www.zdnet.com Open in urlscan Pro
199.232.194.154  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 81

• https://ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/B26301209.312455255;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/B26301209.312455255;dc_pre=CPPSs7-NpPMCFQ4R4AodMCIPWw;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 106

• https://ally.demdex.net/event?d_event=imp&d_src=408698&d_site=7229249&d_creative=157118684&d_placement=312785391&d_campaign=26459418&d_bust=3137386661 HTTP 302
• https://ally.demdex.net/firstevent?d_event=imp&d_src=408698&d_site=7229249&d_creative=157118684&d_placement=312785391&d_campaign=26459418&d_bust=3137386661

140 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/	469 KB 136 KB	7112ms 7050ms	Document text/html	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 531663d77ee8c9f1c8cac45cdcce04820f21fa5733e872f125ae2c53123df720 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.zdnet.com :scheme https :path /article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" link <https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css>; rel="preload"; as="style"; nopush referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id d2a1c18e-01d9-48d8-821e-3585d5de6d44 x-xss-protection 1; mode=block set-cookie nemo_highlander=fastly_resize:1:control; expires=Fri, 01-Oct-2021 06:59:59 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure; date Wed, 29 Sep 2021 11:43:47 GMT via 1.1 varnish cache-control max-age=5400, private expires Wed, 29 Sep 2021 13:13:47 GMT strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent content-length 137721
GET H2	200	main-f1cadb0233-rev.css www.zdnet.com/a/fly/css/core/	323 KB 54 KB	7ms 7ms	Stylesheet text/css	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f36c55e3d9edc4950994cf2cf84ce0f9f7323bb90a1a38150f68d8cee0941853 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 55556 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 11:00:39 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 06 Oct 2021 11:02:53 GMT
GET H2	200	controls-b479ded6c1-rev.css www.zdnet.com/a/fly/css/video/htmlPlayerControls/	25 KB 4 KB	6ms 6ms	Stylesheet text/css	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-b479ded6c1-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 8dc8c16ed4f6bee28114808ce3276ea72c8b3296ed88906ca972032012c82117 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/css/video/htmlPlayerControls/controls-b479ded6c1-rev.css pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 4330 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 11:00:40 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 06 Oct 2021 11:02:53 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	19 KB 7 KB	40ms 23ms	Script application/javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0e45f3b0dad8aa0528790a6dd6dd2831bb8547129bd1320c10fd120118f44616 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 BC5xsXKGgJbQbCzkLNvwBQ== age 3148809 vary Accept-Encoding content-length 6328 x-ms-lease-status unlocked last-modified Wed, 04 Aug 2021 01:49:58 GMT server cloudflare etag 0x8D956EA2A6E73F4 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id b8d637e9-f01e-012a-80bd-8bebf6000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6964f4b1ffd66997-FRA expires Wed, 29 Sep 2021 15:43:47 GMT
GET H2	200	optanon-v1.1.0.js Show response www.zdnet.com/a/privacy/optanon/	36 KB 10 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/privacy/optanon/optanon-v1.1.0.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 10444 x-xss-protection 1; mode=block last-modified Thu, 04 Mar 2021 19:22:21 GMT server ContentServer x-frame-options SAMEORIGIN etag "46e2aa30cbebb708b5fc468d57d56d8b" strict-transport-security max-age=31536000 content-language en via 1.1 varnish cache-control public, max-age=86400 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type application/javascript expires Thu, 16 Sep 2021 06:24:26 GMT
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame 7AA3	205 KB 50 KB	24ms 9ms	Script application/javascript	23.32.243.235 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 23.32.243.235 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-32-243-235.deploy.static.akamaitechnologies.com Software Akamai Resource Optimizer / Resource Hash 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 29 Sep 2021 11:43:47 GMT Content-Encoding br Last-Modified Thu, 02 Sep 2021 17:15:04 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 50393
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H2	200	charlie-osborne.jpg www.zdnet.com/a/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/	935 B 1 KB	16ms 16ms	Image image/jpeg	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/charlie-osborne.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6e66fb7597e4cd496eeb06e3ddcaec86f5358e12bdbdf7fbb3f9818e9fab1c77 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2014/07/22/36b8334d-1175-11e4-9732-00505685119a/thumbnail/40x40/d95deacb5e6bd3a9d82988a322877f5b/charlie-osborne.jpg pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 896 x-xss-protection 1; mode=block last-modified Thu, 15 Jul 2021 05:46:07 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"46f31856dc024a28d6f46d133e03b35c" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 12 Nov 2021 15:00:39 GMT
GET H2	200	require-2.1.2.js Show response www.zdnet.com/a/fly/js/libs/	16 KB 6 KB	9ms 9ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/libs/require-2.1.2.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632430029494824 vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Thu, 23 Sep 2021 21:00:14 GMT server ContentServer x-frame-options SAMEORIGIN etag "250e76b7813acd498cf7d3d44f65f4b1" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 04 Oct 2021 15:00:23 GMT
GET H2	200	mag-white01.png www.zdnet.com/a/fly/1632913080-asset/bundles/zdnetcss/images/core/	1 KB 1 KB	8ms 8ms	Image image/png	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1632913080-asset/bundles/zdnetcss/images/core/mag-white01.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1632913080-asset/bundles/zdnetcss/images/core/mag-white01.png pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 1265 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 11:00:44 GMT server ContentServer x-frame-options SAMEORIGIN date Wed, 29 Sep 2021 11:43:47 GMT strict-transport-security max-age=31536000 content-type image/png cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Oct 2021 11:03:01 GMT
GET H2	200	logo.png www.zdnet.com/a/fly/1632913080-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	6ms 6ms	Image image/png	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1632913080-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/1632913080-asset/bundles/zdnetcss/images/core/logo.png pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-f1cadb0233-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 4105 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 11:00:44 GMT server ContentServer x-frame-options SAMEORIGIN date Wed, 29 Sep 2021 11:43:47 GMT strict-transport-security max-age=31536000 content-type image/png cache-control max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Oct 2021 11:03:01 GMT
GET H2	200	Regular.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 6ms	Font font/woff2	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://www.zdnet.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu :path /a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Mon, 13 Sep 2021 08:18:41 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 13 Sep 2022 15:00:25 GMT
GET H2	200	Semibold.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 7ms	Font font/woff2	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors origin https://www.zdnet.com accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu :path /a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT via 1.1 varnish x-content-type-options nosniff vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Mon, 13 Sep 2021 08:18:41 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 13 Sep 2022 15:00:26 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	33ms 17ms	XHR application/x-javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 xkIaWO5Hr0+rNu9IdoYHdw== age 1983 vary Accept-Encoding content-length 1425 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:53 GMT server cloudflare etag 0x8D94223473B0939 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 5768c4d7-c01e-00ae-0246-a8fb8b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6964f4b288b9695b-FRA
GET H2	200	nr-spa-1210.min.js Show response js-agent.newrelic.com/	41 KB 16 KB	21ms 6ms	Script application/javascript	151.101.130.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-spa-1210.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ae2fc8f8e0697701399521441a03445a3c11d79719accd0099f41687c1536c49 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id S2ZWAVF_bOLxH9dSP4fxyD9xCbMCwnq9 content-encoding gzip etag "d5eff122d09ab2c851fb1780f0287cbf" x-amz-request-id MAGTRK8AS2TWBKPD x-cache HIT cross-origin-resource-policy cross-origin content-length 15563 x-amz-id-2 gGMYV8OIO2MSmkGqcvQY50hjTAfzx2UFXcJLvXe01HcBlULlecvkeuKWxnp+aqSyj4XtQUwDL8o= x-served-by cache-hhn4078-HHN last-modified Tue, 22 Jun 2021 22:47:08 GMT server AmazonS3 x-timer S1632915828.612328,VS0,VE0 date Wed, 29 Sep 2021 11:43:47 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 12854
GET H2	200	main.default.js Show response www.zdnet.com/a/fly/748912-fly/js/	224 KB 71 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/748912-fly/js/main.default.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 3fdea478b92b672165818bca31627641bb3d976ebaf565cf2eb3951871fd3931 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/748912-fly/js/main.default.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 72421 x-xss-protection 1; mode=block last-modified Wed, 29 Sep 2021 11:00:31 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 06 Oct 2021 11:02:54 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame 7AA3	2 KB 1 KB	90ms 78ms	XHR application/json	23.32.243.235 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5443053&v=1.720.0&if=&sl=0&si=0032e1c3-fb97-4d07-9f9d-3abf96582c1b-r071ws&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 23.32.243.235 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-32-243-235.deploy.static.akamaitechnologies.com Software / Resource Hash c626771c6072629a5d232aeda8c80e678d5a527d679592cd028366a2835850bb Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 29 Sep 2021 11:43:47 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 865
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	193 B 398 B	48ms 25ms	Script text/javascript	104.20.185.68 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.20.185.68 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 60756645bbed6ad3cc3e8be0a057dff15132f22b5b60cbe14e48250980043653 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 6964f4b2dfe32bad-FRA
GET H2	200	bidbarrel-zdnet-rv.min.js Show response at.adtech.redventures.io/lib/dist/prod/	601 KB 601 KB	42ms 8ms	Script application/javascript	151.101.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/dist/prod/bidbarrel-zdnet-rv.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash a448f4df2477b69e6afb93be29aa2d752076fa18c23f5421c13dc5a76b3e70a0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT via 1.1 06a27d66e25d02ebcfb014b9d194016b.cloudfront.net (CloudFront), 1.1 varnish age 228 x-cache Miss from cloudfront, HIT content-length 615156 x-served-by cache-hhn4062-HHN last-modified Wed, 08 Sep 2021 13:53:12 GMT server AmazonS3 x-timer S1632915828.679373,VS0,VE1 etag "656910910e572ade18633ae4183df843" vary Accept-Encoding, Origin content-type application/javascript cache-control max-age=900, public, must-revalidate x-amz-cf-pop FRA60-P1 accept-ranges bytes x-amz-cf-id z_Bryt2hT2iCqc8cMgakH8DCzbXk_85xVPRnzCEeHZWKjv4EJBA1zA== x-cache-hits 1
