URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Submission: On June 08 via manual from US

Summary

This website contacted 45 IPs in 6 countries across 38 domains to perform 228 HTTP transactions. The main IP is 104.20.60.209, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on May 12th 2018. Valid for: 2 years.
This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.20.60.209 13335 (CLOUDFLAR...)
3 216.58.207.74 15169 (GOOGLE)
69 104.24.1.61 13335 (CLOUDFLAR...)
1 10 23.67.139.108 20940 (AKAMAI-ASN1)
1 1 216.58.207.68 15169 (GOOGLE)
1 172.217.21.238 15169 (GOOGLE)
1 216.58.207.72 15169 (GOOGLE)
13 172.217.21.194 15169 (GOOGLE)
3 54.93.39.116 16509 (AMAZON-02)
5 2.18.232.128 16625 (AKAMAI-AS)
6 216.58.207.67 15169 (GOOGLE)
3 172.217.22.98 15169 (GOOGLE)
17 216.58.207.66 15169 (GOOGLE)
3 216.58.207.34 15169 (GOOGLE)
1 3 216.58.207.78 15169 (GOOGLE)
4 23.67.132.148 20940 (AKAMAI-ASN1)
1 3 2.19.43.224 20940 (AKAMAI-ASN1)
1 2.19.32.164 20940 (AKAMAI-ASN1)
1 4 138.108.96.100 16477 (ACNIELSEN-AS)
1 54.230.44.100 16509 (AMAZON-02)
1 54.230.44.243 16509 (AMAZON-02)
4 54.72.182.106 16509 (AMAZON-02)
1 66.102.1.157 15169 (GOOGLE)
1 104.108.51.30 16625 (AKAMAI-AS)
1 52.89.201.181 16509 (AMAZON-02)
2 2.18.234.21 16625 (AKAMAI-AS)
2 62.67.193.41 26667 (RUBICONPR...)
2 185.64.189.112 62713 (AS-PUBMATIC)
2 185.33.223.83 29990 (ASN-APPNEXUS)
5 69.172.216.55 7415 (ADSAFE-1)
1 54.230.44.147 16509 (AMAZON-02)
8 172.217.21.225 15169 (GOOGLE)
1 104.24.0.61 13335 (CLOUDFLAR...)
1 54.230.47.244 16509 (AMAZON-02)
15 2.18.235.40 16625 (AKAMAI-AS)
2 69.172.216.58 7415 (ADSAFE-1)
1 54.230.44.63 16509 (AMAZON-02)
6 172.217.21.214 15169 (GOOGLE)
3 54.230.44.128 16509 (AMAZON-02)
16 69.172.216.111 7415 (ADSAFE-1)
1 185.60.216.15 32934 (FACEBOOK)
1 91.225.248.129 197612 (LINKEDIN-1)
1 151.101.13.140 54113 (FASTLY)
1 52.200.111.235 14618 (AMAZON-AES)
1 35.169.143.38 14618 (AMAZON-AES)
228 45
Apex Domain
Subdomains
Transfer
70 bleepstatic.com
www.bleepstatic.com
760 KB
24 adsafeprotected.com
cdn.adsafeprotected.com
pixel.adsafeprotected.com
static.adsafeprotected.com
dt.adsafeprotected.com
123 KB
21 googlesyndication.com
pagead2.googlesyndication.com
tpc.googlesyndication.com
244 KB
17 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
ziffdavis697674298673.moatads.com
176 KB
17 doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
securepubads.g.doubleclick.net
255 KB
12 zdbb.net
cdn.static.zdbb.net
ns.zdbb.net
zdbb.net
gurgle.zdbb.net
walker.zdbb.net
13 KB
8 imrworldwide.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
57 KB
6 ytimg.com
i.ytimg.com
222 KB
6 gstatic.com
fonts.gstatic.com
80 KB
4 addthis.com
s9.addthis.com
s7.addthis.com
187 KB
3 googletagservices.com
www.googletagservices.com
23 KB
3 scorecardresearch.com
sb.scorecardresearch.com
2 KB
3 google-analytics.com
www.google-analytics.com
14 KB
3 google.de
adservice.google.de
847 B
3 tvpagecdn.com
videos-bleepingcomputers-com.tvpagecdn.com
16 KB
3 google.com
www.google.com
cse.google.com
adservice.google.com
2 KB
3 googleapis.com
fonts.googleapis.com
1006 B
2 ziffdavis.com
static.ziffdavis.com
11 KB
2 adnxs.com
ib.adnxs.com
1 KB
2 pubmatic.com
hbopenbid.pubmatic.com
189 B
2 rubiconproject.com
fastlane.rubiconproject.com
2 KB
2 casalemedia.com
as-sec.casalemedia.com
2 KB
1 reddit.com
www.reddit.com
3 KB
1 linkedin.com
www.linkedin.com
1 KB
1 facebook.com
graph.facebook.com
839 B
1 s-onetag.com
get.s-onetag.com
28 KB
1 consensu.org
quantcast.mgr.consensu.org
23 KB
1 addthisedge.com
m.addthisedge.com
900 B
1 tvpage.com
api.tvpage.com
3 KB
1 bluekai.com
stags.bluekai.com
1 adziff.com
static.adziff.com
1 KB
1 nsstatic.com
cdn.nsstatic.com
120 B
1 sharethrough.com
native.sharethrough.com
115 KB
1 bkrtx.com
tags.bkrtx.com
28 KB
1 pcmag.com
g.pcmag.com
323 B
1 googletagmanager.com
www.googletagmanager.com
22 KB
1 nsstatic.net
cdn.nsstatic.net
63 KB
1 bleepingcomputer.com
www.bleepingcomputer.com
16 KB
228 38
Domain Requested by
70 www.bleepstatic.com www.bleepingcomputer.com
pagead2.googlesyndication.com
16 dt.adsafeprotected.com www.bleepingcomputer.com
13 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.bleepingcomputer.com
13 pagead2.googlesyndication.com www.bleepingcomputer.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
8 px.moatads.com www.bleepingcomputer.com
8 tpc.googlesyndication.com securepubads.g.doubleclick.net
6 i.ytimg.com videos-bleepingcomputers-com.tvpagecdn.com
6 fonts.gstatic.com www.bleepingcomputer.com
5 ziffdavis697674298673.moatads.com
5 pixel.adsafeprotected.com cdn.adsafeprotected.com
www.bleepingcomputer.com
4 cdn-gl.imrworldwide.com secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
4 zdbb.net www.bleepingcomputer.com
4 secure-us.imrworldwide.com 1 redirects cdn.nsstatic.net
www.bleepingcomputer.com
4 cdn.static.zdbb.net 1 redirects www.bleepingcomputer.com
cdn.static.zdbb.net
3 s7.addthis.com s9.addthis.com
3 www.googletagservices.com cdn.nsstatic.net
securepubads.g.doubleclick.net
3 sb.scorecardresearch.com 1 redirects cdn.nsstatic.net
www.bleepingcomputer.com
3 www.google-analytics.com 1 redirects www.googletagmanager.com
www.bleepingcomputer.com
3 googleads.g.doubleclick.net pagead2.googlesyndication.com
3 adservice.google.de pagead2.googlesyndication.com
www.googletagservices.com
3 videos-bleepingcomputers-com.tvpagecdn.com www.bleepingcomputer.com
3 fonts.googleapis.com www.bleepingcomputer.com
videos-bleepingcomputers-com.tvpagecdn.com
2 geo.moatads.com z.moatads.com
2 static.adsafeprotected.com pixel.adsafeprotected.com
2 static.ziffdavis.com securepubads.g.doubleclick.net
2 z.moatads.com securepubads.g.doubleclick.net
2 ib.adnxs.com cdn.nsstatic.net
2 hbopenbid.pubmatic.com cdn.nsstatic.net
2 fastlane.rubiconproject.com cdn.nsstatic.net
2 as-sec.casalemedia.com cdn.nsstatic.net
2 gurgle.zdbb.net www.bleepingcomputer.com
cdn.static.zdbb.net
1 www.reddit.com s9.addthis.com
1 www.linkedin.com s9.addthis.com
1 graph.facebook.com s9.addthis.com
1 get.s-onetag.com securepubads.g.doubleclick.net
1 quantcast.mgr.consensu.org www.bleepstatic.com
1 m.addthisedge.com s9.addthis.com
1 walker.zdbb.net cdn.static.zdbb.net
1 api.tvpage.com videos-bleepingcomputers-com.tvpagecdn.com
1 stags.bluekai.com tags.bkrtx.com
1 stats.g.doubleclick.net www.bleepingcomputer.com
1 static.adziff.com www.bleepingcomputer.com
1 cdn.nsstatic.com www.bleepingcomputer.com
1 native.sharethrough.com cdn.nsstatic.net
1 cdn.adsafeprotected.com cdn.nsstatic.net
1 ns.zdbb.net cdn.nsstatic.net
1 tags.bkrtx.com cdn.nsstatic.net
1 g.pcmag.com cdn.nsstatic.net
1 adservice.google.com pagead2.googlesyndication.com
1 s9.addthis.com www.bleepingcomputer.com
1 www.googletagmanager.com www.bleepingcomputer.com
1 cse.google.com www.bleepingcomputer.com
1 www.google.com 1 redirects
1 cdn.nsstatic.net www.bleepingcomputer.com
1 www.bleepingcomputer.com
228 55
Subject Issuer Validity Valid
bleepingcomputer.com
COMODO RSA Domain Validation Secure Server CA
2018-05-12 -
2020-05-17
2 years crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2018-05-23 -
2018-08-15
3 months crt.sh
odc-prod-01.oracle.com
DigiCert ECC Secure Server CA
2018-01-30 -
2019-01-29
a year crt.sh
tpc.googlesyndication.com
Google Internet Authority G3
2018-05-23 -
2018-08-15
3 months crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA
2018-02-15 -
2019-07-11
a year crt.sh

This page contains 18 frames:

