cookie i=95dc8767-771e-08cb-29fd-e7f2714d3857|1584518997 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=95dc8767-771e-08cb-29fd-e7f2714d3857|1584518997; Version=1; Expires=Thu, 18-Mar-2021 08:09:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584518997|mOsLgqgikin0fcmWiygu; Version=1; Expires=Thu, 02-Apr-2020 08:09:57 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" date Wed, 18 Mar 2020 08:09:57 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=10a0cb5d-b5f6-02b0-0a38-465cb2f7ff35|1584518997; Version=1; Expires=Thu, 18-Mar-2021 08:09:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Wed, 18 Mar 2020 08:09:57 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	pd eu-u.openx.net/w/1.0/ Frame C342 Redirect Chain https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1	0 0	21ms 21ms	Document text/html	34.95.120.147 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.179.0 / Resource Hash Request headers :method GET :authority eu-u.openx.net :scheme https :path /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US cookie i=95dc8767-771e-08cb-29fd-e7f2714d3857|1584518997 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 vary Accept, Accept-Encoding set-cookie i=95dc8767-771e-08cb-29fd-e7f2714d3857|1584518997; Version=1; Expires=Thu, 18-Mar-2021 08:09:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1584518997|mOsLgqgikin0fcmWiygu; Version=1; Expires=Thu, 02-Apr-2020 08:09:57 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" date Wed, 18 Mar 2020 08:09:57 GMT content-type text/html content-length 482 content-encoding gzip via 1.1 google alt-svc clear Redirect headers status 302 set-cookie i=95dc8767-771e-08cb-29fd-e7f2714d3857|1584518997; Version=1; Expires=Thu, 18-Mar-2021 08:09:57 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None server OXGW/16.179.0 p3p CP="CUR ADM OUR NOR STA NID" location https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 date Wed, 18 Mar 2020 08:09:57 GMT content-length 0 via 1.1 google alt-svc clear
GET H2	200	sync eb2.3lift.com/ Frame 1217 Redirect Chain https://eb2.3lift.com/sync? https://eb2.3lift.com/sync?&ld=1	0 0	8ms 7ms	Document text/html	35.157.209.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eb2.3lift.com/sync?&ld=1 Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.209.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-209-134.eu-central-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority eb2.3lift.com :scheme https :path /sync?&ld=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US cookie tluid=247683223926493924 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 date Wed, 18 Mar 2020 08:09:57 GMT content-type text/html; charset=utf-8 content-length 493 set-cookie sync=CgoIgQIQzs7E5Y4uCgoI4gEQzs7E5Y4uCgoI5gEQzs7E5Y4uCgkICRDOzsTlji4KCgipARDOzsTlji4KCQg5EM7OxOWOLgoJCDoQzs7E5Y4uCgkICxDOzsTlji4KCgjOARDOzsTlji4KCQgfEM7OxOWOLg==; Max-Age=7776000; Expires=Tue, 16 Jun 2020 08:09:57 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=247683223926493924; Max-Age=7776000; Expires=Tue, 16 Jun 2020 08:09:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure content-encoding gzip p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" cache-control no-cache, no-store, must-revalidate Redirect headers status 302 date Wed, 18 Mar 2020 08:09:57 GMT content-length 0 set-cookie tluid=12579379769846225286; Max-Age=7776000; Expires=Tue, 16 Jun 2020 08:09:57 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure location /sync?&ld=1 cache-control no-cache, no-store, must-revalidate p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 4F8C	0 0	26ms 10ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Wed, 18 Mar 2020 08:09:57 GMT Age 19434482 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4046-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 2006678 X-Timer S1584518998.840240,VS0,VE0 Vary Accept-Encoding
GET H/1.1	200 OK	async_usersync.html acdn.adnxs.com/ib/static/usersync/v3/ Frame 7912	0 0	23ms 9ms	Document text/html	151.101.113.108 FASTLY
General Check archive.org Show headers Download Go to Full URL https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx/1.9.13 / Resource Hash Request headers Host acdn.adnxs.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers Server nginx/1.9.13 Content-Type text/html Last-Modified Fri, 20 May 2016 02:07:09 GMT ETag W/"573e714d-3e3" Expires Sun, 06 Aug 2017 09:41:59 GMT Cache-Control max-age=31536000 Access-Control-Allow-Origin * Content-Encoding gzip Via 1.1 varnish 1.1 varnish Content-Length 506 Accept-Ranges bytes Date Wed, 18 Mar 2020 08:09:57 GMT Age 19434482 Connection keep-alive X-Served-By cache-jfk8123-JFK, cache-hhn4072-HHN X-Cache HIT, HIT X-Cache-Hits 1276778, 1308882 X-Timer S1584518998.842214,VS0,VE0 Vary Accept-Encoding
GET H2	200	index.html cdn.districtm.io/ids/ Frame 1390	0 0	106ms 106ms	Document text/html	104.16.68.69 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.districtm.io/ids/index.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.68.69 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority cdn.districtm.io :scheme https :path /ids/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers status 200 date Wed, 18 Mar 2020 08:09:57 GMT content-type text/html set-cookie __cfduid=d93cdf611e48a778b9e307687ea814a361584518997; expires=Fri, 17-Apr-20 08:09:57 GMT; path=/; domain=.districtm.io; HttpOnly; SameSite=Lax cf-ray 575d79787c992c16-AMS cache-control s-maxage=1209600, max-age=14400 last-modified Thu, 10 Jan 2019 16:50:48 GMT strict-transport-security max-age=31536000; includeSubDomains; preload cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding server cloudflare content-encoding br
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame A07C	0 0	23ms 9ms	Document text/html	23.37.55.184 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html Requested by Host: a.pub.network URL: https://a.pub.network/core/prebid-analytics-3.6.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Wed, 04 Mar 2020 22:48:14 GMT Content-Encoding gzip Content-Length 7619 Content-Type text/html; charset=UTF-8 Cache-Control max-age=64391 Expires Thu, 19 Mar 2020 02:03:08 GMT Date Wed, 18 Mar 2020 08:09:57 GMT Connection keep-alive Vary Accept-Encoding
GET		g rtb.connatix.com/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185817/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1581cc47db24bc1f;misc=1584518992174;