GET H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/1/	49 B 925 B	150ms 133ms	Script text/javascript	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1210.e2a3f80&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=7290&ck=1&ref=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/&ap=6799&be=7136&fe=7239&dc=7209&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1632915820355,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:38,%22c%22:38,%22s%22:44,%22ce%22:63,%22rq%22:63,%22rp%22:7113,%22rpe%22:7126,%22dl%22:7117,%22di%22:7209,%22ds%22:7209,%22de%22:7209,%22dc%22:7239,%22l%22:7239,%22le%22:7239%7D,%22navigation%22:%7B%7D%7D&fp=7223&fcp=7223&at=GkEWQAhCSx5HAxIDThwe&jsonp=NREUM.setToken Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 29 Sep 2021 11:43:47 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC X-NewRelic-App-Data PxQGQlRaAAsCV1BXFR0VMQFTYkEDCBADUxZRDVZkG3xWEU0YdQhAEgVCVAkDEWQcfgEVFk51XhUUUEJQCgMRQBxSFlIUChoAAFIAU3RMB05WAhtDUgAJBABVAgYHBw9eUwhQAUBKBQNcEV0/ Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 6964f4b2eb004ee6-FRA
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	180ms 125ms	Script application/javascript	34.120.203.121 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.203.121 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 121.203.120.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT via 1.1 google last-modified Tue, 12 Jan 2021 17:00:48 GMT etag "5ffdd5c0-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H2	200	mpulse-1.0.2.js Show response www.zdnet.com/a/fly/js/libs/	61 KB 12 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/mpulse-1.0.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/libs/mpulse-1.0.2.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632321243090209 vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Wed, 22 Sep 2021 15:00:15 GMT server ContentServer x-frame-options SAMEORIGIN etag "f26eec453549a0eff7b76f606bd33953" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 30 Sep 2021 09:46:10 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	56ms 44ms	XHR application/json	23.32.243.235 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1632915827676&s=d92046149b439d5b3674b2a55a60d144cd39ebcd0dd10491628e26ffeea61e26 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 23.32.243.235 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-32-243-235.deploy.static.akamaitechnologies.com Software / Resource Hash b882ca3ff41090cb1437b61c37c9949e3f1b80b5eb1c5b4b4154aab699266d98 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 29 Sep 2021 11:43:47 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 807
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.20.0/	376 KB 84 KB	14ms 14ms	Script application/javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jOOTzA5W9ewbfwCUPpt/mw== age 8125970 vary Accept-Encoding content-length 86053 x-ms-lease-status unlocked last-modified Thu, 24 Jun 2021 12:22:20 GMT server cloudflare etag 0x8D9370AB6896F5E expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 1e85a95a-b01e-0126-433f-6b0507000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=691200 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6964f4b30a956997-FRA expires Thu, 07 Oct 2021 11:43:47 GMT
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/	93 KB 20 KB	13ms 13ms	Fetch application/x-javascript	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 AlmWtxV11YCExQkuyz0PJA== age 4553565 vary Accept-Encoding content-length 20136 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:59 GMT server cloudflare etag 0x8D942234AE979B3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 5b1f585d-701e-017f-4ebd-8b0081000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6964f4b34a68695b-FRA
OPTIONS H2	200	diff at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame	0 0	136ms 123ms	Preflight text/html	151.101.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Protocol H2 Server 151.101.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context f4646bea97795a5f1bf727a84f2d63e6 server Google Frontend accept-ranges bytes date Wed, 29 Sep 2021 11:43:47 GMT via 1.1 varnish x-served-by cache-hhn4026-HHN x-cache MISS x-cache-hits 0 x-timer S1632915828.782923,VS0,VE116 vary Accept-Encoding, Origin content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/	95 KB 24 KB	30ms 6ms	Script text/javascript	151.101.1.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash c84000520453425cc10e441fcd3c5b939b0b74dfcc68c4d1e7e41847ec51b501 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 29 Sep 2021 11:43:47 GMT Content-Encoding gzip Age 3099 X-Cache HIT Connection keep-alive Content-Length 24106 x-amz-id-2 juThEG7XGbDeUF/wRMPd8c3J5yjRVmqHm3TpiJyvGg3aAtZVSfvy0De/ZG73xtHjF5rltHsZ4Hk= X-Served-By cache-hhn4031-HHN Last-Modified Wed, 29 Sep 2021 10:38:06 GMT Server AmazonS3 X-Timer S1632915828.772082,VS0,VE0 ETag "2d192a054a9ef6169fef8603cecaf3fd" x-amz-request-id JPBKBQXPV3JVP8YZ Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 255
GET H2	200	diff Show response at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/	185 B 364 B	6ms 6ms	Fetch application/json	151.101.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash 0e245b7d08419cb5979f0cd27c685b7205f3b67d0378b6c8076d47a27a29efa7 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers cat topoc29B3 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type application/json Accept application/json Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ variant core version rv2.25.2 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff age 806 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 179 x-xss-protection 1; mode=block x-served-by cache-hhn4026-HHN access-control-allow-origin * server Google Frontend x-timer S1632915828.905938,VS0,VE0 x-frame-options SAMEORIGIN date Wed, 29 Sep 2021 11:43:47 GMT x-download-options noopen vary Accept-Encoding, Origin content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context ce97b050774bf04f219527fab5d1531d cache-control max-age=900 etag W/7b947b2496566b7b48778205f6010a5eda7349f3 accept-ranges bytes access-control-allow-headers * x-cache-hits 3
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	74 KB 25 KB	44ms 21ms	Script text/javascript	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software sffe / Resource Hash 9ce422e99ae1afc5cd406ceb15cdb321c156f1711f8b2700f8af4b4b597fc400 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1000 / 110 of 1000 / last-modified: 1632913824" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 25131 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Wed, 29 Sep 2021 11:43:47 GMT
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.20.0/assets/	13 KB 3 KB	14ms 14ms	Fetch application/json	104.16.149.64 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.149.64 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OL7qnwFOarng5AW29V9Pw== age 3146188 vary Accept-Encoding content-length 2950 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:42 GMT server cloudflare etag 0x8D94112485FC2D3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id a62ea5e0-601e-004d-2289-981e04000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=691200 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6964f4b3cb7b695b-FRA expires Thu, 07 Oct 2021 11:43:47 GMT
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gptprebidnative/202109271709/	178 KB 57 KB	6ms 6ms	Script application/javascript	151.101.1.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202109271709/wrap.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash e5e78e313a317a211bfa3520f6a5c764e61624b862025c1435742a7cdf851e9a Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 29 Sep 2021 11:43:47 GMT Content-Encoding gzip Age 383 X-Cache HIT Connection keep-alive Content-Length 58274 x-amz-id-2 J0c4kg0oWiy88nYwOZqTdD1bn8JLDCUbVe7NYlR8AHZvP52HU/jWxmvz94tgnrJvw9qyrLYRhJk= X-Served-By cache-hhn4031-HHN Last-Modified Mon, 27 Sep 2021 21:11:06 GMT Server AmazonS3 X-Timer S1632915828.817155,VS0,VE0 ETag "4134deb597556c79cee4127d752affbe" x-amz-request-id CF29KHMN0CHCCQBF Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 989
GET H2	200	cohesion-latest.min.js Show response cdn.cohesionapps.com/cohesion/	76 KB 21 KB	42ms 7ms	Script text/javascript	18.66.139.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 3e472c09cc859df199593110f44bc3352bc55b70bdf25c10820437e068408a04 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip etag W/"2a2da0035274cd76e04d55ff93c05357" last-modified Thu, 23 Sep 2021 12:13:01 GMT server AmazonS3 age 145232 x-amz-server-side-encryption AES256 vary Accept-Encoding x-edge-origin-shield-skipped 0 content-type text/javascript via 1.1 ad3c90e13b86d72e2a5e6bf65eab3451.cloudfront.net (CloudFront) date Tue, 28 Sep 2021 12:13:05 GMT x-cache Hit from cloudfront x-amz-cf-pop FRA60-P4 x-amz-cf-id QZhqxRRNciaD1h4qIsdntl4vUKb1__wsCpqILLk2krIcsYIWPylTpA==
GET H2	200	;ord=1632915827887 ad.doubleclick.net/ddm/ad/bkloi/ldjsifah/iv/	43 B 649 B	57ms 22ms	Image image/gif	142.250.186.166 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/ad/bkloi/ldjsifah/iv/;ord=1632915827887? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.166 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f6.1e100.net Software cafe / Resource Hash 9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:47 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/events/1/	24 B 501 B	119ms 119ms	XHR image/gif	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1210.e2a3f80&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=7570&ck=1&ref=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 content-type text/plain Response headers Date Wed, 29 Sep 2021 11:43:48 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com access-control-allow-credentials true Connection keep-alive CF-Ray 6964f4b48e504ee6-FRA Content-Length 24
GET H2	200	pubads_impl_2021091501.js Show response securepubads.g.doubleclick.net/gpt/	334 KB 117 KB	19ms 18ms	Script text/javascript	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062964 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software sffe / Resource Hash 52c41152c7916b4cf3b3a90f790faa0ba7f746603671e286531bc50407d844ca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 119151 x-xss-protection 0 last-modified Wed, 15 Sep 2021 08:39:44 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Wed, 29 Sep 2021 11:43:47 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 153 B	34ms 16ms	XHR application/json	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash 12717f96c61a500136a8564d666db9b960869a71dd3176a438b53fb08be5c7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:47 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128 x-xss-protection 0 expires Wed, 29 Sep 2021 11:43:47 GMT
GET H2	200	moatheader.js Show response z.moatads.com/redventuresgamheader644747280705/	239 KB 82 KB	75ms 7ms	Script application/x-javascript	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash c7d23011a3e60db63156ffc0217b92c15daee077aafc3d92696796363e63e017 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip last-modified Tue, 21 Sep 2021 16:25:08 GMT server AmazonS3 x-amz-request-id GQKJWGFP8B0DV0AG etag "8643c11e35bc6bd7d41b47ab6a859bc5" vary Accept-Encoding content-type application/x-javascript cache-control max-age=59071 accept-ranges bytes content-length 83232 x-amz-id-2 1XNFlbN86cTBSD8GZWhojTWKY1r7fYna3zQVFF3S1acdykG2TyjF3wKGxmSFbaTJccTiHbTMMAo=
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	308ms 96ms	Preflight	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	304ms 96ms	Preflight	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	304ms 97ms	Preflight	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	303ms 96ms	Preflight	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	109ms 108ms	XHR application/json	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash 0e01c4e2fe2a12294a3f94dd12740e6493875b8ae2d94ffd96e0fc718c9a58c9 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	107ms 106ms	XHR application/json	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash 40cb65ec353619446590bce42ba54b2e2b10932c228bd25a12ea0026fcf5727c Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	111ms 111ms	XHR application/json	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash c628bbdd382c1b537d734671941a1b160b7aa274d43a0bdcadb8e5c2f385b14e Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	137 B 270 B	116ms 115ms	XHR application/json	184.72.183.173 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.183.173 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-183-173.compute-1.amazonaws.com Software / Resource Hash aa61f83bb79e0506136981fe0c75cc0456964c23493fcb6f477658cc4cb0ef57 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT access-control-allow-credentials true content-length 137 vary Origin content-type application/json