Primary Page: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Frame ID: C8BEBF0D0D0C8709A1F2EA1231921C10
Requests: 172 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20180606/r20180604/zrt_lookup.html
Frame ID: 1684517BB5E992FB82F31A1C90815161
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Frame ID: 1D309DC0E19258F2FA012E0AA66DF691
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Roboto:400,500
Frame ID: BFFEE1036AA23D509C3CB663F6AE6217
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3249370012249755&output=html&h=90&slotname=5975899204&adk=557056660&adf=2216754707&w=728&lmt=1502846673&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&wgl=1&adsid=NT&dt=1528483966583&bpp=18&bdt=336&fdt=21&idt=206&shv=r20180606&cbv=r20180604&saldr=sa&abxe=1&correlator=2477879929723&frm=20&pv=2&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=171801324032&dssz=41&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=261&ady=2217&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=1&xpc=PHZwUyNAfd&p=https%3A//www.bleepingcomputer.com&dtd=253
Frame ID: 0D50D1781A1A580CEEB0E3B5265F19D8
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Frame ID: 17F969D577741DF73AA3AC67A658FB34
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3249370012249755&output=html&h=90&slotname=1089300124&adk=4118485907&adf=452058354&w=728&lmt=1502846673&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&wgl=1&adsid=NT&dt=1528483966643&bpp=9&bdt=396&fdt=256&idt=257&shv=r20180606&cbv=r20180604&saldr=sa&abxe=1&prev_slotnames=5975899204&correlator=2477879929723&frm=20&pv=1&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=175924546938880&dssz=47&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3961&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=2&xpc=Cx55Pmzrqd&p=https%3A//www.bleepingcomputer.com&dtd=267
Frame ID: 1978EA04E4055EC5A13B651CF2C79C05
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dbleepingcomputer.com&phint=referer%3Dhttps%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&phint=__bk_t%3DEight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&phint=__bk_k%3Dcomputers%2C%20windows%2C%20linux%2C%20mac%2C%20support%2C%20tech%20support%2C%20spyware%2C%20malware%2C%20virus%2C%20security%2C%20Adware%2C%20Browser%2C%20Chrome%20extension%2C%20Google%20Chrome%2C%20Phishing%2Cvirus%20removal%2C%20malware%20removal%2C%20computer%20help%2C%20technical%20support&phint=__bk_l%3Dhttps%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&limit=10&bknms=&r=81244494
Frame ID: 6EE07C78D120F662FE2D48E2351638EF
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Frame ID: F74D83A7D1AB640BA1554E23517D2694
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=1363081324&w=834&crui=image_stacked&cr_col=4&cr_row=2&fwrn=2&lmt=1502846673&rafmt=9&guci=1.2.0.0.2.2.0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&fwr=0&wgl=1&adsid=NT&dt=1528483966666&bpp=17&bdt=418&fdt=270&idt=272&shv=r20180606&cbv=r20180604&saldr=aa&abxe=1&prev_slotnames=5975899204%2C1089300124&correlator=2477879929723&frm=20&pv=2&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=175924546938880&dssz=51&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=208&ady=3376&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=7&ifi=3&xpc=pLzPJedS5T&p=https%3A//www.bleepingcomputer.com&dtd=283
Frame ID: 9F3E8FF98CAD8121AB369E5DA3596706
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html
Frame ID: E7C31376A4278641344B4D5DBA3939F7
Requests: 1 HTTP requests in this frame

Frame: https://get.s-onetag.com/2fa26226-c8f0-4d1d-bcfb-8fce981242a4/tag.min.js
Frame ID: 1D99D0DBA8E85D298459954A6A698E9C
Requests: 5 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=7529&campId=728x90&pubId=25349972&chanId=175702292&placementId=44049572&pubCreative=53780021972&pubOrder=129076172&cb=903959442&adsafe_par&impId=2282a076-6b4d-11e8-a18e-00259088293c
Frame ID: 5BE32009236B3165E664EAE5BF1DE749
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 5487A19218CFDE045CFF889862F4F63E
Requests: 14 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=7529&campId=300x250&pubId=25349972&chanId=175702292&placementId=44046452&pubCreative=138234240615&pubOrder=129076172&cb=1547039622&adsafe_par&impId=2282a077-6b4d-11e8-a18e-00259088293c
Frame ID: 63E1DFF6C3781DB7BF99CA41E718961E
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagservices.com/tag/js/gpt.js
Frame ID: 11B8A748AEAF061E555F3927088BAD3F
Requests: 13 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 63AF32EEF9E710610692F0064906CE1F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html?n=1
Frame ID: D644D1A02C76EE0AB7919BC4D644F4BC
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • env /pbjs/i

Overall confidence: 100%
Detected patterns
  • env /^addthis/i

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Overall confidence: 100%
Detected patterns
  • script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • env /^google_ad_/i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • env /^googletag$/i
  • env /^google_tag_manager$/i

Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • env /^_?COMSCORE$/i

Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

228
Requests

4 %
HTTPS

0 %
IPv6

38
Domains

55
Subdomains

45
IPs

6
Countries

2495 kB
Transfer

6121 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 302
  • https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en
Request Chain 90
  • https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js HTTP 303
  • https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Request Chain 103
  • https://www.google-analytics.com/r/collect?v=1&_v=j68&a=1223192875&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&ul=en-us&de=UTF-8&dt=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEDAAEAB~&jid=500332830&gjid=203610770&cid=246142973.1528483967&tid=UA-25910482-11&_gid=1864758176.1528483967&_r=1&z=995453960 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-25910482-11&cid=246142973.1528483967&jid=500332830&_gid=1864758176.1528483967&gjid=203610770&_v=j68&z=995453960
Request Chain 110
  • https://sb.scorecardresearch.com/b?c1=2&c2=6036316&ns__t=1528483966848&ns_c=UTF-8&cv=3.1e&c8=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6036316&ns__t=1528483966848&ns_c=UTF-8&cv=3.1e&c8=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&c9=
Request Chain 168
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1528483967775&ci=ziffdavis&js=1&cg=0&ts=bk-coretag.js&vn=6.0.58&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&sr=1600x1200 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1528483967775&ci=ziffdavis&js=1&cg=0&ts=bk-coretag.js&vn=6.0.58&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&sr=1600x1200&ja=1

228 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
62 KB
16 KB
Document
General
Full URL
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.20.60.209 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
444e7a52ef48556debcc9c567fd0d01eaf9cc0cb02871510e100b97f159b0f36
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

:method
GET
:authority
www.bleepingcomputer.com
:scheme
https
:path
/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10

Response headers

status
200
date
Fri, 08 Jun 2018 18:52:46 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d81bcdd3aef8daa2d24cbfbd0dbb45da41528483965; expires=Sat, 08-Jun-19 18:52:45 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly session_id=829b9482742d8c42c3f03b04ffe43846; path=/; domain=.bleepingcomputer.com; httponly;Secure lav=2150; expires=Sun, 08-Jul-2018 18:52:45 GMT; Max-Age=2592000; path=/;Secure
x-frame-options
SAMEORIGIN
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
expires
0
last-modified
Wed, 16 Aug 2017 01:24:33 GMT
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
427d8eaf78de63a9-FRA
content-encoding
gzip
css
fonts.googleapis.com/
1 KB
404 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.74 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f10.1e100.net
Software
ESF /
Resource Hash
1878c3e6e47ab99b415a0af0dd75b714c1025ad355aaa886c0dde34a19847e90
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:46 GMT
bootstrap.css
www.bleepstatic.com/css/redesign/
134 KB
20 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/css/redesign/bootstrap.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
13c9e692ecdcdc0f1203c1fe459e4da7b7fd66a89c4cad51c3ce12705e204762

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
20092
last-modified
Fri, 23 Sep 2016 14:33:06 GMT
server
cloudflare
etag
"2866134196"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb54c879744-FRA
expires
Tue, 26 Jun 2018 04:28:19 GMT
main.css
www.bleepstatic.com/css/redesign/
59 KB
10 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a387c230af7c053b21d96c296fe7bbcd2f8db68dbdd96e14de77a632c40dfd9

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
last-modified
Wed, 11 Apr 2018 19:21:34 GMT
server
cloudflare
status
200
etag
"3890365644"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb54c8c9744-FRA
content-length
10450
expires
Fri, 13 Jul 2018 18:52:45 GMT
home.css
www.bleepstatic.com/css/redesign/
12 KB
3 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/css/redesign/home.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1474b847c4be14b2fbaf5d65ef989712f309ebd4bb48b87cf6b3bfa3ba583a4

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
status
200
etag
W/"2876631182"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
last-modified
Sat, 24 Mar 2018 16:18:00 GMT
cf-ray
427d8eb54c8b9744-FRA
expires
Tue, 26 Jun 2018 04:28:20 GMT
news.css
www.bleepstatic.com/css/redesign/
32 KB
6 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/css/redesign/news.css?v=31017.2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4cb3fbf585c232657aff936688387e882ff196d600475f67bdebb286a994d5c

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
last-modified
Tue, 29 May 2018 17:11:26 GMT
server
cloudflare
status
200
etag
"2310177789"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb54c8d9744-FRA
content-length
5684
expires
Fri, 13 Jul 2018 18:52:45 GMT
jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/
5 KB
2 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css?v=2.1.5
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
968a8e56e4adaf8c135199ebd7f6cc065424ca45974d4dfbeb5607e69fe72fcd

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
status
200
etag
"1334702690"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb54c899744-FRA
content-length
1423
expires
Fri, 13 Jul 2018 18:52:46 GMT
jquery-1.11.1.min.js
www.bleepstatic.com/js/redesign/
94 KB
33 KB
Script
General
Full URL
https://www.bleepstatic.com/js/redesign/jquery-1.11.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
33266
last-modified
Thu, 23 Apr 2015 12:36:44 GMT
server
cloudflare
etag
"476811546"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb54c8e9744-FRA
expires
Tue, 26 Jun 2018 04:28:20 GMT
bleep.js
www.bleepstatic.com/js/redesign/
4 KB
1 KB
Script
General
Full URL
https://www.bleepstatic.com/js/redesign/bleep.js?t=1528483966
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
29d2faa2144367069d8cacce9600470a99f6ce3d2d0ce5641c38044adc77cbc8