Domain

adserver-us.adtech.advertising.com

URL

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5185818/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=159c7fd572fb0b61;misc=1584518992174;

Domain

rtb.connatix.com

URL

https://rtb.connatix.com/g?c_pw=834&c_ph=470&c_tk=C018218D-4AD0-4E01-8158-045425E65946&c_bu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer%2F&c_ivt=0&connatix_sess=jvoj6VvAGdm93CF3bUxXMYXAUm_032AtwJ82OmkCyUy7vgl4gGUlAwmvJhBrLIhCCxmtIrDKZZzGGW7EdiiXQ7ZAbqf0rFC_AzS7SA0bMaGpm6g72ykosva30Vd_zAfa-Y6M6su47h4XQEjsYxzPkMaurpGG_IMHcH1e1utq0LGz212JU_okWcBs5S1ljtqG&notServed=false&xplr=true&c_s=false&c_pl=zvRPplZQ2s7EFKVgUADKAjWq6VINOC1aMXwakKiLTQXww4NS-rrRMcMC5YYcsEcHJyP2b3z_QQr8xKDWB2UUboOib-0yIrfI80DN7X_xcDbM5cAsI0OrhQ2vCx7azLKnsu3YevQc6UVmQPD89zIFxy_CPLxwvDHjcFX9Yt7SF_v5ONq6yfcJi04yvmhk7bSAJd_nuWCy9CIy2VrZ1A5sHZwfy5ze0gderlYpkpXD4K9oR1_llbPFExUwRIrEy7nzDLPxxCrs8Dwc4AkZHPFwTQ&gdpr=1&is_ccpa_b=false&med_id=639404&req_no=2&v=1&c_pt=1&c_f=[{id:14547,r:4,i:0,f:2.68},{id:14554,r:1,i:0,f:6.02},{id:16156,r:1,i:0}]&p=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-coronavirus-ransomware-acts-as-cover-for-kpot-inf&c_v=1911_1_0_0_0&spp=1&callback=cnxJSONP_ead02b66f06526debab51584519000179