GET H2	200	xs1.html Show response cdn.cohesionapps.com/cohesion/ Frame BBD1	2 KB 1 KB	7ms 7ms	Document text/html	18.66.139.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs1.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9 Request headers :method GET :authority cdn.cohesionapps.com :scheme https :path /cohesion/xs1.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Response headers content-type text/html date Tue, 28 Sep 2021 20:25:21 GMT last-modified Thu, 23 Sep 2021 12:13:01 GMT etag W/"10b2c1751c2247b1aeccc91060f971cf" x-amz-server-side-encryption AES256 x-amz-version-id null server AmazonS3 x-edge-origin-shield-skipped 0 content-encoding gzip vary Accept-Encoding x-cache Hit from cloudfront via 1.1 ad3c90e13b86d72e2a5e6bf65eab3451.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 x-amz-cf-id csRg4sA2R6goA0B0mKdT8zDLpOtsTsF3jFvXvd0ADtjIpTVbusqkQg== age 55108
GET H2	200	article-b89ce21f1f-rev.js Show response www.zdnet.com/a/fly/js/pages/	146 KB 39 KB	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/pages/article-b89ce21f1f-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7ccb3192c234a355072ccac2c04aa854b562782fc09c94048683d2a7fbe54b3e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/pages/article-b89ce21f1f-rev.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 39463 x-xss-protection 1; mode=block last-modified Wed, 22 Sep 2021 14:33:45 GMT server ContentServer x-frame-options SAMEORIGIN etag "6630dda02e2e45c300a22fe27fab4899" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 29 Sep 2021 14:36:02 GMT
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 570 B	69ms 28ms	Script application/javascript	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	138 KB 26 KB	492ms 492ms	XHR text/plain	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=907523700142935&correlator=121805761707980&output=ldjh&impl=fifs&eid=31062964%2C31062463%2C44748553&vrg=2021091501&ptt=17&sc=1&sfv=1-0-38&ecs=20210929&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x66%7C5x5%2C300x250%7C300x600%2C300x250%2C300x250%2C728x90%7C970x250%7C970x66&prev_scp=pos%3Dnav%26sl%3Dnav-ad-plus-leader%253FT-1000%26iid%3Dunit%253Dnav-ad-plus-leader%257Cvguid%253D42c4e0cb-8236-43d2-a3c0-85c3937e95b1%257Cpv%253D1%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%26iid%3Dunit%253Dmpu-plus-top%257Cvguid%253D42c4e0cb-8236-43d2-a3c0-85c3937e95b1%257Cpv%253D1%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%26iid%3Dunit%253Dmpu-middle%257Cvguid%253D42c4e0cb-8236-43d2-a3c0-85c3937e95b1%257Cpv%253D1%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%26iid%3Dunit%253Dmpu-bottom%257Cvguid%253D42c4e0cb-8236-43d2-a3c0-85c3937e95b1%257Cpv%253D1%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000%26iid%3Dunit%253Dleader-plus-bottom%257Cvguid%253D42c4e0cb-8236-43d2-a3c0-85c3937e95b1%257Cpv%253D1&eri=1&cust_params=test%3Dfastly_resize%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cblockchain%26tag%3Dcryptocurrency%252Ctarget%252Cblockchain%26mfr%3Dmicrosoft%26pid%3Dmicrosoft-exchange-server%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Da%26pv%3D1%26vguid%3D42c4e0cb-8236-43d2-a3c0-85c3937e95b1&cookie_enabled=1&bc=31&abxe=1&lmt=1632915828&dt=1632915828209&dlt=1632915827472&idt=681&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1050%2C1050%2C1050%2C436&adys=50%2C420%2C1646%2C2278%2C2568&adks=3846852823%2C36326968%2C2638305364%2C3625754864%2C3368778720&ucis=1%7C2%7C3%7C4%7C5&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100%7C370x280%7C370x30%7C370x250%7C1210x0&msz=1600x100%7C370x30%7C370x30%7C370x30%7C1210x0&ga_vid=1830541169.1632915828&ga_sid=1632915828&ga_hid=921840781&ga_fc=false&fws=4%2C4%2C4%2C4%2C4&ohw=1600%2C370%2C370%2C370%2C1600&btvi=0%7C0%7C1%7C2%7C3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0. Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash 223739818e9963bf8ee357ce0e9385a3565031d60dcc4c2a6c23e06c94c81036 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26961 x-xss-protection 0 google-lineitem-id 5783084534,5748803744,5755023283,5783219911,5783219953 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138362440413,138357464880,138360786083,138362955961,138362642886 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html b2d1b9e3dcaa7a7cdbe36b1422457971.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 712B	0 0	67ms 15ms	Document text/html	142.250.184.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://b2d1b9e3dcaa7a7cdbe36b1422457971.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f1.1e100.net Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority b2d1b9e3dcaa7a7cdbe36b1422457971.safeframe.googlesyndication.com :scheme https :path /safeframe/1-0-38/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Wed, 29 Sep 2021 11:43:48 GMT expires Thu, 29 Sep 2022 11:43:48 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	video-player.js Show response www.zdnet.com/a/video-player/uvpjs-rv/3.2.1/	933 KB 248 KB	8ms 7ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/video-player/uvpjs-rv/3.2.1/video-player.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f97926aa27fe2056e80467cdfe9c6bbbc8e628e28467f1bb7c5a4a36a4bfadf4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/video-player/uvpjs-rv/3.2.1/video-player.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 253770 x-xss-protection 1; mode=block last-modified Wed, 18 Aug 2021 20:22:22 GMT server ContentServer x-frame-options SAMEORIGIN etag "5c5fa9a5d2e282f0d520cd290ff4328d" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control public, max-age=604800 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Thu, 23 Sep 2021 09:42:31 GMT
GET H2	200	xs2.html cdn.cohesionapps.com/cohesion/ Frame BBD1	473 B 0	7ms 7ms	Document text/html	18.66.139.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs2.html Requested by Host: cdn.cohesionapps.com URL: https://cdn.cohesionapps.com/cohesion/xs1.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority cdn.cohesionapps.com :scheme https :path /cohesion/xs2.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site same-origin sec-fetch-mode navigate sec-fetch-dest iframe referer https://cdn.cohesionapps.com/cohesion/xs1.html accept-encoding gzip, deflate, br cookie cohsn_xs_id=1db653fe-e335-44c5-b760-66cfb8b8ddfe Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://cdn.cohesionapps.com/cohesion/xs1.html Response headers content-type text/html content-length 473 date Tue, 28 Sep 2021 13:49:34 GMT last-modified Thu, 23 Sep 2021 12:13:01 GMT etag "ffa03bed298484a7755ca23c5431cb28" x-amz-server-side-encryption AES256 x-amz-version-id null accept-ranges bytes server AmazonS3 x-edge-origin-shield-skipped 0 x-cache Hit from cloudfront via 1.1 ad3c90e13b86d72e2a5e6bf65eab3451.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 x-amz-cf-id slK1oZRl77T68YusuqEbT1JwWaVh14SgYKju-qWRGNK6O1JBgndNiw== age 78855
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	21 KB 9 KB	146ms 145ms	XHR text/plain	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=907523700142935&correlator=2039302554879445&output=ldjh&impl=fifs&eid=31062964%2C31062463%2C44748553&vrg=2021091501&ptt=17&sc=1&sfv=1-0-38&ecs=20210929&iu_parts=22309610186%2Caw-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11&fluid=height&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FLL%257CT-1000%26iid%3Dunit%253Dsharethrough-top%257Cvguid%253D42c4e0cb-8236-43d2-a3c0-85c3937e95b1%257Cpv%253D1&eri=1&cust_params=test%3Dfastly_resize%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cblockchain%26tag%3Dcryptocurrency%252Ctarget%252Cblockchain%26mfr%3Dmicrosoft%26pid%3Dmicrosoft-exchange-server%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D2%26session%3Da%26pv%3D1%26vguid%3D42c4e0cb-8236-43d2-a3c0-85c3937e95b1&cookie_enabled=1&bc=31&abxe=1&lmt=1632915828&dt=1632915828247&dlt=1632915827472&idt=681&frm=20&biw=1600&bih=1200&oid=3&adxs=215&adys=1343&adks=697432828&ucis=6&ifi=6&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x150&msz=770x0&ga_vid=1830541169.1632915828&ga_sid=1632915828&ga_hid=921840781&ga_fc=false&fws=4&ohw=770&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0. Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash 6837ddaf09fa2906ac3cd1c2c98c916d765be21d2892fe1b235db7fbf448966a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9228 x-xss-protection 0 google-lineitem-id 5667186874 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138346939033 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	204 No Content	/ Show response 1737ad58.akstat.io/	0 354 B	41ms 26ms	XHR image/gif	23.38.58.249 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://1737ad58.akstat.io/?h.pg=article&h.ab=fastly_resize_control_1&when=1632915828233&cdim.Site_View=desktop&t_other=custom4%7C7118&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=c0cf789675124c659000adee17eed5312c841d87-77f98978-800602a4&h.t=1632915827710&http.initiator=api&rt.start=api&rt.si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&rt.ss=1632915834997&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 23.38.58.249 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-38-58-249.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 1 KB	117ms 116ms	XHR application/json	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ba50409c06f52f9b50c4b11b3f738033d757f6b798bd502cb90047fc5e07bf95 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br tracestate 78034@nr=0-1-2767451-695782612-d63ff90680ef5e85----1632915828279 accept-language de-DE,de;q=0.9 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiZDYzZmY5MDY4MGVmNWU4NSIsInRyIjoiZDNhYmJjMzNmYTEwYjE3NjJhYjViOWFlOTE0MzhjYTAiLCJ0aSI6MTYzMjkxNTgyODI3OSwidGsiOiI3ODAzNCJ9fQ== sec-fetch-dest empty x-requested-with XMLHttpRequest cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 :path /components/breaking-news/xhr/?slug=breaking-news-banner pragma no-cache x-newrelic-id VgEBVlJWCRAGXVRVDwMDUlc= traceparent 00-d3abbc33fa10b1762ab5b9ae91438ca0-d63ff90680ef5e85-01 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept application/json, text/javascript, */*; q=0.01 cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-d63ff90680ef5e85----1632915828279 traceparent 00-d3abbc33fa10b1762ab5b9ae91438ca0-d63ff90680ef5e85-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiZDYzZmY5MDY4MGVmNWU4NSIsInRyIjoiZDNhYmJjMzNmYTEwYjE3NjJhYjViOWFlOTE0MzhjYTAiLCJ0aSI6MTYzMjkxNTgyODI3OSwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff last-modified Wed, 29 Sep 2021 11:34:41 GMT vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFtcXRQODFJfQzkGQ1NSCQ8NBW8MXRVLGhgCHVUJUQFRH1JKBgRTX1EUHgFIQwZTAQRXUgIOUAMCB1ZUUFtAFF5VXkAAZA== x-frame-options SAMEORIGIN date Wed, 29 Sep 2021 11:43:48 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 62d11e1b-abc9-4aa3-8b37-eee57542136d content-type application/json via 1.1 varnish cache-control max-age=5400, private accept-ranges bytes expires Wed, 29 Sep 2021 13:04:41 GMT
GET H2	200	my-finance-widget-7aae3015cd-rev.js Show response www.zdnet.com/a/fly/js/components/	703 B 631 B	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/my-finance-widget-7aae3015cd-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a84086788b252354921398e522c3afd599306017c370cdcbc5827b6deaa7e1da Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/my-finance-widget-7aae3015cd-rev.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632321249588719 vary Accept-Encoding, Accept content-length 421 x-xss-protection 1; mode=block last-modified Wed, 22 Sep 2021 15:00:15 GMT server ContentServer x-frame-options SAMEORIGIN etag "126d32123c10f353514874e289b4f980" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 30 Sep 2021 06:32:17 GMT
GET H2	200	disqus-loader-891338aca1-rev.js Show response www.zdnet.com/a/fly/js/components/	1 KB 824 B	6ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/disqus-loader-891338aca1-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bb852945d8e9ae2dddadccfbce542830d5e86adf940a29239fa2742d6e79e2fb Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/disqus-loader-891338aca1-rev.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632430033487036 vary Accept-Encoding, Accept content-length 685 x-xss-protection 1; mode=block last-modified Thu, 23 Sep 2021 21:00:11 GMT server ContentServer x-frame-options SAMEORIGIN etag "deb2d59251a31d066d4ebd284d3fea94" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 05 Oct 2021 00:52:42 GMT