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
last-modified
Wed, 21 Feb 2018 08:43:47 GMT
server
cloudflare
status
200
etag
"2594116829"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb56cb69744-FRA
content-length
1066
expires
Fri, 13 Jul 2018 18:52:46 GMT
news.js
www.bleepstatic.com/js/redesign/
247 B
291 B
Script
General
Full URL
https://www.bleepstatic.com/js/redesign/news.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ded8ccc0bf2159ddbcda148611365dd27ddbca253518d5a939a6b9159263416e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
171
last-modified
Wed, 16 Dec 2015 15:41:46 GMT
server
cloudflare
etag
"4250885039"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb56cb79744-FRA
expires
Tue, 26 Jun 2018 04:29:28 GMT
bleepingcomputer.com.js
cdn.nsstatic.net/ns/
204 KB
63 KB
Script
General
Full URL
https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c50c64d2ce67ce581ad26345ac68fd1ba3d10e76554753b3cfe3da65a0b73c90

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
7AfZOr15bkV_9kkyic2ZcFlIXjyCSJEC
content-encoding
gzip
last-modified
Fri, 08 Jun 2018 01:09:07 GMT
x-amz-request-id
BAFA6DCEACC743F5
date
Fri, 08 Jun 2018 18:52:46 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2314
x-amz-replication-status
COMPLETED
accept-ranges
bytes
x-amz-id-2
znOLH3EcNUy9E7F7S9l08cB13RFo1JFur5tmFtWCik9G5/fHD/rfOhJLMOYtgjLgLX3rUm6DWn8=
expires
Fri, 08 Jun 2018 19:31:20 GMT
qc-consent.js
www.bleepstatic.com/js/qc-consent/
2 KB
1 KB
Script
General
Full URL
https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6430c8baccb3354e98553cc6c598c0e919f52d8f628b91ccf1f7210c7e67ca96

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
cf-polished
origSize=2641
status
200
last-modified
Fri, 25 May 2018 17:28:52 GMT
server
cloudflare
etag
W/"1438309859"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
expires
Fri, 29 Jun 2018 17:30:42 GMT
cache-control
max-age=3024000
cf-ray
427d8eb6ae019744-FRA
cf-bgj
minify
logo.png
www.bleepstatic.com/images/site/
1 KB
1 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=1882
status
200
content-disposition
inline; filename="logo.webp"
content-length
1152
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:55:20 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae029744-FRA
cf-bgj
imgq:100
brand
cse.google.com/coop/cse/
Redirect Chain
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
  • https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en
3 KB
1 KB
Script
General
Full URL
https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
172.217.21.238 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f238.1e100.net
Software
pfe /
Resource Hash
4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 16:48:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
pfe
age
7455
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
public, max-age=172800
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
1181
x-xss-protection
1; mode=block
expires
Sun, 10 Jun 2018 16:48:31 GMT

Redirect headers

date
Fri, 08 Jun 2018 18:52:46 GMT
x-content-type-options
nosniff
server
sffe
status
302
content-type
text/html; charset=UTF-8
location
https://cse.google.com/coop/cse/brand?form=cse-search-box&lang=en
cache-control
private
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
266
x-xss-protection
1; mode=block
211x130_Cisco-device.jpg
www.bleepstatic.com/content/posts/2018/06/08/thumb/
4 KB
4 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/08/thumb/211x130_Cisco-device.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
75f4d66faf9ecb5ee9162622e8463ad53da62fbf7776a196f331a9b8f5bcfce5

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=4287, err=webp_bigger
status
200
content-length
3824
last-modified
Fri, 08 Jun 2018 09:39:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 08 Jul 2018 09:40:34 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae039744-FRA
cf-bgj
imgq:100
211x130_FTC.png
www.bleepstatic.com/content/hl-images/2018/06/07/thumb/
20 KB
20 KB
Image
General
Full URL
https://www.bleepstatic.com/content/hl-images/2018/06/07/thumb/211x130_FTC.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0b1148f37919a145504d62500b2e4778f1a8f96fc51454ebe7bc20e9f9f0f0c

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=31907
status
200
content-disposition
inline; filename="211x130_FTC.webp"
content-length
20500
last-modified
Thu, 07 Jun 2018 21:41:50 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 23:01:13 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae049744-FRA
cf-bgj
imgq:100
211x130_Supermicro.jpg
www.bleepstatic.com/content/posts/2018/06/07/thumb/
5 KB
5 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/07/thumb/211x130_Supermicro.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dbc006c71450e4ff941bc74f43e0ece97b97b77b5fc8a7976e8416f797864ada

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=5419, err=webp_bigger
status
200
content-length
5032
last-modified
Thu, 07 Jun 2018 10:57:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 21:02:42 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae059744-FRA
cf-bgj
imgq:100
211x130_BabaYaga-WordPress-Update-Page.jpg
www.bleepstatic.com/content/posts/2018/06/07/thumb/
5 KB
5 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/07/thumb/211x130_BabaYaga-WordPress-Update-Page.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
128f32bd40bd478cffb974e34ac29e53e1515381427a4124482b91721a68c65a

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=5589, err=webp_bigger
status
200
content-length
5055
last-modified
Thu, 07 Jun 2018 20:24:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 20:25:51 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae069744-FRA
cf-bgj
imgq:100
211x130_yahoo-messenger.jpg
www.bleepstatic.com/content/posts/2018/06/08/thumb/
5 KB
6 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/08/thumb/211x130_yahoo-messenger.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e9b4191148339344ecfe7f1d6eb12dc65b784acb69cecdc0a0200aa52b633ef

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=6064, err=webp_bigger
status
200
content-length
5592
last-modified
Fri, 08 Jun 2018 15:28:58 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 08 Jul 2018 15:48:35 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae079744-FRA
cf-bgj
imgq:100
211x130_InvisiMole.png
www.bleepstatic.com/content/posts/2018/06/08/thumb/
12 KB
12 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/08/thumb/211x130_InvisiMole.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c16f78c1e9e84c7634504ec4a27f8b4e491b0944226fb1d5b387c7dcb816ffa

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=18423
status
200
content-disposition
inline; filename="211x130_InvisiMole.webp"
content-length
12464
last-modified
Fri, 08 Jun 2018 14:21:16 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sun, 08 Jul 2018 14:22:28 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae089744-FRA
cf-bgj
imgq:100
211x130_PC-Malware.png
www.bleepstatic.com/content/hl-images/2016/11/30/thumb/
3 KB
3 KB
Image
General
Full URL
https://www.bleepstatic.com/content/hl-images/2016/11/30/thumb/211x130_PC-Malware.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
558d4a629da14b07cb7beeb983dd5f549f0e0a19f001c3de784083b62bce2f10

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=8271
status
200
content-disposition
inline; filename="211x130_PC-Malware.webp"
content-length
3190
last-modified
Wed, 30 Nov 2016 09:22:55 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sun, 08 Jul 2018 07:41:34 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae099744-FRA
cf-bgj
imgq:100
196-skype-classic.jpg
www.bleepstatic.com/download/nav-header-images/1/
6 KB
6 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/1/196-skype-classic.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
150b898680e649f163d8bcca0ff5deae40909421fb01d0d867e38ec3f4603f7e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=7890
status
200
content-disposition
inline; filename="196-skype-classic.webp"
content-length
6248
last-modified
Mon, 26 Feb 2018 14:18:11 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:13:04 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae0a9744-FRA
cf-bgj
imgq:100
195-gpu-z.jpg
www.bleepstatic.com/download/nav-header-images/1/
4 KB
4 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/1/195-gpu-z.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d11d8938e6e3f5415928e012bc31d32753ee9792c5fe8df57f42f4f2b41fdec

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=5851
status
200
content-disposition
inline; filename="195-gpu-z.webp"
content-length
4196
last-modified
Wed, 31 Jan 2018 18:37:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 23:54:12 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae0b9744-FRA
cf-bgj
imgq:100
194-insanecrypt-desucrypt-decrypter.jpg
www.bleepstatic.com/download/nav-header-images/1/
2 KB
2 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/1/194-insanecrypt-desucrypt-decrypter.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb8538dffb0334e2d261233f2de275907a4a5582e38c3879e2015eddb35ac9d4

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=4588
status
200
content-disposition
inline; filename="194-insanecrypt-desucrypt-decrypter.webp"
content-length
2350
last-modified
Mon, 22 Jan 2018 17:46:54 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 01:32:49 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae0d9744-FRA
cf-bgj
imgq:100
193-gibon-ransomware-decryptor.jpg
www.bleepstatic.com/download/nav-header-images/1/
2 KB
2 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/1/193-gibon-ransomware-decryptor.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb8538dffb0334e2d261233f2de275907a4a5582e38c3879e2015eddb35ac9d4

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=4588
status
200
content-disposition
inline; filename="193-gibon-ransomware-decryptor.webp"
content-length
2350
last-modified
Mon, 06 Nov 2017 15:55:17 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 23:44:03 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae0e9744-FRA
cf-bgj
imgq:100
96-adwcleaner.jpg
www.bleepstatic.com/download/nav-header-images/0/
8 KB
8 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/0/96-adwcleaner.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
951ddf22d995a038ead9f2e91ab18ab2829e8a382eda519342b0b998f36cf1af

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=9471
status
200
content-disposition
inline; filename="96-adwcleaner.webp"
content-length
8118
last-modified
Sat, 13 Aug 2016 22:53:01 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:02:12 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae0f9744-FRA
cf-bgj
imgq:100
9-combofix.jpg
www.bleepstatic.com/download/nav-header-images/0/
5 KB
5 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/0/9-combofix.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
16385b778e893fea4ce7daa7b01645297e44ad6622136cfa7a6525ac3cb060bc

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
last-modified
Sat, 04 Mar 2017 21:44:56 GMT
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae109744-FRA
content-length
5032
expires
Fri, 06 Jul 2018 04:27:55 GMT
8-rkill.jpg
www.bleepstatic.com/download/nav-header-images/0/
5 KB
5 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/0/8-rkill.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8950f9cbb7896df7fe26f759bf72223f92b33de77d315e0cb4ec3a772a9f3ca

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
last-modified
Sat, 04 Mar 2017 21:44:56 GMT
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae119744-FRA
content-length
5352
expires
Fri, 06 Jul 2018 04:27:54 GMT
98-junkware-removal-tool.jpg
www.bleepstatic.com/download/nav-header-images/0/
6 KB
6 KB
Image
General
Full URL
https://www.bleepstatic.com/download/nav-header-images/0/98-junkware-removal-tool.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d15b95bf4970eddb971b099a14f94c0de981ec80b720e7d21ba30c4e420a8444