GET H2	200	shutterstock-1794130912.jpg www.zdnet.com/a/hub/i/r/2021/09/24/30e51b33-8835-47bf-b886-884c1581c0c8/thumbnail/170x128/3b5decebdab6dc73e34abce2453d22a8/	5 KB 5 KB	8ms 5ms	Image image/jpeg	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2021/09/24/30e51b33-8835-47bf-b886-884c1581c0c8/thumbnail/170x128/3b5decebdab6dc73e34abce2453d22a8/shutterstock-1794130912.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 40ab3183c9d9d66dd801983a6aa5eef6ceeb51440a65805f0a93efc7132b9f2e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2021/09/24/30e51b33-8835-47bf-b886-884c1581c0c8/thumbnail/170x128/3b5decebdab6dc73e34abce2453d22a8/shutterstock-1794130912.jpg pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, Accept content-length 5130 x-xss-protection 1; mode=block last-modified Fri, 24 Sep 2021 14:35:19 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"32d4c20ed7f2aa50bdc5b7a10d8b7dce" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 23 Nov 2021 20:35:22 GMT
GET H2	200	gettyimages-1317337924.jpg www.zdnet.com/a/hub/i/r/2021/06/23/28d7c4cd-05e5-42e2-854f-f3989e016aec/thumbnail/170x128/046b25f6bdd25927df39b48cf5b30692/	9 KB 9 KB	7ms 6ms	Image image/jpeg	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2021/06/23/28d7c4cd-05e5-42e2-854f-f3989e016aec/thumbnail/170x128/046b25f6bdd25927df39b48cf5b30692/gettyimages-1317337924.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7e68d1beb3d9920bef574a2057facf5ca0edf370673efca02b645de35ba1238c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2021/06/23/28d7c4cd-05e5-42e2-854f-f3989e016aec/thumbnail/170x128/046b25f6bdd25927df39b48cf5b30692/gettyimages-1317337924.jpg pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1624421777490467 vary Accept-Encoding, Accept content-length 8863 x-xss-protection 1; mode=block last-modified Fri, 09 Jul 2021 19:46:27 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"aabfe6de3d6e8b85e0a450881164979b" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 12 Nov 2021 15:06:16 GMT
GET H2	200	screenshot-2021-09-27-at-10-28-25.png www.zdnet.com/a/hub/i/r/2021/09/27/69c23ac1-a7ac-496d-baa9-05bd2c21eba8/thumbnail/170x128/dfb2dc7e7c85fed79c0a7550c5b6d0c6/	43 KB 43 KB	8ms 7ms	Image image/png	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2021/09/27/69c23ac1-a7ac-496d-baa9-05bd2c21eba8/thumbnail/170x128/dfb2dc7e7c85fed79c0a7550c5b6d0c6/screenshot-2021-09-27-at-10-28-25.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7618e5d6ee57d56919e8f0e6b64d65fb4d0fc85094d54c78838b859a292200f5 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2021/09/27/69c23ac1-a7ac-496d-baa9-05bd2c21eba8/thumbnail/170x128/dfb2dc7e7c85fed79c0a7550c5b6d0c6/screenshot-2021-09-27-at-10-28-25.png pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff content-transfer-encoding binary x-image-exists vary Accept-Encoding, Accept content-length 43988 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag W/"bef6472f89cbec888f5b9ee0e243efda" strict-transport-security max-age=31536000 content-type image/png via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin *
GET H2	200	watching-eye.jpg www.zdnet.com/a/hub/i/r/2017/04/20/96cc5dcf-52b3-4a03-bc10-f9f4d0d5adbe/thumbnail/170x128/07c9c9679cb3568dff529d6b1db18f07/	10 KB 9 KB	7ms 6ms	Image image/jpeg	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/hub/i/r/2017/04/20/96cc5dcf-52b3-4a03-bc10-f9f4d0d5adbe/thumbnail/170x128/07c9c9679cb3568dff529d6b1db18f07/watching-eye.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 5388091f1ad494023d573b7a53e89e4e5bb583ab6e404fe23317d9923a5e0dfb Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/hub/i/r/2017/04/20/96cc5dcf-52b3-4a03-bc10-f9f4d0d5adbe/thumbnail/170x128/07c9c9679cb3568dff529d6b1db18f07/watching-eye.jpg pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1599141138039856 vary Accept-Encoding, Accept content-length 9346 x-xss-protection 1; mode=block last-modified Fri, 09 Jul 2021 19:41:57 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"eeca6b7016a576982f59a821e59e83fd" strict-transport-security max-age=31536000 content-type image/jpeg via 1.1 varnish cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sat, 27 Nov 2021 15:10:11 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 1 KB	1220ms 1220ms	XHR application/json	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 53566d83058af29aa735722b8d8a57746a4e93b65387a49971ac95262636c66e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br tracestate 78034@nr=0-1-2767451-695782612-344b83e75cbc0b16----1632915828292 accept-language de-DE,de;q=0.9 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiMzQ0YjgzZTc1Y2JjMGIxNiIsInRyIjoiNmMwMTAxNGM0NDdhODFhYWEwNzAwY2QyNjZmOWVlYjAiLCJ0aSI6MTYzMjkxNTgyODI5MiwidGsiOiI3ODAzNCJ9fQ== sec-fetch-dest empty x-requested-with XMLHttpRequest cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1 :path /newsletter/xhr/widget-login/?topic=security pragma no-cache x-newrelic-id VgEBVlJWCRAGXVRVDwMDUlc= traceparent 00-6c01014c447a81aaa0700cd266f9eeb0-344b83e75cbc0b16-01 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept application/json, text/javascript, */*; q=0.01 cache-control no-cache :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-344b83e75cbc0b16----1632915828292 traceparent 00-6c01014c447a81aaa0700cd266f9eeb0-344b83e75cbc0b16-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiMzQ0YjgzZTc1Y2JjMGIxNiIsInRyIjoiNmMwMTAxNGM0NDdhODFhYWEwNzAwY2QyNjZmOWVlYjAiLCJ0aSI6MTYzMjkxNTgyODI5MiwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFZWRxcNB0NFUhQ7Rl9XBQMXPUMKVxVnVFtVWgsbTQFPA1JUBgdNVk0IAAlVWU4aABtEAAQEAwFSBgZUB10ACl1RBRFJXwBdElY/ x-frame-options SAMEORIGIN date Wed, 29 Sep 2021 11:43:49 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 65a6f11b-55a4-4898-abdd-414fd46cbce4 content-type application/json via 1.1 varnish cache-control max-age=0, must-revalidate, private set-cookie fly_session=a42f79af4a4dc8bb7e996e6abbf1dbcd; path=/; domain=.zdnet.com; secure; HttpOnly accept-ranges bytes expires Wed, 29 Sep 2021 11:43:49 GMT
GET H2	200	v2 Show response mb.moatads.com/yi/	287 B 462 B	153ms 42ms	Script text/html	18.169.85.185 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&callback=MoatNadoAllJsonpRequest_77552072 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.169.85.185 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-169-85-185.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 42c2e535f4a6dc6fddf2beaf1aae5c783ea2e2ac32b3c25832ef994cbdafad53 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "e76464461d2efb9883356243a819bc5e425fea08" content-length 287 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	83 B 257 B	118ms 25ms	Script text/html	18.134.72.135 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1632915828295&de=85313964691&rx=808435182935&m=0&ar=a583cb13d08-clean&iw=bd6d1e7&q=1&cb=0&cu=1632915828295&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A7224%3A7224%3A7239%3A7209&jk=-1&jm=-1&fs=194656&na=366043710&cs=0&ord=1632915828295&jv=1202936275&callback=DOMlessLLDcallback_77552072 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.72.135 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-72-135.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash fc40e12380cc6440ff0a0729c3f12ef2fab79c53af14e6b6e10e6745177c5b5b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "b08e61acaa083ef9f5b180face538f0776e16779" content-length 83 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	86 B 259 B	118ms 26ms	Script text/html	18.134.72.135 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1632915828295&de=85313964691&rx=808435182935&m=0&ar=a583cb13d08-clean&iw=bd6d1e7&q=2&cb=0&cu=1632915828295&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A7224%3A7224%3A7239%3A7209&jk=-1&jm=-1&fs=194656&na=512972575&cs=0&callback=MoatDataJsonpRequest_77552072 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.72.135 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-72-135.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash a083566ff50520a2003097120de574ec7e1e00dfcc09b5029cb9a5a13492be9b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "05907a109e5f63c0cd93bc9791a83fdf7186336a" content-length 86 content-type text/html; charset=UTF-8
GET H2	200	front-door-carousel-dcdcc78ebc-rev.js Show response www.zdnet.com/a/fly/js/components/	5 KB 2 KB	7ms 6ms	Script application/javascript	199.232.194.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.194.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js pragma no-cache cookie nemo_highlander=fastly_resize:1:control; fly_geo={"countryCode": "de"}; fly_device=desktop; fly_preferred_edition=eu; fly_default_edition=eu; RT="z=1&dm=zdnet.com&si=c330e6cd-8469-4c27-9ef0-23c0fb6904a8&ss=ku5fx2rn&sl=0&tt=0&bcn=%2F%2F685b391d.akstat.io%2F"; OptanonConsent=isIABGlobal=false&datestamp=Wed+Sep+29+2021+11%3A43%3A47+GMT%2B0000+(GMT)&version=6.20.0&hosts=&consentId=cb3e83dc-a991-4919-a03d-6b4ddfe37afe&interactionCount=0&landingPath=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0; arrowImp=true; arrowImpCnt=1; zdnetSessionStarted=true; zdnetSessionCount=1; chsn_cnsnt=tglr_ref%2Ctglr_req%2Ctglr_sess_id%2Ctglr_sess_count%2Ctglr_anon_id%2Ctglr_tenant_id%2Ctglr_virtual_ref%2Ctglr_transit_id%2Cchsn_dcsn_cache%2Cpmpdid%2Cpmpredirected%2Cpmpredir%2Cfuseid%2Ccohsn_xs_id%2Cchsn_auth_id%2ChashID%2CetagID%2CreinforcedID%2ChttpOnlyID%2CfpID%2CflID%2Ctglr_smpl%2Ctglr_reinforce%2Ctglr_gpc_sess_id; tglr_tenant_id=src_1kYsAcdpfzbZ8UlNLYht1RPg3m2; tglr_sess_id=846e90c5-ac4c-479e-a55c-4b675681d923; tglr_sess_count=1; tglr_req=https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/; tglr_ref=; tglr_anon_id=fb36e80f-a194-4b25-952c-a8b3e84313dd; viewGuid=42c4e0cb-8236-43d2-a3c0-85c3937e95b1; upid_433611747=1 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority www.zdnet.com referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff x-goog-meta-x-goog-reserved-source-generation 1632430033445691 vary Accept-Encoding, Accept content-length 1651 x-xss-protection 1; mode=block last-modified Thu, 23 Sep 2021 21:00:14 GMT server ContentServer x-frame-options SAMEORIGIN etag "4cd3ccf82ccb845c458768be6bd955cb" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 04 Oct 2021 15:00:28 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	30ms 29ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsswrAZcQPdEHIcw0kI3OBWpnkRmKAffTHOz7Hnd1YMZMWkyh7Kgjb-sBwQeEhLCEbvV1dkAIagKvvxuNYCkaBKOHnkYwUYREvD0O2c1vL4KY7M5o8ZRPkOpj-PeF6qd4jlvPbYXPRGvYL66N6prZuNLiFamgiyHnaHvLGQgHDlCtU3PO2uab-W5q29mhUhUarB4bt0YL-Ke6tEVQb3tPpZ9S59XgZI-znpcIDoEc2Y9uquNJUd9XZkJ5HH8NEByGuA3ILTQFiBfOoc97dNUypVm1lViCyDXUyGl83I9cP0qgQ9Q1BuulSWYXlkuRC9MHA&sig=Cg0ArKJSzCDLNg2tJfdtEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/	122 KB 37 KB	49ms 27ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062964 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software sffe / Resource Hash 2e2201192d8a342b5f570c4418dc4dcd2c0460243b4f9ba99c60a7c312d13e50 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37837 x-xss-protection 0 server sffe etag "1632742272549041" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="active-view-scs-read-write-acl" expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/	334 KB 112 KB	12ms 12ms	Script application/x-javascript	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062964 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash bfca1731080c45e6c25fba9450707b3588abe7d36b7e5ab919a3efe2801de825 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 21:48:12 GMT server AmazonS3 x-amz-request-id SC8W7A3WSXQ0SNN9 etag "fa23a41f0fd339f7192a4e24c76c9ec1" vary Accept-Encoding content-type application/x-javascript cache-control max-age=21394 accept-ranges bytes content-length 113980 x-amz-id-2 n/P4mf5P42vG2Xz2OmtkdHqVKUrn+mSo3Nal6RhjqRYlEnw6ah7YndTi1le+tpJOEiCPYwZnjMA=
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	72 KB 28 KB	39ms 20ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software sffe / Resource Hash e5668ad294690c0def710438c8462f2eb7ece9e8ef4b7ab53cb93a45d1f8cd7c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27596 x-xss-protection 0 server sffe etag "1632742284803949" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="active-view-scs-read-write-acl" expires Wed, 29 Sep 2021 11:43:48 GMT
GET DATA	200 OK	truncated /	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6c2252d32d141b267361f8434244bf888ec9479af0d2d62736a271e24dbe47f8 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	16ms 8ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=11x11&zMoatPS=top&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1632915828551&de=347548572216&m=0&ar=2b00db7c7e3-clean&iw=7bf3f87&q=6&cb=0&ym=0&cu=1632915828551&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=5009920773%3A2843412950%3A5667186874%3A138346939033&zMoatW=11&zMoatH=11&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A7224%3A7224%3A7239%3A7209&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=194825&na=1826290211&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 9 KB	68ms 27ms	XHR application/json	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091501&st=env Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash e053836795532f6227fb5568362890873d44c2f5d42c6843c7a41b85bc59697a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8542 x-xss-protection 0
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	30ms 29ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstdffDRZptArcLDyztwZE7IKw5cvofBAhkmVLgnWv3iSvRMrkENPw2aUT7R4CYuAGhT0PxzNjWC7tOPv8CR6MD7biHPdxr8M6NR2tn90kwxuqSx6b-98iFgdJPqAdcJTlUpZhnWz4NxPkxiru0fyiz2EpbS0VNSF55NT35SwF7VHJ6f0zcU1Ew4oN0Pv9_QTpbP4o0rAWMGuaTlcyM0AC2RtaK5sVeQJ6BsA5nUGBS-r_AVszn-wz8wXnTt0JES74kQvZBCAyIrpmT_nxW8QLKCBrQFq_WnYPA2lNOWjQds_QPYjuCydgDlQkEmglWGAg-V&sig=Cg0ArKJSzPC_g16dScfbEAE&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	63ms 39ms	Script text/javascript	142.250.185.129 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.129 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f1.1e100.net Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Wed, 29 Sep 2021 11:43:48 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	29ms 29ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssymDPosnie-BmkXkXHT4A7h_ylxYYD2OKeAZqb2-5LnWjpzAJ42txkAEUho62ndTKKnHnT5P6sxfgUcqm_WN1kGe9B_-h7f6a-QE1bKiY86g3sjrIp9ONScgelK6W0_BZiT8Z7_HebW8Uil6ij119eeSMVWxn9LtxdYOl0Bd8StoNNvzXZXIGpafZ4R0TdrP3D1SXqC5BdvGxjaI612f7Yh7JSNo06zc__8O2X-XqMuqDKYQUcusB-CAhnyq1iwBsiIFywHxp7f50CaengAaXdaY8y3EjoILkEV_KElYm0l2jzZOIzmXS_DXUv9CqWwLzBtVQ&sig=Cg0ArKJSzGrx2D42boGKEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H2	200	ad.js Show response clipcentric-a.akamaihd.net/ad/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/	160 KB 43 KB	591ms 481ms	Script text/javascript	2.16.107.105 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://clipcentric-a.akamaihd.net/ad/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/ad.js?q=1629759099 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062964 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.105 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-105.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 29c817cd2c98f5acfe4315ba1972bf02d3d0de7fbf028e948daafd55f82782d1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT content-encoding br last-modified Thu Jan 1 00:00:00 1970 server Apache/2.2.34 cache-control max-age=3600 content-length 44091 content-type text/javascript
GET DATA	200 OK	truncated /	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2f118bfb6e4f2077f527ced8fde041e2867c62e67806095b2dae87eff40cc6ca Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	30ms 30ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst9SmbjxSzlBwb42nv-DZgp0PxyMRyGXswUTK_Sf5JFRnEParhJiICyl-RYYP6MlCV8EzUeYuquhadvFbfNYh2-yTbDmTzzWBMdMlsOuCwEU_p4NS9aVjE-NF0erm10egKQ1TOVYHTZFOf8AbIuO45EMHRF64OX-YSBUaQpgqwB2o6HECw3oynS6aes4V5BGwvB2GErU3SOvRPWvNM1G5RnOxi2WNgQq0Ovd_6yM7CHKDOYplyWWTCiD2F6-m7NSSb-rbT9yd5UYiqpGoQbuqf0i6PtXD13S9wBlzBoHSFjNHQH8oDeliPVkv6WA-TP3EAX4qA&sig=Cg0ArKJSzKRQ3oUBnxajEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET DATA	200 OK	truncated /	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 57e2d035d011b9ac35c7f41fb6ec33d0bf7be5b117ec8af23cab97b339354028 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H3	200	B26301209.312455255;dc_pre=CPPSs7-NpPMCFQ4R4AodMCIPWw;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/ Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/B26301209.312455255;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua... https://ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/B26301209.312455255;dc_pre=CPPSs7-NpPMCFQ4R4AodMCIPWw;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_...	42 B 63 B	41ms 40ms	Image image/gif	142.250.186.166 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/B26301209.312455255;dc_pre=CPPSs7-NpPMCFQ4R4AodMCIPWw;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.166 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N30602.3048754REDVENTURES/B26301209.312455255;dc_pre=CPPSs7-NpPMCFQ4R4AodMCIPWw;dc_trk_aid=505731091;dc_trk_cid=157041449;ord=825755747;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=? cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 7ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatPS=nav&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1632915828760&de=269404293656&m=0&ar=2b00db7c7e3-clean&iw=7bf3f87&q=10&cb=0&ym=0&cu=1632915828760&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=5041399663%3A2902615913%3A5783084534%3A138362440413&zMoatW=5&zMoatH=5&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=nav-ad-plus-leader%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A7224%3A7224%3A7239%3A7209&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=194825&na=1454213409&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:48 GMT
GET H3	200	4522651130063922560 tpc.googlesyndication.com/simgad/	107 KB 107 KB	48ms 21ms	Image image/png	142.250.185.129 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/4522651130063922560? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.129 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f1.1e100.net Software sffe / Resource Hash b172a63318a644afaeb49253e2989c5a57a67b3a76956b65af3e9adb1a8d9a38 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Sun, 26 Sep 2021 03:01:59 GMT x-content-type-options nosniff age 290509 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 109652 x-xss-protection 0 last-modified Tue, 27 Jul 2021 00:28:58 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Mon, 26 Sep 2022 03:01:59 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	49ms 8ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5047434205&L2id=2883957554&L3id=5748803744&L4id=138357464880&S1id=22308610192&S2id=22364980590&ord=1632915828790&r=107509064774&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	50ms 9ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5047434205&L2id=2883957554&L3id=5748803744&L4id=138357464880&S1id=22308610192&S2id=22364980590&ord=1632915828790&r=107509064774&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	48ms 7ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5047434205&L2id=2883957554&L3id=5748803744&L4id=138357464880&S1id=22308610192&S2id=22364980590&ord=1632915828790&r=107509064774&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	view googleads4.g.doubleclick.net/pcs/	0 0	81ms 18ms	Fetch image/gif	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstY35Qsji8Fgj1DtxLS_Rs6EMMAFYDy-yCm-QMYiHixevRCX0yIXiY_yKghpU8Kd03-mc4Wa9z5aF1tF_csEGnAzCo4CcYYHXux1avKzZ284DeUFjK8kDh9RGPbs8abbE1pw1rTfi7Tz_MVTwPYLxMMZTb5m0Ha6cML0JOVa0Hs7l26WlG8NWmaXn7Q4_CvpEI-Zq9tHnpP9TwaU04G-5G-GpdDJSacG4ZRtVNS3kHYr9m10k6IbPc67C1Y76ngrEOHCqF4C48UYesV-laStkbLTkJqCdTCoM3fl4OHCbiNG1yZPYTr-Kt_Okwy7pMmJfcev4WDC7iGjP2l9FmGltz8VrCBGk8bIIxC-AEzj6J7SeNRqKAtpQtB9ZYybzaJUcs4HCD-SA5o&sig=Cg0ArKJSzE9YYWUnP1DMEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H2	200	skeleton.js Show response fw.adsafeprotected.com/rjss/st/747769/56497279/	46 KB 13 KB	169ms 63ms	Script application/javascript	63.33.102.111 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fw.adsafeprotected.com/rjss/st/747769/56497279/skeleton.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 63.33.102.111 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-63-33-102-111.eu-west-1.compute.amazonaws.com Software nginx / Resource Hash e1e8d170940d18b3cecb48812c496a8d4fcf83f17802da7075a56dce076f9aa9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT content-encoding gzip x-server-name app01.ie.303net.net content-type application/javascript;charset=utf-8 access-control-allow-origin fw.adsafeprotected.com cache-control no-cache access-control-allow-credentials true server nginx expires Wed, 31 Dec 1969 23:59:59 GMT
GET H3	200	omrhp_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/	6 KB 3 KB	22ms 7ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp_fy2019.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062964 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash 569411215bdd18d7660a5d2e5385f061c409915fbf4c9058e06ab18b06fb0ad5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:01:59 GMT content-encoding gzip x-content-type-options nosniff age 2509 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2646 x-xss-protection 0 server cafe etag 7823829336074104133 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 13 Oct 2021 11:01:59 GMT
GET DATA	200 OK	truncated /	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 919c58ed9a680e6932f26f6f61e1afca66674d4382ec18893d52a2b52ee3d81a Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	30ms 29ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOuI61w47rVQdogaRYqjS8pA7RFmQxSbrvzNC1ASM-ocOTWu0WhdXV7dxPphtPxpeBUy0zZj6drBhQ2THAj1yICUuAso_puu4IK4Zob8Kjlaf61V2RIMcJeScQtkGdzVzRY49sXbNlrmjJbLvR8ORUaZGnWdp-pJsOoQTpAZn_zwYkBQSTrIqX-dNr803vU4RZECj1f3chkPJCg-TVvaZ_3YBmAkIl7rm9cWceP3UBuntIXUVSPBJtfkiZp-TPmHBIrIArcRNobUzBUHn_83DVWwPzovMdGpB7oDP6dX3sWdF1DGNqSTfryt5emAMikW4&sig=Cg0ArKJSzJhEdau3g2BAEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	dcmads.js Show response www.googletagservices.com/dcm/	9 KB 4 KB	21ms 7ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/dcm/dcmads.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js?31062964 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software sffe / Resource Hash b9faf5ea9fcd5c6aa7e73bba81ca700013fd12c8a19a1a3c0ed0b490fa4388fb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 29 Sep 2021 11:09:21 GMT content-encoding gzip x-content-type-options nosniff age 2067 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4416 x-xss-protection 0 last-modified Tue, 28 Sep 2021 14:35:24 GMT server sffe vary Accept-Encoding report-to {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]} content-type text/javascript cache-control public, max-age=3600 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="ads-dcm-tag" expires Wed, 29 Sep 2021 12:09:21 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	29ms 29ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss4EJIzfUOHocduZRoULmFnbZ8in1Y7M2qYYkKQLYlYIge7dJj4JRxD4UWBq-OrXlZ3sPRejX_Jrim1KPKLPgyWruru4yciGVNvt_LM08WlWl0a_9m062H9-Y4D8ytNHw8eClP8H54wqA_gDrTmtaDdG80o8l3FRUG1jhYAAQF8I1zJHtQyVbWWXY48fasRbvIdoni5U0DlOKaMxwh4LsIBQr0djFzD86SLa709e_G_E1uELHUaUXdhERCee-KuZK44rYK2t6XfN1dSf8U-2KNTcm_OTXysHYZQkP95L9UZeJdMIfHJ6-cT3joH1gF4wcA&sig=Cg0ArKJSzIqCxWyWhkFCEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H2	200	beacon tag.researchnow.com/t/	42 B 467 B	52ms 7ms	Image image/gif	65.9.66.52 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://tag.researchnow.com/t/beacon?pr=285377&adn=3&ca=26006318&si=6514979&pl=311465606&cr=156645417&did=ADID&ord=1015383762&gdpr=&gdpr_consent=&us_privacy=${US_PRIVACY} Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.66.52 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.48 () / PHP/7.2.34 Resource Hash 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:29:52 GMT via 1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront) age 836 x-powered-by PHP/7.2.34 x-edge-origin-shield-skipped 0 p3p CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM' x-cache Hit from cloudfront content-length 42 pragma no-cache server Apache/2.4.48 () content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate x-amz-cf-pop FRA56-C1 x-amz-cf-id dVWIadUUAdoDwKzA21zfBcCNVsGD1ZekNa5AzfapUD66TZMz8gmGag== expires 0