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=7951
status
200
content-disposition
inline; filename="98-junkware-removal-tool.webp"
content-length
6428
last-modified
Fri, 20 Nov 2015 17:50:09 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:31:33 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae129744-FRA
cf-bgj
imgq:100
shutdown-timer-thmb-350.jpg
www.bleepstatic.com/removal-guides/s/shutdown-timer/
4 KB
4 KB
Image
General
Full URL
https://www.bleepstatic.com/removal-guides/s/shutdown-timer/shutdown-timer-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b12e1bf44cf2298027405746f211bcfcb1073db3a964e97445c4c5d93c0e73c1

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=4604, err=webp_bigger
status
200
content-length
3696
last-modified
Wed, 06 Jun 2018 00:50:45 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 00:51:49 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae139744-FRA
cf-bgj
imgq:100
software-updater-service-thmb-350.jpg
www.bleepstatic.com/removal-guides/s/software-updater-service/
6 KB
6 KB
Image
General
Full URL
https://www.bleepstatic.com/removal-guides/s/software-updater-service/software-updater-service-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
886666fb6f1d41f3ff1aa78dc1b4c6c87f3110cab6e6f47052c2d0ce2a7e3a3e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=6655, err=webp_bigger
status
200
content-length
5723
last-modified
Wed, 06 Jun 2018 00:47:43 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 00:48:10 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae149744-FRA
cf-bgj
imgq:100
auto-mechanic-2018-thmb-350.jpg
www.bleepstatic.com/removal-guides/a/auto-mechanic-2018/
13 KB
13 KB
Image
General
Full URL
https://www.bleepstatic.com/removal-guides/a/auto-mechanic-2018/auto-mechanic-2018-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5803a80762d6f911fd8dd5dc1823145f6f43b0ff0ee5b2ce2e8f9ce09b970861

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=14437, err=webp_bigger
status
200
content-length
13210
last-modified
Tue, 29 May 2018 13:36:51 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Thu, 28 Jun 2018 15:58:28 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae159744-FRA
cf-bgj
imgq:100
windows-net-proxy-auto-service-service-thmb-350.jpg
www.bleepstatic.com/removal-guides/w/windows-net-proxy-auto-service/
20 KB
20 KB
Image
General
Full URL
https://www.bleepstatic.com/removal-guides/w/windows-net-proxy-auto-service/windows-net-proxy-auto-service-service-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
70eb7b474480f19a1eecefd6edbb3c31a93faeb7088f9c3c86dc7746422554b4

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=22675, err=webp_bigger
status
200
content-length
20210
last-modified
Tue, 29 May 2018 12:49:13 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Thu, 28 Jun 2018 14:31:29 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae169744-FRA
cf-bgj
imgq:100
security-tool-thmb-350.jpg
www.bleepstatic.com/swr-guides/s/securitytool/
7 KB
7 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/s/securitytool/security-tool-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a595fcc49d99638da4d2003d86dddfc70eceebb9ab0ba9f6acee9c0de9b8fa0f

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=7915
status
200
content-length
6937
last-modified
Sat, 04 Mar 2017 17:11:38 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:54 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae179744-FRA
cf-bgj
imgq:100
antivirus-2009-thmb-350.jpg
www.bleepstatic.com/swr-guides/a/antivirus-2009/
11 KB
11 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/a/antivirus-2009/antivirus-2009-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
496f81a050e3eff47a78755cb2b4bb870d1b944af42bd078baa72cd9ece46fd5

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=12218
status
200
content-length
11037
last-modified
Sat, 04 Mar 2017 17:18:35 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae189744-FRA
cf-bgj
imgq:100
generic-chalkboard-211x130.jpg
www.bleepstatic.com/images/site/navigation/
3 KB
3 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/navigation/generic-chalkboard-211x130.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc1a5cd1bdb60c4796325ad79c483e5b6dcedad884c14fdfa2f7dc1a5407e4a1

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=2644
status
200
content-length
2612
last-modified
Wed, 25 Nov 2015 18:33:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae199744-FRA
cf-bgj
imgq:100
tdsskiller-start-thmb-350.jpg
www.bleepstatic.com/swr-guides/tools/tdsskiller/
6 KB
6 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/tools/tdsskiller/tdsskiller-start-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
13451dcbf777017c91b11755237fe091c7be397db95bb659dd92bc82e0263d23

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=7314
status
200
content-length
6279
last-modified
Sat, 04 Mar 2017 17:01:53 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 10 Jun 2018 22:27:17 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae1a9744-FRA
cf-bgj
imgq:100
locky-header-thmb-350.png
www.bleepstatic.com/swr-guides/l/locky/
28 KB
28 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/l/locky/locky-header-thmb-350.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c13f7a7ae91136735e8b9a518535d5832b5683aa86089f02fbb28419724de6c0

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
pngoptimizer, origSize=48002
status
200
content-length
28806
last-modified
Sat, 04 Mar 2017 17:08:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae1b9744-FRA
cf-bgj
imgq:100
CryptoLocker-thmb-350.jpg
www.bleepstatic.com/swr-guides/c/cryptolocker/
9 KB
9 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/c/cryptolocker/CryptoLocker-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
71e4ed905483936fd3bf5c82f41988757ea8e812107c0c79ab496b9a7e75718d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=9720
status
200
content-length
8863
last-modified
Sat, 04 Mar 2017 17:01:29 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae1c9744-FRA
cf-bgj
imgq:100
howdecrypt-thmb-350.gif
www.bleepstatic.com/swr-guides/c/cryptorbit/
22 KB
22 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/c/cryptorbit/howdecrypt-thmb-350.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec569f2ff9e47f52d3710ed53fa8cf0a014ea79fb54cf091f0239cfbdae56990

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=gif, origSize=28326
status
200
content-disposition
inline; filename="howdecrypt-thmb-350.webp"
content-length
22118
last-modified
Sat, 04 Mar 2017 17:01:17 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:31:32 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae1d9744-FRA
cf-bgj
imgq:100
how_decrypt-html-thmb-350.jpg
www.bleepstatic.com/swr-guides/c/CryptoDefense/
9 KB
9 KB
Image
General
Full URL
https://www.bleepstatic.com/swr-guides/c/CryptoDefense/how_decrypt-html-thmb-350.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
40a5f4ef0d4f9d3afd9255d53bf582bfff4913065c81b3f1dd77c30c6a49d096

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=10318
status
200
content-length
9080
last-modified
Sat, 04 Mar 2017 17:18:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae1e9744-FRA
cf-bgj
imgq:100
350-new-password-entered.jpg
www.bleepstatic.com/images/site/tutorials/nav-header-images/7/
8 KB
9 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/7/350-new-password-entered.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5689ee50aaeb228e297fd9276acd41518dce62e3e76b292fdec050436878dfb8

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=21201
status
200
content-disposition
inline; filename="350-new-password-entered.webp"
content-length
8566
last-modified
Fri, 04 May 2018 16:02:23 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 01:30:19 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae1f9744-FRA
cf-bgj
imgq:100
349-account-settings.jpg
www.bleepstatic.com/images/site/tutorials/nav-header-images/6/
10 KB
10 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/6/349-account-settings.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ef6f1bf3735aec0829e69209b989f049b0f2b2f428c312bfc4aadb86711bb14

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=23316
status
200
content-disposition
inline; filename="349-account-settings.webp"
content-length
9808
last-modified
Fri, 04 May 2018 15:35:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:06:37 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae209744-FRA
cf-bgj
imgq:100
348-hey-cortana.png
www.bleepstatic.com/images/site/tutorials/nav-header-images/6/
4 KB
4 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/6/348-hey-cortana.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
99012f79791e46655e96223362ed8aebbbe59904fae29988033fe4c91d7c2d8d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=6962
status
200
content-disposition
inline; filename="348-hey-cortana.webp"
content-length
4102
last-modified
Wed, 04 Apr 2018 00:55:38 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:13:06 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae229744-FRA
cf-bgj
imgq:100
347-app-settings.jpg
www.bleepstatic.com/images/site/tutorials/nav-header-images/6/
6 KB
7 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/6/347-app-settings.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e4d8d85fd9a2ae5712b38eac679930914cc8b6705fa36c62e447228ffa7801e7

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=14657
status
200
content-disposition
inline; filename="347-app-settings.webp"
content-length
6572
last-modified
Wed, 21 Mar 2018 20:21:44 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:48:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae239744-FRA
cf-bgj
imgq:100
61-startup-settings.png
www.bleepstatic.com/images/site/tutorials/nav-header-images/1/
7 KB
7 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/1/61-startup-settings.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5c8508b5403b3ca03c904bd90b08428114c6f8a6cec720fe588f146a2c11664

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=15212
status
200
content-disposition
inline; filename="61-startup-settings.webp"
content-length
7046
last-modified
Mon, 02 Oct 2017 01:44:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 01:01:49 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae249744-FRA
cf-bgj
imgq:100
101-Cerber-wallpaper.png
www.bleepstatic.com/images/site/tutorials/nav-header-images/2/
52 KB
52 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/2/101-Cerber-wallpaper.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0804129dfb42df37903e68fcddbc2ce4a377460d1ce3686a881b1c25f0cb2953

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=71304
status
200
content-disposition
inline; filename="101-Cerber-wallpaper.webp"
content-length
52764
last-modified
Wed, 13 Sep 2017 12:24:42 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 23:26:43 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae259744-FRA
cf-bgj
imgq:100
151-show-hidden-files.jpg
www.bleepstatic.com/images/site/tutorials/nav-header-images/3/
7 KB
7 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/3/151-show-hidden-files.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
370a4c08fcc68e1a97e3004e338748d7cc253bd1540a192172f95d565265f5a7

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=17665
status
200
content-disposition
inline; filename="151-show-hidden-files.webp"
content-length
7096
last-modified
Sat, 06 May 2017 18:39:54 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 22:53:20 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae269744-FRA
cf-bgj
imgq:100
62-hidden-files.jpg
www.bleepstatic.com/images/site/tutorials/nav-header-images/1/
5 KB
5 KB
Image
General
Full URL
https://www.bleepstatic.com/images/site/tutorials/nav-header-images/1/62-hidden-files.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e72b1eb40bc5b4b9fd74544d13be8234c9f52c89f6bb6d472f6190935afe22f

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=jpeg, origSize=14278
status
200
content-disposition
inline; filename="62-hidden-files.webp"
content-length
4834
last-modified
Sat, 06 May 2017 19:04:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:02:12 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae279744-FRA
cf-bgj
imgq:100
elearning-nav.jpg
www.bleepstatic.com/images/deals/
9 KB
9 KB
Image
General
Full URL
https://www.bleepstatic.com/images/deals/elearning-nav.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6143557b7f5f19ba25f0b8ef707599a5bb13952a4ff867e6652677ff5260ec20

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae289744-FRA
content-length
8954
expires
Fri, 06 Jul 2018 04:27:55 GMT
it-certification-nav.jpg
www.bleepstatic.com/images/deals/
8 KB
8 KB
Image
General
Full URL
https://www.bleepstatic.com/images/deals/it-certification-nav.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7befd17f6e2d040a6bc9e7abd8528fa87d853a928f7603e32b6cd36e19ef2a9

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae299744-FRA
content-length
8358
expires
Fri, 06 Jul 2018 05:21:25 GMT
gear-gadgets-nav.jpg
www.bleepstatic.com/images/deals/
4 KB
4 KB
Image
General
Full URL
https://www.bleepstatic.com/images/deals/gear-gadgets-nav.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
daa85ded4156b780540061c948a34b1ed8fc31d93655bac407bb12b41752596d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae2a9744-FRA
content-length
3785
expires
Fri, 06 Jul 2018 04:27:55 GMT
security-nav.jpg
www.bleepstatic.com/images/deals/
13 KB
13 KB
Image
General
Full URL
https://www.bleepstatic.com/images/deals/security-nav.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c495867cc3ab5c7cae6316d4157ff672ce172d86efed63d678151927030989a7

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=14191
status
200
content-length
13571
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 04:27:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae2b9744-FRA
cf-bgj
imgq:100
Chrome-extensions.jpg
www.bleepstatic.com/content/posts/2017/08/15/
155 KB
155 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2017/08/15/Chrome-extensions.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ca47ac7522c32eb4a4acb2f20034928c5fd492308eb0bef86402aad46ee0ab9

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
MISS
last-modified
Wed, 16 Aug 2017 01:22:31 GMT
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae2c9744-FRA
content-length
158392
expires
Sun, 08 Jul 2018 18:52:46 GMT
gtm.js
www.googletagmanager.com/
66 KB
22 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-N3FCGQ
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.72 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f8.1e100.net
Software
Google Tag Manager (scaffolding) /
Resource Hash
c1fd10f83242c8c832d6c8d3243d7180ec71c4f8473acd129ab8dbbd4e93f408
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
22397
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:46 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/
52 KB
20 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
8fe610f9d8cd1dc1d95881f10497cd420be1df13a95e2567c42a7fc30af04215
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20009
x-xss-protection
1; mode=block
server
cafe
etag
3541530574739903965
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 08 Jun 2018 18:52:46 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
72 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
1de6869366acfb4fda2da2dd9ef085d2a5c375657344d4395726fbe2524f4bfb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
27059
x-xss-protection
1; mode=block
server
cafe
etag
9647518572458795769
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 08 Jun 2018 18:52:46 GMT
292x176_VPNFilter-logo.png
www.bleepstatic.com/content/posts/2018/06/06/thumb/
18 KB
19 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/06/thumb/292x176_VPNFilter-logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed0d67dcf6a6cb0716be1dbaa0fa2b9059c7649161137efe0dca6c403d3ec6db

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=37251
status
200
content-disposition
inline; filename="292x176_VPNFilter-logo.webp"
content-length
18908
last-modified
Wed, 06 Jun 2018 15:50:36 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 01:55:31 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb59cdc9744-FRA
cf-bgj
imgq:100
292x176_Supermicro.jpg
www.bleepstatic.com/content/posts/2018/06/07/thumb/
8 KB
8 KB
Image
General
Full URL
https://www.bleepstatic.com/content/posts/2018/06/07/thumb/292x176_Supermicro.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f445112c3e40e803ac15c79cdc4e51e95697795899e584de5f1b422aac363d7d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origSize=8564, err=webp_bigger
status
200
content-length
8169
last-modified
Thu, 07 Jun 2018 10:57:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 08 Jul 2018 12:28:41 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb59cdd9744-FRA
cf-bgj
imgq:100
twitter.png
www.bleepstatic.com/images/site/login/
282 B
438 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/login/twitter.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=475
status
200
content-disposition
inline; filename="twitter.webp"
content-length
282
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 01:30:25 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb59cde9744-FRA
cf-bgj
imgq:100
bootstrap.js
www.bleepstatic.com/js/redesign/
64 KB
13 KB
Script
General
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e5884d1be3041eafbab27d898b8e401e0263c5bebaba17c97d82240064a362c

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
13441
last-modified
Thu, 23 Apr 2015 12:36:43 GMT
server
cloudflare
etag
"792990186"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb59cdf9744-FRA
expires
Tue, 26 Jun 2018 04:28:20 GMT
index.js
videos-bleepingcomputers-com.tvpagecdn.com/tvpwidget/sidebar-dynamic/
49 KB
10 KB
Script
General
Full URL
https://videos-bleepingcomputers-com.tvpagecdn.com/tvpwidget/sidebar-dynamic/index.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
54.93.39.116 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-93-39-116.eu-central-1.compute.amazonaws.com
Software
Netlify /
Resource Hash
10a2075bd80aa6e145816c982e326353fad91dff2c07ec83665261a477aa7701

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-bb-deploy-id
5aa2d8d9295b553f9fc6aa7a
date
Fri, 08 Jun 2018 10:46:39 GMT
content-encoding
gzip
server
Netlify
age
29168
status
200
etag
"88c4216f04f4c4aba281041b123a4c41-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
access-control-allow-headers
*
content-length
9515
jquery.fancybox.js
www.bleepstatic.com/js/redesign/fancybox/
48 KB
14 KB
Script
General
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js?v=2.1.5
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c78ce6b6d1928630b903084ea9d503643f303ba05455860cc7cd17f7687cc65

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
status
200
etag
"4087285096"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb59ce09744-FRA
content-length
13919
expires
Fri, 13 Jul 2018 18:52:46 GMT
fixto.min.js
www.bleepstatic.com/js/fixto/
8 KB
3 KB
Script
General
Full URL
https://www.bleepstatic.com/js/fixto/fixto.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
2686
last-modified
Sat, 13 Jun 2015 21:34:42 GMT
server
cloudflare
etag
"568800715"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eb59ce19744-FRA
expires
Tue, 26 Jun 2018 04:31:13 GMT
addthis_widget.js
s9.addthis.com/js/300/
351 KB
112 KB
Script
General
Full URL
https://s9.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
2.18.232.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-128.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5fbea6940d27958f33a5f388caca8dd12c410a88fb41a49e60780c51f645efd9

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
surrogate-key
client_dist
last-modified
Mon, 04 Jun 2018 20:17:14 GMT
server
nginx
etag
"5b159e4a-57c89"
vary
Accept-Encoding
x-distribution
99
cache-tag
client_dist
status
200
cache-control
public, max-age=600
x-host
s9.addthis.com
accept-ranges
bytes
timing-allow-origin
*
content-type
application/javascript
login_bg.png
www.bleepstatic.com/images/site/
126 B
385 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/login_bg.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9

Request headers

Referer
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=187
status
200
content-disposition
inline; filename="login_bg.webp"
content-length
126
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:17:34 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ae2d9744-FRA
cf-bgj
imgq:100
KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v18/
35 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900
Origin
https://www.bleepingcomputer.com

Response headers

date
Sat, 07 Apr 2018 05:12:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5406002
status
200
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20272
x-xss-protection
1; mode=block
last-modified
Mon, 16 Oct 2017 17:32:56 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 07 Apr 2019 05:12:44 GMT
KFOlCnqEu92Fr1MmWUlfBBc9.ttf
fonts.gstatic.com/s/roboto/v18/
34 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc9.ttf
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
70e339a1a220298dd1d9c6a69bbb3e3f7e2b4e655c85da9f127cb21a699f99d8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900
Origin
https://www.bleepingcomputer.com

Response headers

date
Tue, 13 Feb 2018 16:30:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
9944542
status
200
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20309
x-xss-protection
1; mode=block
last-modified
Mon, 16 Oct 2017 17:33:12 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 13 Feb 2019 16:30:24 GMT
comment-light.png
www.bleepstatic.com/images/site/
96 B
256 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/comment-light.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e

Request headers

Referer
https://www.bleepstatic.com/css/redesign/news.css?v=31017.2
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=1034
status
200
content-disposition
inline; filename="comment-light.webp"
content-length
96
last-modified
Fri, 29 May 2015 07:08:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:00:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ce4a9744-FRA
cf-bgj
imgq:100
clock.png
www.bleepstatic.com/images/site/
252 B
406 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/clock.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21

Request headers

Referer
https://www.bleepstatic.com/css/redesign/news.css?v=31017.2
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=1316
status
200
content-disposition
inline; filename="clock.webp"
content-length
252
last-modified
Fri, 29 May 2015 07:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 22:54:55 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ce4b9744-FRA
cf-bgj
imgq:100
calendar.png
www.bleepstatic.com/images/site/
86 B
269 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/calendar.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b

Request headers

Referer
https://www.bleepstatic.com/css/redesign/news.css?v=31017.2
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=129
status
200
content-disposition
inline; filename="calendar.webp"
content-length
86
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:17:33 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ce4c9744-FRA
cf-bgj
imgq:100
20x20-printer.png
www.bleepstatic.com/images/site/
422 B
582 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/20x20-printer.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1

Request headers

Referer
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=824
status
200
content-disposition
inline; filename="20x20-printer.webp"
content-length
422
last-modified
Sat, 03 Oct 2015 03:18:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:51:47 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ce4d9744-FRA
cf-bgj
imgq:100
nav_bg.png
www.bleepstatic.com/images/site/
72 B
352 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/nav_bg.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460