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/224/ Frame C93C	12 KB 5 KB	17ms 16ms	Document text/html	142.250.185.129 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.129 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f1.1e100.net Software sffe / Resource Hash 4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/224/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5029 date Wed, 29 Sep 2021 11:31:45 GMT expires Thu, 29 Sep 2022 11:31:45 GMT last-modified Wed, 02 Jun 2021 17:09:45 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 723 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	aframe Show response www.google.com/recaptcha/api2/ Frame CC7B	783 B 1 KB	59ms 23ms	Document text/html	172.217.23.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.23.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS mil04s23-in-f4.1e100.net Software GSE / Resource Hash 543cfea78cbaf35989fdfab9d731a7b143d9e8ea384011f507c636af4b1c1cb5 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-08m1UpfH0QZ5Iw5oY+dqnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/aframe pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy-report-only require-corp; report-to="recaptcha" report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Wed, 29 Sep 2021 11:43:48 GMT date Wed, 29 Sep 2021 11:43:48 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-08m1UpfH0QZ5Iw5oY+dqnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 513 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1632915828790&de=107509064774&m=0&ar=2b00db7c7e3-clean&iw=7bf3f87&q=14&cb=0&ym=0&cu=1632915828790&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=5047434205%3A2883957554%3A5748803744%3A138357464880&zMoatW=300&zMoatH=600&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=mpu-plus-top%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A7224%3A7224%3A7239%3A7209&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=194825&na=868410026&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:48 GMT
GET H3	200	impl_v79.js Show response www.googletagservices.com/dcm/	37 KB 16 KB	8ms 8ms	Script text/javascript	142.250.186.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/dcm/impl_v79.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/dcm/dcmads.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f2.1e100.net Software sffe / Resource Hash 44abe3410418a547f3412ba93a94ffdfd1dbadf9c785418af8ef15d7877fa2c8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 28 Sep 2021 07:38:13 GMT content-encoding gzip x-content-type-options nosniff age 101135 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15928 x-xss-protection 0 last-modified Mon, 13 Sep 2021 19:19:29 GMT server sffe vary Accept-Encoding report-to {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="ads-dcm-tag" expires Wed, 28 Sep 2022 07:38:13 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F4522651130063922560%3F&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=600&w=1600&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828790&de=107509064774&cu=1632915828790&m=13&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=0&ag=2&an=0&gf=2&gg=0&ix=2&ic=2&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=2&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4&cd=0&ah=4&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5047434205%3A2883957554%3A5748803744%3A138357464880&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=300&zMoatH=600&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=mpu-plus-top%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=945154363&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	22ms 22ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=middle&zMoatSZPS=300x250%20%7C%20middle&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1632915828856&de=501810464862&m=0&ar=2b00db7c7e3-clean&iw=7bf3f87&q=18&cb=0&ym=0&cu=1632915828856&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=5041455538%3A2887319417%3A5755023283%3A138360786083&zMoatW=300&zMoatH=250&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=mpu-middle%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A7224%3A7224%3A7239%3A7209&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=194825&na=1581210847&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:48 GMT
GET H3	200	B26459418.312785391;dc_ver=79.230;dc_eid=40004001;sz=728x90;u_sd=1;nel=1;dc_adk=3866786814;ord=t45lnv;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssebLfFMFBsOIcD-u-rl39... Show response ad.doubleclick.net/ddm/adj/N970858.276655ZDNET/	44 KB 21 KB	35ms 35ms	Script text/javascript	142.250.186.166 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ad.doubleclick.net/ddm/adj/N970858.276655ZDNET/B26459418.312785391;dc_ver=79.230;dc_eid=40004001;sz=728x90;u_sd=1;nel=1;dc_adk=3866786814;ord=t45lnv;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssebLfFMFBsOIcD-u-rl39l8r77lGv9y3k6OBhtI5XcqA-jHFxCjw2MVtRcSjvsZnxtqsaxME15SVIfFc-VRxhTbu6anXu2zZEIndgNIHg8OTVrHzRLfcV5fUW9-CjGlvqxQIUNmzon-ilitas45_BHL2jneDAAjDB8kcehFBn_wj0je-BK7Yo9Ouw2yo_qg_dhHeldOQpYmkfIqlE3-RZkkFYJDNS_JrRTjRnDgCoi_PVlx8eFuMPyHFfI30LDK_A57WN8vlYAC7Ccyd53UN6WHlV3KRScosIjLJhteMffqXeVlFoAE6wNZpuUbPc%26sig%3DCg0ArKJSzISYLBH9b9iYEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F$0;xdt=0;crlt=Yj.TZu0vt7;sttr=23;prcl=s Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/dcm/impl_v79.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.166 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f6.1e100.net Software cafe / Resource Hash 7a4b65de24b63f9edb93d621c15870413a7577b6dac3ad6281f458cfb42544f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21662 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	WOdvqX5MrEWan8NE-dDT01W_bgveDh48divqo2Vh5b0.js Show response pagead2.googlesyndication.com/bg/ Frame C93C	35 KB 13 KB	7ms 7ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/WOdvqX5MrEWan8NE-dDT01W_bgveDh48divqo2Vh5b0.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software sffe / Resource Hash 58e76fa97e4cac459a9fc344f9d0d3d355bf6e0bde0e1e3c762beaa36561e5bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 03:07:42 GMT content-encoding br x-content-type-options nosniff age 30966 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13526 x-xss-protection 0 last-modified Mon, 20 Sep 2021 23:08:00 GMT server sffe vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="botguard-scs" expires Thu, 29 Sep 2022 03:07:42 GMT
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame CC7B	0 0	31ms 30ms	Image text/html	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091501&jk=907523700142935&rc= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/	8 KB 3 KB	6ms 6ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:41:04 GMT content-encoding gzip x-content-type-options nosniff age 164 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3143 x-xss-protection 0 server cafe etag 2416364338287085106 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 13 Oct 2021 11:41:04 GMT
POST H3	200	view googleads4.g.doubleclick.net/pcs/	0 23 B	31ms 17ms	Ping image/gif	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssOuR84U52jnONouFSOVNPjobd6soakzv_s9UJxKdP2PWrS9KpavY4VEEIY1rsQhRsjXWT1K-k75dxggD5aRX0NorpvfhIPIbJ50B65qyFN9Hj-MOhreZo-7SKi-ydCTE_Ksz95oeXaFWVxdlSHCA&sig=Cg0ArKJSzBxkVfukXXBDEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20210922.56233&adurl= Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N970858.276655ZDNET/B26459418.312785391;dc_ver=79.230;dc_eid=40004001;sz=728x90;u_sd=1;nel=1;dc_adk=3866786814;ord=t45lnv;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssebLfFMFBsOIcD-u-rl39l8r77lGv9y3k6OBhtI5XcqA-jHFxCjw2MVtRcSjvsZnxtqsaxME15SVIfFc-VRxhTbu6anXu2zZEIndgNIHg8OTVrHzRLfcV5fUW9-CjGlvqxQIUNmzon-ilitas45_BHL2jneDAAjDB8kcehFBn_wj0je-BK7Yo9Ouw2yo_qg_dhHeldOQpYmkfIqlE3-RZkkFYJDNS_JrRTjRnDgCoi_PVlx8eFuMPyHFfI30LDK_A57WN8vlYAC7Ccyd53UN6WHlV3KRScosIjLJhteMffqXeVlFoAE6wNZpuUbPc%26sig%3DCg0ArKJSzISYLBH9b9iYEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F$0;xdt=0;crlt=Yj.TZu0vt7;sttr=23;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:48 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H/1.1	200 OK	firstevent Show response ally.demdex.net/ Redirect Chain https://ally.demdex.net/event?d_event=imp&d_src=408698&d_site=7229249&d_creative=157118684&d_placement=312785391&d_campaign=26459418&d_bust=3137386661 https://ally.demdex.net/firstevent?d_event=imp&d_src=408698&d_site=7229249&d_creative=157118684&d_placement=312785391&d_campaign=26459418&d_bust=3137386661	42 B 947 B	50ms 50ms	Script image/gif	54.171.163.246 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ally.demdex.net/firstevent?d_event=imp&d_src=408698&d_site=7229249&d_creative=157118684&d_placement=312785391&d_campaign=26459418&d_bust=3137386661 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.163.246 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-163-246.eu-west-1.compute.amazonaws.com Software / Resource Hash 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers DCS dcs-prod-irl1-1-v018-0d71bd386.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains content-encoding gzip X-Content-Type-Options nosniff X-TID VP41qonxR3I= P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Type image/gif Content-Length 59 Expires Thu, 01 Jan 1970 00:00:00 UTC Redirect headers DCS dcs-prod-irl1-2-v018-05b42b657.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains X-TID DnY9I59XQFw= P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Location https://ally.demdex.net/firstevent?d_event=imp&d_src=408698&d_site=7229249&d_creative=157118684&d_placement=312785391&d_campaign=26459418&d_bust=3137386661 Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 UTC
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/	41 KB 15 KB	16ms 16ms	Script text/javascript	142.250.185.129 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.129 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f1.1e100.net Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 16:30:55 GMT content-encoding gzip x-content-type-options nosniff age 69173 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Wed, 28 Sep 2022 16:30:55 GMT
GET H2	200	Ally_Job_Seeker_Tech_2_728x90_Transforming_Tech.png s0.2mdn.net/8877379/	9 KB 9 KB	85ms 14ms	Image image/png	142.250.185.102 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/8877379/Ally_Job_Seeker_Tech_2_728x90_Transforming_Tech.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.102 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f6.1e100.net Software sffe / Resource Hash cbaff319bef1eae6399491a22128fc7c53532807eb7237e5587630cf01b7be45 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 13:12:48 GMT x-content-type-options nosniff last-modified Fri, 03 Sep 2021 20:03:47 GMT server sffe age 81061 content-type image/png access-control-allow-origin * cache-control public, max-age=86400 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9198 x-xss-protection 0 expires Wed, 29 Sep 2021 13:12:48 GMT
GET H/1.1	200 OK	/ d.agkn.com/pixel/2387/	43 B 660 B	73ms 8ms	Image image/gif	18.192.155.173 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d.agkn.com/pixel/2387/?ct=US&st=&city=0&dma=0&zp=&bw=3&che=3137386661&col=26459418,7229249,312785391,505949787,157118684 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.192.155.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-192-155-173.eu-central-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Server Apache-Coyote/1.1 P3P CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Cache-Control no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 43 Expires Sat, 01 Jan 2000 00:00:00 GMT
GET DATA	200 OK	truncated /	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34c5cb3259adca7f247c25cd7f0810ad424671b1ca2482fbd9f74403445d0b58 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 6ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=0&j=&t=1632915828983&de=586220111856&m=0&ar=2b00db7c7e3-clean&iw=7bf3f87&q=22&cb=0&ym=0&cu=1632915828983&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A7224%3A7224%3A7239%3A7209&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=194825&na=1599404545&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:48 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:48 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	7ms 6ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5064483059&L2id=2902944911&L3id=5783219953&L4id=138362642886&S1id=22308610192&S2id=22364980590&ord=1632915828983&r=586220111856&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	8ms 7ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5064483059&L2id=2902944911&L3id=5783219953&L4id=138362642886&S1id=22308610192&S2id=22364980590&ord=1632915828983&r=586220111856&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	7ms 7ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=2&fi=1&apd=4&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5064483059&L2id=2902944911&L3id=5783219953&L4id=138362642886&S1id=22308610192&S2id=22364980590&ord=1632915828983&r=586220111856&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:48 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:48 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	9ms 9ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2F8877379%2FAlly_Job_Seeker_Tech_2_728x90_Transforming_Tech.png&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828983&de=586220111856&cu=1632915828983&m=9&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=0&ag=2&an=0&gf=2&gg=0&ix=2&ic=2&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=2&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4&cd=0&ah=4&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=401949821&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:49 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:49 GMT