Request headers

Referer
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=83
status
200
content-disposition
inline; filename="nav_bg.webp"
content-length
72
last-modified
Sat, 04 Mar 2017 07:57:02 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 23:54:59 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb6ce4e9744-FRA
cf-bgj
imgq:100
KFOlCnqEu92Fr1MmSU5fBBc9.ttf
fonts.gstatic.com/s/roboto/v18/
35 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc9.ttf
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
3ee85c770966bfd58a0c807851e2c14d2c63abadcfb45ce30fbfbe871152caf2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900
Origin
https://www.bleepingcomputer.com

Response headers

date
Wed, 09 May 2018 03:51:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2646047
status
200
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20366
x-xss-protection
1; mode=block
last-modified
Mon, 16 Oct 2017 17:32:44 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 09 May 2019 03:51:59 GMT
KFOlCnqEu92Fr1MmEU9fBBc9.ttf
fonts.gstatic.com/s/roboto/v18/
35 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900
Origin
https://www.bleepingcomputer.com

Response headers

date
Mon, 12 Feb 2018 16:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
10032140
status
200
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20419
x-xss-protection
1; mode=block
last-modified
Mon, 16 Oct 2017 17:33:01 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 12 Feb 2019 16:10:26 GMT
integrator.js
adservice.google.de/adsid/
109 B
494 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/
109 B
494 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
104
x-xss-protection
1; mode=block
ca-pub-3249370012249755.js
pagead2.googlesyndication.com/pub-config/r20160913/
133 B
277 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-3249370012249755.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
sffe /
Resource Hash
ad3f5743027d58f0c5e8b2f074edc3fb50e776ddecdb8a90531fd30407d6ff48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 12:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 08 Jun 2018 00:35:29 GMT
server
sffe
age
23652
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
125
x-xss-protection
1; mode=block
expires
Sat, 09 Jun 2018 00:18:34 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20180606/r20180604/ Frame 1684
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20180606/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20180606/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Wed, 06 Jun 2018 14:46:42 GMT
expires
Wed, 20 Jun 2018 14:46:42 GMT
content-type
text/html; charset=UTF-8
etag
8341461738443483577
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6979
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
187564
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/ Frame 1D30
185 KB
69 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
f9741b66aa221bcff2c8901dfd50a449c564405f970fb269c3412bf9619d2a2d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
70460
x-xss-protection
1; mode=block
server
cafe
etag
4276430851371973721
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Fri, 08 Jun 2018 18:52:46 GMT
e1bde5ed1bb1075346983638c8e177b2.png
www.bleepstatic.com/author/photos/
29 KB
30 KB
Image
General
Full URL
https://www.bleepstatic.com/author/photos/e1bde5ed1bb1075346983638c8e177b2.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed8d3c278099f59854449fea39c7e95f3cbf41be2424511010c8248821b552fc

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=51751
status
200
content-disposition
inline; filename="e1bde5ed1bb1075346983638c8e177b2.webp"
content-length
30202
last-modified
Tue, 13 Sep 2016 21:21:44 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:02:40 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb74ee29744-FRA
cf-bgj
imgq:100
32x32-printer.png
www.bleepstatic.com/images/site/
256 B
417 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/32x32-printer.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590

Request headers

Referer
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=618
status
200
content-disposition
inline; filename="32x32-printer.webp"
content-length
256
last-modified
Fri, 02 Oct 2015 21:57:19 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 00:31:33 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb74ee39744-FRA
cf-bgj
imgq:100
news_email_icon.png
www.bleepstatic.com/images/site/
126 B
314 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/news_email_icon.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a

Request headers

Referer
https://www.bleepstatic.com/css/redesign/home.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=1105
status
200
content-disposition
inline; filename="news_email_icon.webp"
content-length
126
last-modified
Fri, 29 May 2015 07:10:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 06 Jul 2018 23:57:24 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb78f299744-FRA
cf-bgj
imgq:100
h4-bg.png
www.bleepstatic.com/images/site/
38 B
192 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/h4-bg.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339

Request headers

Referer
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=72
status
200
content-disposition
inline; filename="h4-bg.webp"
content-length
38
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sun, 01 Jul 2018 19:34:28 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb78f2a9744-FRA
cf-bgj
imgq:100
news_footer_icon.png
www.bleepstatic.com/images/site/
110 B
261 B
Image
General
Full URL
https://www.bleepstatic.com/images/site/news_footer_icon.png
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d

Request headers

Referer
https://www.bleepstatic.com/css/redesign/main.css?v=3.29.17.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
cf-cache-status
HIT
cf-polished
origFmt=png, origSize=186
status
200
content-disposition
inline; filename="news_footer_icon.webp"
content-length
110
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 07 Jul 2018 01:11:50 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
427d8eb7bf699744-FRA
cf-bgj
imgq:100
ca-pub-0920899300397823.js
pagead2.googlesyndication.com/pub-config/r20160913/
133 B
236 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-0920899300397823.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
sffe /
Resource Hash
ad3f5743027d58f0c5e8b2f074edc3fb50e776ddecdb8a90531fd30407d6ff48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 09:55:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 08 Jun 2018 00:30:18 GMT
server
sffe
age
32242
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
125
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 21:55:24 GMT
analytics.js
www.google-analytics.com/
34 KB
14 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-N3FCGQ
Protocol
SPDY
Server
216.58.207.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 18 May 2018 01:10:24 GMT
server
Golfe2
age
581
date
Fri, 08 Jun 2018 18:43:05 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
14386
expires
Fri, 08 Jun 2018 20:43:05 GMT
css
fonts.googleapis.com/
450 B
301 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com/tvpwidget/sidebar-dynamic/index.js
Protocol
SPDY
Server
216.58.207.74 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f10.1e100.net
Software
ESF /
Resource Hash
766f9a424b57841fd8f8a7ec5c2bf1718818a2c52008b7d05b23ab7bdcb9c276
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:46 GMT
css
fonts.googleapis.com/ Frame BFFE
450 B
301 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com/tvpwidget/sidebar-dynamic/index.js
Protocol
SPDY
Server
216.58.207.74 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f10.1e100.net
Software
ESF /
Resource Hash
766f9a424b57841fd8f8a7ec5c2bf1718818a2c52008b7d05b23ab7bdcb9c276
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:46 GMT
geocc.js
g.pcmag.com/
184 B
323 B
Script
General
Full URL
https://g.pcmag.com/geocc.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
23.67.132.148 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-132-148.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
99ecb14ec0a4e706ee386f1bde1a4684119fa8e100f24821f71f7fa75ccd481d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:46 GMT
Connection
keep-alive
Content-Length
184
Content-Type
application/javascript
beacon.js
sb.scorecardresearch.com/
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:46 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Sat, 09 Jun 2018 18:52:46 GMT
z0WVjCBSEeGLoxIxOQVEwQ.min.js
cdn.static.zdbb.net/eu/js/
Redirect Chain
  • https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
  • https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
19 KB
6 KB
Script
General
Full URL
https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aec23e33e546e31c593bcc44f10e9419a4b20ebc961663ef1b0b9eb4ff39a989

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
zTz_tFb6fEbZgayacJIfRXMkCS4DKScw
content-encoding
gzip
last-modified
Wed, 06 Jun 2018 16:58:42 GMT
x-amz-request-id
3AF7921164F7877D
date
Fri, 08 Jun 2018 18:52:46 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
5564
x-amz-id-2
lpk2U95MpDIGmIPLfGs1ih9uydAYCp6w4oRv6gf95Isr1tIHT/jbvxyaTxs4X+ut
expires
Fri, 08 Jun 2018 19:52:46 GMT

Redirect headers

status
303
date
Fri, 08 Jun 2018 18:52:46 GMT
cache-control
max-age=3600
core-eu
Yes
content-length
0
location
https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
expires
Fri, 08 Jun 2018 19:52:46 GMT
bk-coretag.js
tags.bkrtx.com/js/
28 KB
28 KB
Script
General
Full URL
https://tags.bkrtx.com/js/bk-coretag.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
2.19.32.164 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-32-164.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
05b9d55fa713061f2a66b576aa499141aa505fd76989cda669e86197c39dbb18

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:46 GMT
Last-Modified
Thu, 07 Jun 2018 21:25:37 GMT
Server
Apache
ETag
"3160052-6fe2-56e13eca8452a"
Content-Type
text/javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
28642
Expires
Fri, 15 Jun 2018 18:52:46 GMT
v60.js
secure-us.imrworldwide.com/
21 KB
7 KB
Script
General
Full URL
https://secure-us.imrworldwide.com/v60.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
138.108.96.100 Schaumburg, United States, ASN16477 (ACNIELSEN-AS - ACNIELSEN, US),
Reverse DNS
Software
nginx /
Resource Hash
8b9ff14a2ba603e1a32fddd3da2ffd8b50e201a9874ea3fafb50d537117153eb

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 Jan 2018 08:47:23 GMT
Server
nginx
ETag
"5a605f1b-1922"
Content-Type
application/x-javascript
Connection
keep-alive
Keep-Alive
timeout=5
Content-Length
6434
nsgpt.jsonp
ns.zdbb.net/
190 B
424 B
Script
General
Full URL
https://ns.zdbb.net/nsgpt.jsonp?u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
SPDY
Server
23.67.132.148 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-132-148.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d5632d024b7f80bf952f983a9b733e17994232a66a460bea7db5c5a3d5b79c0

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=58
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control
content-length
177
expires
Fri, 08 Jun 2018 18:53:44 GMT
gpt.js
www.googletagservices.com/tag/js/
19 KB
8 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
d7ece9c8c7bfd4c9732c71235cecc8800dc0deb8e1652aa7d97325eff94e74c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"5 / 339 of 1000 / last-modified: 1528464387"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
7619
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:46 GMT
iasPET.1.js
cdn.adsafeprotected.com/
7 KB
3 KB
Script
General
Full URL
https://cdn.adsafeprotected.com/iasPET.1.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
54.230.44.100 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-100.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
15318cd7cfd934ad4be8a9d2b57ab84bee103a3efffb30ea9f70b7f4acbcf825

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 04 May 2018 04:20:31 GMT
Content-Encoding
gzip
Last-Modified
Fri, 04 May 2018 04:20:28 GMT
Server
AmazonS3
Age
52323
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 7b6339693d82ec593824b8c6ad776117.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
X-Amz-Cf-Id
_4Jnj6b_TjxphhxK-B3sIVZxux9P26YABGq9zSXRTJYzyj7N0fCDew==
tag.js
native.sharethrough.com/assets/
378 KB
115 KB
Script
General
Full URL
https://native.sharethrough.com/assets/tag.js
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
SPDY
Server
54.230.44.243 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-243.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2a42cbfbf8f1f8f16343570edca6a1a004f0613da5bdcc1b070026b93adce2e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 04:40:45 GMT
content-encoding
gzip
last-modified
Fri, 08 Jun 2018 04:40:41 GMT
server
AmazonS3
age
722
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
uWq0dcyanIDHPSdzgc6EO8HNSj3kzYTTDINSZO8NpRS6Njp_vcd5Zw==
via
1.1 d2e34d11a094aa8f0c8077cfdf5b4b38.cloudfront.net (CloudFront)
expires
Fri, 08 Jun 2018 05:40:39 GMT
7hJiiEHoEeWRqiIAC39GJQ
cdn.nsstatic.com/tview/n/
4 B
120 B
Image
General
Full URL
https://cdn.nsstatic.com/tview/n/7hJiiEHoEeWRqiIAC39GJQ?g=a3522dcdb65979c567183779b655b28c&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&or=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
23.67.132.148 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-132-148.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Fri, 08 Jun 2018 18:52:46 GMT
cache-control
max-age=0, no-cache
content-length
4
expires
Fri, 08 Jun 2018 18:52:46 GMT
zd_footer_logo.png
static.adziff.com/pcmag/images/
1 KB
1 KB
Image
General
Full URL
https://static.adziff.com/pcmag/images/zd_footer_logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d9ab271a58bd3e13c43b449f2f9a547f13a8acb8f8d266602d8acbd2679ac5a1

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
null
last-modified
Thu, 21 Nov 2013 22:11:51 GMT
x-amz-request-id
B03D48F26FBB0E11
date
Fri, 08 Jun 2018 18:52:46 GMT
content-type
image/png
status
200
cache-control
max-age=7776000
accept-ranges
bytes
content-length
1272
x-amz-id-2
Hb/Kwi1SpBc4feL4S+uMzNQqzHmkMnaQ2S6BN1uk9ulsEYm7DFOoh4YjT0Gl3TJ4YyDfaayc3Lo=
expires
Thu, 06 Sep 2018 18:52:46 GMT
a.gif
zdbb.net/n/
43 B
262 B
Image
General
Full URL
https://zdbb.net/n/a.gif
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
54.72.182.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-182-106.eu-west-1.compute.amazonaws.com
Software
Ziff Davis BuyerBase /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:46 GMT
server
Ziff Davis BuyerBase
status
200
p3p
CP="ALL DSP COR NID"
access-control-allow-origin
*
cache-control
No-Cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
expires
0
activeview
pagead2.googlesyndication.com/
42 B
178 B
Image
General
Full URL
https://pagead2.googlesyndication.com/activeview?
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:46 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
gurgle.zdbb.net/
43 B
223 B
Image
General
Full URL
https://gurgle.zdbb.net/?domain=netshelter.net
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
status
200
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control
content-length
43
collect
www.google-analytics.com/r/
35 B
102 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j68&aip=1&a=1223192875&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&ul=en-us&de=UTF-8&dt=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=2048873492&gjid=1224211628&cid=246142973.1528483967&tid=UA-91740-1&_gid=1864758176.1528483967&_r=1&gtm=G64N3FCGQ&z=2127910626
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.78 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:46 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j68&a=1223192875&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-maliciou...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-25910482-11&cid=246142973.1528483967&jid=500332830&_gid=1864758176.1528483967&gjid=203610770&_v=j68&z=995453960
35 B
102 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-25910482-11&cid=246142973.1528483967&jid=500332830&_gid=1864758176.1528483967&gjid=203610770&_v=j68&z=995453960
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
66.102.1.157 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wb-in-f157.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 08 Jun 2018 18:52:46 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:46 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-25910482-11&cid=246142973.1528483967&jid=500332830&_gid=1864758176.1528483967&gjid=203610770&_v=j68&z=995453960
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
417
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 0D50
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3249370012249755&output=html&h=90&slotname=5975899204&adk=557056660&adf=2216754707&w=728&lmt=1502846673&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&wgl=1&adsid=NT&dt=1528483966583&bpp=18&bdt=336&fdt=21&idt=206&shv=r20180606&cbv=r20180604&saldr=sa&abxe=1&correlator=2477879929723&frm=20&pv=2&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=171801324032&dssz=41&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=261&ady=2217&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=1&xpc=PHZwUyNAfd&p=https%3A//www.bleepingcomputer.com&dtd=253
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-3249370012249755&output=html&h=90&slotname=5975899204&adk=557056660&adf=2216754707&w=728&lmt=1502846673&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&wgl=1&adsid=NT&dt=1528483966583&bpp=18&bdt=336&fdt=21&idt=206&shv=r20180606&cbv=r20180604&saldr=sa&abxe=1&correlator=2477879929723&frm=20&pv=2&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=171801324032&dssz=41&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=261&ady=2217&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=1&xpc=PHZwUyNAfd&p=https%3A//www.bleepingcomputer.com&dtd=253
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 08 Jun 2018 18:52:47 GMT
server
cafe
cache-control
private
content-length
15403
x-xss-protection
1; mode=block
set-cookie
test_cookie=CheckForPermission; expires=Fri, 08-Jun-2018 19:07:46 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
expires
Fri, 08 Jun 2018 18:52:47 GMT
osd.js
pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/
71 KB
26 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/osd.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
a390cf62fca4217670690ed84dcb7f8d569348f6ef9ef61b3ea4bc15c4548561
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Wed, 06 Jun 2018 14:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
187340
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
26505
x-xss-protection
1; mode=block
server
cafe
etag
18183909933677749988
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Jun 2018 14:50:26 GMT
scripts.min.js
videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/ Frame BFFE
6 KB
2 KB
Script
General
Full URL
https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
54.93.39.116 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-93-39-116.eu-central-1.compute.amazonaws.com
Software
Netlify /
Resource Hash
c2ba2eb0ae248fdbb8072b2e13da7994d02dee0696a9313cbdd22b747e0ba3a5

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-bb-deploy-id
5aa2d8d9295b553f9fc6aa7a
date
Fri, 08 Jun 2018 10:46:42 GMT
content-encoding
gzip
server
Netlify
age
29165
status
200
etag
"88e4fc50a87018a9810e7c5b116ee6b3-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
access-control-allow-headers
*
content-length
2379
styles.min.css
videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/css/ Frame BFFE
9 KB
4 KB
Stylesheet
General
Full URL
https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/css/styles.min.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
54.93.39.116 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-93-39-116.eu-central-1.compute.amazonaws.com
Software
Netlify /
Resource Hash
f18abebfda1e0d5479ac5ee54ee605a173a77a01f3170917fc709251f448556d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-bb-deploy-id
5aa2d8d9295b553f9fc6aa7a
date
Fri, 08 Jun 2018 10:46:42 GMT
content-encoding
gzip
server
Netlify
age
29165
status
200
etag
"f64b5d699c214cbe88bdda22b55da923-ssl-df"
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
access-control-allow-headers
*
content-length
3755
KFOmCnqEu92Fr1Mu4mxP.ttf
fonts.gstatic.com/s/roboto/v18/ Frame BFFE
35 KB
0
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Sat, 07 Apr 2018 05:12:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
5406002
status
200
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20272
x-xss-protection
1; mode=block
last-modified
Mon, 16 Oct 2017 17:32:56 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 07 Apr 2019 05:12:44 GMT
KFOlCnqEu92Fr1MmEU9fBBc9.ttf
fonts.gstatic.com/s/roboto/v18/ Frame BFFE
35 KB
0
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.67 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f3.1e100.net
Software
sffe /
Resource Hash
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Mon, 12 Feb 2018 16:10:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
10032140
status
200
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
20419
x-xss-protection
1; mode=block
last-modified
Mon, 16 Oct 2017 17:33:01 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 12 Feb 2019 16:10:26 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6036316&ns__t=1528483966848&ns_c=UTF-8&cv=3.1e&c8=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&c7...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6036316&ns__t=1528483966848&ns_c=UTF-8&cv=3.1e&c8=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&c...
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6036316&ns__t=1528483966848&ns_c=UTF-8&cv=3.1e&c8=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&c9=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-19-43-224.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:46 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=6036316&ns__t=1528483966848&ns_c=UTF-8&cv=3.1e&c8=Eight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&c9=
Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:46 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
segments.js
gurgle.zdbb.net/
2 KB
1 KB
Script
General
Full URL
https://gurgle.zdbb.net/segments.js?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b7d713512d82c73090b70a70ee41c3b9cd26179a73db4090af86a9c9e4bd1809

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
status
200
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control
content-length
877
walker.min.js
cdn.static.zdbb.net/js/
7 KB
3 KB
Script
General
Full URL
https://cdn.static.zdbb.net/js/walker.min.js?v=5
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d7d22751f1faf2473ebf462474c1c84a07c5b9d18cc09fc0ded523d73a4c674e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
t_8xLGzG.NU04CkFJ_L9YtfCbNHb8i_V
content-encoding
gzip
last-modified
Wed, 06 Jun 2018 16:58:42 GMT
x-amz-request-id
DA7D3FEDE8B4C25A
date
Fri, 08 Jun 2018 18:52:46 GMT
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
content-length
2729
x-amz-id-2
DfJ5+G8+q5hdWv/5fr4Pk8B2QPNyzNTRTfu7MVpVTbRUuMiyutmQoIqmpBF1B/Iy
expires
Fri, 08 Jun 2018 19:52:46 GMT
zd-core-olt.min.js
cdn.static.zdbb.net/js/
844 B
1 KB
Script
General
Full URL
https://cdn.static.zdbb.net/js/zd-core-olt.min.js?v=5
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
IYWKstejIBD54arrkZI5RiTtW4XrqCT1
last-modified
Wed, 06 Jun 2018 16:58:42 GMT
x-amz-request-id
061049DD434BE228
date
Fri, 08 Jun 2018 18:52:46 GMT
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
844
x-amz-id-2
dILuCXGFi7ojqYw+z8yhDm1zZSgT78QUxMVvFGT0+iEeSSY93+b73fwLuNSDvLL4lSvzjB4sbvk=
expires
Fri, 15 Jun 2018 18:52:46 GMT
z0WVjCBSEeGLoxIxOQVEwQ
zdbb.net/l/
43 B
262 B
Image
General
Full URL
https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?zd_pagview_id=eb0c6788-5874-4fc8-8f46-94e8fc49db39&zd_location=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&evidon_consent=undefined&cms_page_id=&local_uid=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
54.72.182.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-182-106.eu-west-1.compute.amazonaws.com
Software
Ziff Davis BuyerBase /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:46 GMT
server
Ziff Davis BuyerBase
status
200
p3p
CP="ALL DSP COR NID"
access-control-allow-origin
*
cache-control
No-Cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
expires
0
pubads_impl_213.js
securepubads.g.doubleclick.net/gpt/
174 KB
60 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
e30451ab10c133aa79ea31bc8db83eeb2fbea2d2b811e5564dff42c7d42e398f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 04 Jun 2018 18:27:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
61467
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:46 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/ Frame 17F9
185 KB
0
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
f9741b66aa221bcff2c8901dfd50a449c564405f970fb269c3412bf9619d2a2d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
70460
x-xss-protection
1; mode=block
server
cafe
etag
4276430851371973721
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Fri, 08 Jun 2018 18:52:46 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 1978
0
0