GET H2	200	main.gr.19.8.248.js Show response static.adsafeprotected.com/	186 KB 60 KB	76ms 7ms	Script application/javascript	18.66.112.27 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.adsafeprotected.com/main.gr.19.8.248.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.27 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash eebdf79938702147857b839ad40eb72d15039198a7037047f2594861b34c4968 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Tue, 28 Sep 2021 20:05:10 GMT content-encoding gzip age 56320 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 28 Sep 2021 19:49:53 GMT server AmazonS3 etag W/"5a63013af7144f483e91b9eaa7b84842" vary Accept-Encoding x-amz-version-id 2gbG1pdI7EeodCyfWvQIwJrUYmsJozck via 1.1 98652de9f742fc1df9de714d921e14c3.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop FRA56-P5 content-type application/javascript x-amz-cf-id 71afhkEQRErRXbGsvAJ1VTCNYHnGyg7tw93rSG5yTy4WAJV7brjZzg==
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame 20BD	22 KB 8 KB	16ms 16ms	Document text/html	142.250.185.129 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.129 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f1.1e100.net Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/Enqz_20U.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Tue, 28 Sep 2021 07:38:15 GMT expires Wed, 28 Sep 2022 07:38:15 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 101134 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
POST H3	200	view googleads4.g.doubleclick.net/pcs/	0 23 B	18ms 18ms	Ping image/gif	142.250.186.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssOuR84U52jnONouFSOVNPjobd6soakzv_s9UJxKdP2PWrS9KpavY4VEEIY1rsQhRsjXWT1K-k75dxggD5aRX0NorpvfhIPIbJ50B65qyFN9Hj-MOhreZo-7SKi-ydCTE_Ksz95oeXaFWVxdlSHCA&sig=Cg0ArKJSzBxkVfukXXBDEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=96&vt=11&dtpt=96&dett=2&cstd=0&cisv=r20210922.56233&adurl= Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N970858.276655ZDNET/B26459418.312785391;dc_ver=79.230;dc_eid=40004001;sz=728x90;u_sd=1;nel=1;dc_adk=3866786814;ord=t45lnv;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssebLfFMFBsOIcD-u-rl39l8r77lGv9y3k6OBhtI5XcqA-jHFxCjw2MVtRcSjvsZnxtqsaxME15SVIfFc-VRxhTbu6anXu2zZEIndgNIHg8OTVrHzRLfcV5fUW9-CjGlvqxQIUNmzon-ilitas45_BHL2jneDAAjDB8kcehFBn_wj0je-BK7Yo9Ouw2yo_qg_dhHeldOQpYmkfIqlE3-RZkkFYJDNS_JrRTjRnDgCoi_PVlx8eFuMPyHFfI30LDK_A57WN8vlYAC7Ccyd53UN6WHlV3KRScosIjLJhteMffqXeVlFoAE6wNZpuUbPc%26sig%3DCg0ArKJSzISYLBH9b9iYEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F$0;xdt=0;crlt=Yj.TZu0vt7;sttr=23;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:49 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	view securepubads.g.doubleclick.net/pcs/	0 0	29ms 29ms	Fetch image/gif	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuEvRZ-Dq9mpuqCZ7X0aWYKXZVhAzUsxOG_aEsn6ZalF7wkxhhwiqS_QNsXmx8gYDuU5e6RmHZpyI8hOIHVZ5buKRKWjpGXwzcYZauKh4ieMiCihbDWwR7NlmqQ6evJvJvrSZbOp9sdASomott4jhKyyA66UEnySasMiXos-cnKJgay5UhuOtBJW80cmrBAMdVrrqaerWNe8ogUSZRbPTP-aYIptiXAl1CT1r4ofu__iPGsS8qVfyIp1km8_v9o40yN0Bm9tjp6Na8D2-XMx6i9_K7EFlLgvP_i1TkbyEaEbSvLw2b8Sm6rG2MbJtyrYDR5yA&sig=Cg0ArKJSzJdCzfkP7sSOEAE&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Wed, 29 Sep 2021 11:43:49 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Wed, 29 Sep 2021 11:43:49 GMT
GET H3	200	WOdvqX5MrEWan8NE-dDT01W_bgveDh48divqo2Vh5b0.js Show response pagead2.googlesyndication.com/bg/ Frame 20BD	35 KB 13 KB	7ms 6ms	Script text/javascript	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/WOdvqX5MrEWan8NE-dDT01W_bgveDh48divqo2Vh5b0.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software sffe / Resource Hash 58e76fa97e4cac459a9fc344f9d0d3d355bf6e0bde0e1e3c762beaa36561e5bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 03:07:42 GMT content-encoding br x-content-type-options nosniff age 30967 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13526 x-xss-protection 0 last-modified Mon, 20 Sep 2021 23:08:00 GMT server sffe vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="botguard-scs" expires Thu, 29 Sep 2022 03:07:42 GMT
GET H2	200	sca.17.5.12.js Show response static.adsafeprotected.com/ Frame 9875	80 KB 21 KB	7ms 7ms	Script application/javascript	18.66.112.27 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.adsafeprotected.com/sca.17.5.12.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.27 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 19 Aug 2021 18:55:08 GMT content-encoding gzip age 3516522 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Thu, 19 Aug 2021 16:31:24 GMT server AmazonS3 etag W/"9304f57298c3834ff107ea7ccb547996" vary Accept-Encoding x-amz-version-id 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja via 1.1 98652de9f742fc1df9de714d921e14c3.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop FRA56-P5 content-type application/javascript x-amz-cf-id 9u3LDb8etsF22Q5C7eN4odRTGE_GQY56nKdQMGCZ18A70y4oYQ3jKg==
GET H3	204	sodar pagead2.googlesyndication.com/pagead/	0 0	32ms 32ms	Image text/html	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gpt_2021091501&jk=907523700142935&bg=!5eal5qLNAAZNQyuQTUM7ACkAdvg8WlNTDtYWg8Wfdd5rKs-wH5jPvgukbxVuMN_yi2ayR9wC4DKqAAIAAACZUgAAABxoAQeZAsRAe09tVNF2Q6rkSgMuZCNC3U40NLHVqpAGS0dFbkg3YL5k2VKJTfbIpldthnM_KdbXmot3R0rKNi5gB-u8n656IBu3Wm3RjloodW9Vi3j9ibjDbYeuCmXb4BCvlj5vQFuwoz2gX7dLXm4Foz69fRUVvkVCVrrgrAA0pT9Zp24wUPWJ_uDn1eAALNWXkN1-23Z5icrbpCp7_lTubMmuxZLJyPSBk74YzyBEHju8pDowV9LQTe-Efd2p2MstTCaC1NNarSoHbnmZ05O3zzB_EHBb9PRcXTaDWhW7woTKVnaxQ-pbgJWj9SJv8-6NX-goxHujbhUGvd1zyUSxIuwLGUXqaqA1e86EMVhnWin7tSm7UEwjdN2OLJGTgzidAVqXtgNgE60YOF4bqkXUoFPBmjWvy70bz2HcwtFtC175ZNPuDTUPYIhVO9rCB9uJ8x-zfainPN348VlTuTTwvsqwQ27t8N37SkuvXdJ7jWGtrX3M2IJGVNjWb_Orbw2lB67T2cvnNeqGCm7u-8XQiAntH8Xpv-mdBCxL3mlD-xYfC2SCl0CgFNpmOMgn5a_9l5u6Tz1MrSwWVzkSt5Zt9rCgA6h-_FRNm7ozbtZB_fLU_UVBhPlpmofg-wInB8KDTcq1iteFdbZza-zbzgDiWdcXKKp7-23f5TCm84Y_-PUZjU9oDgvTwq9by_nEx-n0Bzzyv_gJ158gV4-VC-3rrbdWBhZpppxEqft2FAu5Xbf_t9Bl5PxTxwDCH-I2EQ9AkmbhfNEJD_KWnSElszSsWKTLWVKuCV-1ND0Gh2lOgec3JnW1sLpfkMdkMBlMkMeAyVj4aD-68_ygmOYDHV2u_l_NlN_bDSmgTfkCPczktxPDci2sN0vNJZQkJmfvIca52tKL1gJo3F6rMo7WDpdIHBXc4uVAbF3p8ky2CU681V68vZ3ZwHN9n8I Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H/1.1	200 OK	dt dt.adsafeprotected.com/	43 B 301 B	290ms 86ms	Image image/gif	104.244.36.20 ADSAFE-1
General Check archive.org Show headers Download Go to Show image Full URL https://dt.adsafeprotected.com/dt?advEntityId=747769&asId=1749cb31-8e57-5ba8-266e-71cbd6786f39&tv=%7Bc:pBrCMz,pingTime:-2,time:150,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:8478,bdZ:8648,beA:8666,beZ:8668,mfA:8783,cmA:8784,inA:8784,inZ:8787,prA:8787,prZ:8790,si:8792,poA:8792,poZ:8804,cmZ:8804,mfZ:8804,loA:8806,loZ:8806,ltA:8815,ltZ:8815%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:0,h:0,t:125%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:0,n:150,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:125,wc:0.0.1600.1200,bkn:%7Bpiv:%5B30~1%5D,as:%5B30~na.na%5D%7D%7D%5D,slEventCount:1,em:false,fr:true,e:A,tt:rjss,dtt:0,fm:sKoQpiZ+1*.747769-56497279%7C11%7C12%7C131,idMap:1*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,sinceFw:23,readyFired:true%7D&br=c Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US), Reverse DNS nyidt.adsafeprotected.com Software nginx / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:49 GMT X-Server-Name dt53.303net.pvt P3P CP="COM NAV INT STA NID OUR IND NOI" Cache-Control no-cache Connection keep-alive Content-Type image/gif Content-Length 43 Server nginx
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	7ms 7ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=206&fi=1&apd=208&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5064483059&L2id=2902944911&L3id=5783219953&L4id=138362642886&S1id=22308610192&S2id=22364980590&ord=1632915828983&r=586220111856&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&moatClientSlicer3=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:49 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:49 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 20BD	0 20 B	17ms 17ms	Image image/gif	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B1CuwdFFUYbDSOJeT3gP_n4SwDgAAAAA4AeAEAg&bg=!q6ilqOzNAAZNQyuQTUM7ACkAdvg8WvFXpc1AOwImoFRluuHP9l5BAPjjCSXH4xkY8nK6Zvt1oEYnhwIAAAB_UgAAAAtoAQeZAr1quhirw2ZEQ4gxbykXihT_v-P-FasVGqPeBVOm0jt6zfUHTSABzn-Z6gtq8cIWuxSRDa4mfLGfSJFNt4aBygrOWg3_hPJeTg9X9pinijWIeF9VmiN_cWeCWbljUENp7DE6509sZrRLAN0j7UNhL2bGdn8QRKqoRk3oftcj92cHcIumNJnRtZeYWz4mxTBp1LoiFKmcMGDcrCNiYOXMgBNwYaqqoomyLGmoXE8DLpTCpCGh33kM7fszMLK0wGjrQoaezFx5cF1OaFvwpc6XF_WQ61LQDzvIejdxM-0G-KzD1gZY6pnjyzBat8LbllZrkkMxdN9IhVMUbOcGZNpZwB5wk-QVXzdENYloj--LwZ8GrOEmXMOS595anh5AisXrC8Ng52wB29VdT98ZJ3UZ6JcS5aC3gT3DBAIspcb-FVvXjYieB2cZYeu-HX9HZCXm-4t010EWNslv11QjSuS-pot--vit0WxF_ZA4ibex9F7gHgVZ-beFPqRcQ-PvWqjMUyb0w4Z1ArjDXbCVfKFl1Y2z1dQQlmcTNEu59IkbMcjMY4eGR2p6zt5FkkA8gbPrGnMnznTFZ7foFPCfDuuDG9r2ibdDQTtICBJU0sfKCiNknW16Z97AKdVPcGO3mdsVEGbf9V_j00tsLBJz2rPu7by5IqaoBGb7KaAM7ddStSxlUhfQcSF1IKSBTsuxOyR3IwEqSngLquqg2maVNGRiA4DItYWyJlXw1INF-sXwawyIfAQMu9o-ZzgOricz9OR1H8rHinnR5qx_UvoXvzXPm34TTvedBS-mjs3tHP2YxxOnDQEmBdoBeuAXlEkEHcnqbV959mptRK4AmV7_fD3kN-0KNAAsfqDuMbJuAHyKmoKA5HtZHociUkvnhzqyHST6QQkWS3V2xrPP5FUlyQ--DEYICcpwlKFipXU6HpLA7A Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:49 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET DATA	200 OK	truncated / Frame 8179	750 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e9cac3eeba1fc86e06fdc013a4c52742e9b4bd14b7be6517321127d4515095ce Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	E=in,im,fi tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=39/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 137 B	294ms 93ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=39/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=in,im,fi Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	jzzbn5Yz clipcentric-a.akamaihd.net/file/1247385/ad_q75/1629912718/	12 KB 12 KB	10ms 8ms	Image image/avif	2.16.107.105 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1247385/ad_q75/1629912718/jzzbn5Yz?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.105 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-105.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash e245a4382cf4ab471b9b8d24917843175bd4327a4eb15a3574d7d52c91c8193f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:49 GMT cache-control private, max-age=31536000 last-modified Wed, 25 Aug 2021 17:32:19 GMT server Apache/2.2.34 content-length 12172 content-type image/avif
GET H2	200	kzH4toB3 clipcentric-a.akamaihd.net/file/1246090/ad_q75/1629760675/	12 KB 12 KB	10ms 8ms	Image image/avif	2.16.107.105 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1246090/ad_q75/1629760675/kzH4toB3?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.105 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-105.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 1072bb617a787627b5569dddf56fb15f2c28b3be18e04ff7a8014158b199532b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:49 GMT cache-control private, max-age=31536000 last-modified Mon, 23 Aug 2021 23:23:52 GMT server Apache/2.2.34 content-length 12585 content-type image/avif
GET H2	200	E=ls:Clipcentric%20Site%20Fixes.0,li tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=41/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 136 B	389ms 189ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=41/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=ls:Clipcentric%20Site%20Fixes.0,li Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:Super%20Billboard.0 tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=45/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 136 B	294ms 93ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=45/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=ls:Super%20Billboard.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	DxW2qfea clipcentric-a.akamaihd.net/file/1247384/ad_q65/1629912701/	12 KB 12 KB	279ms 277ms	Image image/avif	2.16.107.105 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1247384/ad_q65/1629912701/DxW2qfea?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.105 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-105.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash 9f4f52cdea56e18ec34ad12c9d0cf800b075e32e8ba869350972a42b07ea47dd Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:49 GMT cache-control private, max-age=31536000 last-modified Wed, 25 Aug 2021 17:32:21 GMT server Apache/2.2.34 content-length 12076 content-type image/avif
GET H2	200	-x1QdJ6l clipcentric-a.akamaihd.net/file/1246097/ad_q70/1629760917/	26 KB 26 KB	390ms 389ms	Image image/avif	2.16.107.105 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1246097/ad_q70/1629760917/-x1QdJ6l?f=auto Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.107.105 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-107-105.deploy.static.akamaitechnologies.com Software Apache/2.2.34 / Resource Hash b0527bc0d669623021d21865888769bf662d2b22cd0294f075e71534c1874d88 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers access-control-allow-origin * date Wed, 29 Sep 2021 11:43:49 GMT cache-control private, max-age=31536000 last-modified Mon, 23 Aug 2021 23:23:53 GMT server Apache/2.2.34 content-length 26530 content-type image/avif
GET H2	200	E=ls:hotspots%20expanded.0 tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=46/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 136 B	388ms 188ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=46/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=ls:hotspots%20expanded.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:on%20scroll%20partial%20expand.0 tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=46/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 136 B	292ms 93ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=46/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=ls:on%20scroll%20partial%20expand.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:on%20scroll%20full%20expand.0 tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=46/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 136 B	293ms 94ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=46/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=ls:on%20scroll%20full%20expand.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:custom%20ad%20controls.0 tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=47/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	35 B 136 B	109ms 109ms	Image image/gif	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=47/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=ls:custom%20ad%20controls.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 29 Sep 2021 11:43:49 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H/1.1	200 OK	dt dt.adsafeprotected.com/	43 B 301 B	88ms 88ms	Image image/gif	104.244.36.20 ADSAFE-1
General Check archive.org Show headers Download Go to Show image Full URL https://dt.adsafeprotected.com/dt?advEntityId=747769&asId=1749cb31-8e57-5ba8-266e-71cbd6786f39&tv=%7Bc:pBrCRS,pingTime:-10,time:479,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85My4wLjQ1NzcuNjMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1632915829499%7C%7Cbeedbe6e7eb8cbe495965295afdc90e4%7C%7Cc7e7172c7781b034963ef5178f1479dd%7C%7Caf5748df75ac969eadf2400e9cd1d701%7C%7C42f6aaa12c8390241bdc263d0dd1e9f2%7C%7C1c6cbf604e24185fb25cc03904248857%7C%7C301c60f57b943d4d2819a27f133357b5%7C%7C663779d0fd545b7cceefaa861fba8a64%7C%7C1629390669%7D Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US), Reverse DNS nyidt.adsafeprotected.com Software nginx / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:49 GMT X-Server-Name dt53.303net.pvt P3P CP="COM NAV INT STA NID OUR IND NOI" Cache-Control no-cache Connection keep-alive Content-Type image/gif Content-Length 43 Server nginx
POST H2	200	E=si,dt:0,ld:Super%20Billboard:75.0,le:Super%20Billboard:120:120.0,ld:hotspots%20expanded:75.0,le:hotspots%20expanded:121:121.0,ld:custom%20ad%20controls:74.0,le:custom%20ad%20controls:121:121.0 tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=129/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/	115 B 281 B	110ms 109ms	Ping application/octet-stream	35.174.253.19 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tr.clipcentric.com/s/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/Z=1/I=114.712604.1632915829423/U=www.zdnet.com/T=129/M=w/D=d/PO=zdnet.com/LO=5783084534/VO=138362440413/E=si,dt:0,ld:Super%20Billboard:75.0,le:Super%20Billboard:120:120.0,ld:hotspots%20expanded:75.0,le:hotspots%20expanded:121:121.0,ld:custom%20ad%20controls:74.0,le:custom%20ad%20controls:121:121.0 Requested by Host: clipcentric-a.akamaihd.net URL: https://clipcentric-a.akamaihd.net/ad/B=608/F=1246037/C=389582/P=22/L=21/V=23/S=p-RtJGcy/ad.js?q=1629759099 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.174.253.19 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-174-253-19.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 214dc5b3c7f529c707e203b8ea4bd194a269213ec95a4f13162fa564dce5d98f Request headers Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Wed, 29 Sep 2021 11:43:49 GMT last-modified Tue, 12 Feb 2013 20:05:06 GMT server Apache/2.2.34 accept-ranges bytes etag "73-4d58c8ab38080" content-length 115 content-type text/plain; charset=UTF-8
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	19ms 18ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828983&de=586220111856&cu=1632915828983&m=1035&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&lh=26&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=1&ag=1030&an=2&gi=1&gf=1030&gg=2&ix=1030&ic=1030&ez=1&ck=1030&kw=831&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1030&bx=2&ci=1030&jz=831&dj=1&aa=0&ad=926&cn=0&gk=926&gl=0&ik=926&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=831&cd=4&ah=831&am=4&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=1803434412&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:50 GMT
GET H/1.1	200 OK	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 419 B	7ms 7ms	Image image/gif	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=831&tet=1030&fi=1&apd=1032&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=5064483059&L2id=2902944911&L3id=5783219953&L4id=138362642886&S1id=22308610192&S2id=22364980590&ord=1632915828983&r=586220111856&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatPS=bottom&zMoatPT=article&zMoatSL=leader-plus-bottom%3FT-1000&moatClientSlicer3=0&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Pragma no-cache Date Wed, 29 Sep 2021 11:43:50 GMT Last-Modified Fri, 20 May 2016 15:16:00 GMT Server AkamaiNetStorage ETag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" Content-Type image/gif Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 43 Expires Wed, 29 Sep 2021 11:43:50 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	19ms 19ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828983&de=586220111856&cu=1632915828983&m=1037&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&lh=26&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=1&ag=1030&an=1030&gi=1&gf=1030&gg=1030&ix=1030&ic=1030&ez=1&ck=1030&kw=831&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1030&bx=1030&ci=1030&jz=831&dj=1&aa=0&ad=926&cn=926&gk=926&gl=926&ik=926&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=831&cd=831&ah=831&am=831&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=1081752408&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:50 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	9ms 9ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828983&de=586220111856&cu=1632915828983&m=1038&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&lh=26&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=1&ag=1030&an=1030&gi=1&gf=1030&gg=1030&ix=1030&ic=1030&ez=1&ck=1030&kw=831&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1030&bx=1030&ci=1030&jz=831&dj=1&aa=0&ad=926&cn=926&gk=926&gl=926&ik=926&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=831&cd=831&ah=831&am=831&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=1973943290&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:50 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/	42 B 64 B	31ms 16ms	Fetch image/gif	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuWcT2SyzqasUc8GYnQjRhoC4zbnapvHXHHQAJpZ3-_qyXglxAFA-feuC_qGb9I-9VI8nIPE4LYAqiMK-iy30kwo3-YxOSlSzpVCrBsAnv6oLs9SE5u&sig=Cg0ArKJSzLGEleB8d2sBEAE&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210927&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=3368778720&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1632915820355&rpt=8706 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:50 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/	42 B 64 B	29ms 16ms	Fetch image/gif	142.250.186.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstj9bdy-D3PeTYKz9laR6niU34ib5l8j2Bvw2tmiB7BPANgj6uup3uD1XaF0WWc20LFaJ_rbAl9rzOztoUM3vUut6bxhfrHFLQ&sig=Cg0ArKJSzBCkZ0plKHNQEAE&id=lidar2&mcvt=1002&p=0,0,90,728&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20210927&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=3866786814&rs=6&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1632915820355&rpt=8708 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f2.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:50 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	7ms 7ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828983&de=586220111856&cu=1632915828983&m=1239&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&lh=26&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=1&ag=1234&an=1030&gi=1&gf=1234&gg=1030&ix=1234&ic=1234&ez=1&ck=1030&kw=831&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1234&bx=1030&ci=1030&jz=831&dj=1&aa=1&ad=1130&cn=926&gn=1&gk=1130&gl=926&ik=1130&co=1130&cp=1032&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1032&cd=831&ah=1032&am=831&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=1794135708&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:50 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:50 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	8ms 8ms	Image image/gif	23.218.209.154 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22364980590&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=728x90&zMoatPS=bottom&zMoatSZPS=728x90%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BZ.jrG%3DzIR*E%24sRK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ADAvPbh4hhkj2QMKvovmHE5i7dy8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-PnpNn7leOPQ59g%3D%3D&sc=1&os=1-Cw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%3B4*E%3Amx5%60K&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&pcode=redventuresgamheader644747280705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug%2F&id=1&ii=4&f=0&j=&t=1632915828983&de=586220111856&cu=1632915828983&m=5055&ar=2b00db7c7e3-clean&iw=7bf3f87&cb=0&ym=0&rd=1&ll=2&lm=0&ln=0&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=1200&le=1&lf=0&lg=1&lh=26&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A7224%3A7224%3A7239%3A7209&as=1&ag=5050&an=1234&gi=1&gf=5050&gg=1234&ix=5050&ic=5050&ez=1&ck=1030&kw=831&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5050&bx=1234&ci=1030&jz=831&dj=1&aa=1&ad=4946&cn=1130&gn=1&gk=4946&gl=1130&ik=4946&co=1130&cp=1032&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4851&cd=1032&ah=4851&am=1032&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5064483059%3A2902944911%3A5783219953%3A138362642886&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22364980590&dfp=0%2C1&la=22364980590&zMoatW=728&zMoatH=90&zMoatVGUID=42c4e0cb-8236-43d2-a3c0-85c3937e95b1&zMoatSN=a&zMoatSL=leader-plus-bottom%3FT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fthis-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug&zMoatDev=Desktop&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&iq=na&tt=na&tu=&tp=&tc=0&fs=194825&na=1827988907&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.209.154 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-218-209-154.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/this-cryptocurrency-miner-is-exploiting-the-new-confluence-remote-code-execution-bug/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 29 Sep 2021 11:43:54 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 29 Sep 2021 11:43:54 GMT