30629
stags.bluekai.com/site/ Frame 6EE0
0
0
Document
General
Full URL
https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dbleepingcomputer.com&phint=referer%3Dhttps%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&phint=__bk_t%3DEight%20Chrome%20Extensions%20Hijacked%20to%20Deliver%20Malicious%20Code%20to%204.8%20Million%20Users&phint=__bk_k%3Dcomputers%2C%20windows%2C%20linux%2C%20mac%2C%20support%2C%20tech%20support%2C%20spyware%2C%20malware%2C%20virus%2C%20security%2C%20Adware%2C%20Browser%2C%20Chrome%20extension%2C%20Google%20Chrome%2C%20Phishing%2Cvirus%20removal%2C%20malware%20removal%2C%20computer%20help%2C%20technical%20support&phint=__bk_l%3Dhttps%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&limit=10&bknms=&r=81244494
Requested by
Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.108.51.30 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-108-51-30.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
stags.bluekai.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
b91e
Date
Fri, 08 Jun 2018 18:52:47 GMT
Connection
keep-alive
X-N
S
videos
api.tvpage.com/v1/channels/81979997/ Frame BFFE
18 KB
3 KB
Script
General
Full URL
https://api.tvpage.com/v1/channels/81979997/videos?X-login-id=1758881&p=0&n=6&callback=tvp_166
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
52.89.201.181 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-89-201-181.us-west-2.compute.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) / PHP/7.0.28-1+ubuntu14.04.1+deb.sury.org+1
Resource Hash
ebead41b592cff0f3b123181a85b91ac004f530f03ba97fdec945fb1c89ac5df

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-version
a086f23
date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
server
nginx/1.4.6 (Ubuntu)
x-powered-by
PHP/7.0.28-1+ubuntu14.04.1+deb.sury.org+1
status
200
content-type
application/json
pragma
no-cache
x-login-id
1758881
cache-control
no-store, no-cache, must-revalidate
x-user-id
8
expires
Thu, 19 Nov 1981 08:52:00 GMT
truncated
/ Frame BFFE
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ad00ce0c27a5316106aa3a6b6bcc0b9036e1d6c2078dbbaff4f6fdda718e8be1

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
check
walker.zdbb.net/
5 B
376 B
XHR
General
Full URL
https://walker.zdbb.net/check?href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F
Requested by
Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/walker.min.js?v=5
Protocol
HTTP/1.1
Server
23.67.132.148 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-132-148.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4e523a5ae5b4636c75901b79fafbd3912e41dc7987414e688b09d4b436ff22b3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com

Response headers

Date
Fri, 08 Jun 2018 18:52:46 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=65660
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
5
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/ Frame F74D
185 KB
0
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
f9741b66aa221bcff2c8901dfd50a449c564405f970fb269c3412bf9619d2a2d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Fri, 08 Jun 2018 18:52:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
70460
x-xss-protection
1; mode=block
server
cafe
etag
4276430851371973721
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Fri, 08 Jun 2018 18:52:46 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 9F3E
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=1363081324&w=834&crui=image_stacked&cr_col=4&cr_row=2&fwrn=2&lmt=1502846673&rafmt=9&guci=1.2.0.0.2.2.0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&fwr=0&wgl=1&adsid=NT&dt=1528483966666&bpp=17&bdt=418&fdt=270&idt=272&shv=r20180606&cbv=r20180604&saldr=aa&abxe=1&prev_slotnames=5975899204%2C1089300124&correlator=2477879929723&frm=20&pv=2&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=175924546938880&dssz=51&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=208&ady=3376&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=7&ifi=3&xpc=pLzPJedS5T&p=https%3A//www.bleepingcomputer.com&dtd=283
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180606/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
216.58.207.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=1363081324&w=834&crui=image_stacked&cr_col=4&cr_row=2&fwrn=2&lmt=1502846673&rafmt=9&guci=1.2.0.0.2.2.0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&fwr=0&wgl=1&adsid=NT&dt=1528483966666&bpp=17&bdt=418&fdt=270&idt=272&shv=r20180606&cbv=r20180604&saldr=aa&abxe=1&prev_slotnames=5975899204%2C1089300124&correlator=2477879929723&frm=20&pv=2&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=175924546938880&dssz=51&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=208&ady=3376&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=7&ifi=3&xpc=pLzPJedS5T&p=https%3A//www.bleepingcomputer.com&dtd=283
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 08 Jun 2018 18:52:47 GMT
server
cafe
cache-control
private
content-length
8582
x-xss-protection
1; mode=block
set-cookie
test_cookie=CheckForPermission; expires=Fri, 08-Jun-2018 19:07:46 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
expires
Fri, 08 Jun 2018 18:52:47 GMT
cygnus
as-sec.casalemedia.com/
24 B
971 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?s=186662&v=7.2&r=%7B%22id%22%3A%221e3799cfe6c5a8%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2224e3848cce664f%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22728x90%22%2C%22siteID%22%3A%22186662%22%7D%7D%2C%7B%22id%22%3A%223ae7c30b45f621%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22970x250%22%2C%22siteID%22%3A%22186662%22%7D%7D%2C%7B%22id%22%3A%2240bfa2b61f0bf4%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A180%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22970x180%22%2C%22siteID%22%3A%22186662%22%7D%7D%2C%7B%22id%22%3A%225363eee903848a%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22970x90%22%2C%22siteID%22%3A%22186662%22%7D%7D%2C%7B%22id%22%3A%226e0766e6639a7a%22%2C%22banner%22%3A%7B%22w%22%3A997%2C%22h%22%3A123%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22997x123%22%2C%22siteID%22%3A%22186662%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F%22%2C%22ref%22%3A%22%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22BOORuRfOORuRfAKABDENAcAAAAAUWAAA%22%7D%7D%7D&ac=j&sd=1&
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b8cac7efd6ea95e27c24392b93c9bdd6e02e28d3e32b6c3bd48c49344319fc5a

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
44
Expires
Fri, 08 Jun 2018 18:52:47 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/
322 B
814 B
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11576&site_id=88252&zone_id=416734&size_id=2&alt_size_ids=55%2C57&p_pos=unknown&rp_floor=0.01&rp_secure=1&tk_flint=pbjs_lite_v1.12.0&x_source.tid=ac3cec44-6fbe-420c-8880-07f2f3fae6a5&p_screen_res=1600x1200&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&gdpr=1&gdpr_consent=BOORuRfOORuRfAKABDENAcAAAAAUWAAA&tg_i.site=bleepingcomputer.com&tg_i.pos=atf&tg_i.adunit=homepage&slots=1&rand=0.12143994551841653
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
62.67.193.41 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
30168c118c3243cb81b671312f3f0e99c1ff82cb0ac1d31d484ce46aab9c0c6e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=100
Content-Length
322
Expires
Wed, 17 Sep 1975 21:32:10 GMT
translator
hbopenbid.pubmatic.com/
0
123 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
SPDY
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Fri, 08 Jun 2018 18:52:47 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
prebid
ib.adnxs.com/ut/v3/
21 B
723 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.70:80
AN-X-Request-Uuid
2eefbfc6-e728-4a37-85ab-be15efb38b59
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
21
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
pub
pixel.adsafeprotected.com/services/
378 B
767 B
XHR
General
Full URL
https://pixel.adsafeprotected.com/services/pub?anId=7529&slot=%7Bid:nsgpt-billboard-1,ss:%5B728.90,970.250,970.180,970.90,997.123%5D,p:/4585/ns.bleepingcomputer/homepage,t:display%7D&slot=%7Bid:nsgpt-portrait-1,ss:%5B300.600,300.1050,300.250%5D,p:/4585/ns.bleepingcomputer/homepage,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=e2b15606-c35f-1416-3ebc-fdf1d584dc9b
Requested by
Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
d103739880dfde0845ea6d235002e500adc8621625307635140dd9d6f67dfd76

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com

Response headers

Date
Fri, 08 Jun 2018 18:52:47 GMT
X-Server-Name
app10ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Access-Control-Expose-Headers
X-Server-Name
Access-Control-Allow-Credentials
true
Connection
close
Timing-Allow-Origin
*
Server
nginx
_ate.track.config_resp
m.addthisedge.com/live/boost/ra-561517d2c7f964d6/
2 KB
900 B
Script
General
Full URL
https://m.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
2.18.232.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-128.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5fe405e64b42b49a5813c2c7b8e48ccf290310c5eb351d2b15966856d1a2f06e

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
surrogate-key
ra-561517d2c7f964d6
etag
-1808207170
vary
Accept-Encoding
cache-tag
ra-561517d2c7f964d6
status
200
cache-control
public, max-age=60, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-type
application/javascript;charset=UTF-8
content-length
678
cmp.js
quantcast.mgr.consensu.org/
78 KB
23 KB
Script
General
Full URL
https://quantcast.mgr.consensu.org/cmp.js
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Protocol
SPDY
Server
54.230.44.147 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-147.fra6.r.cloudfront.net
Software
CloudFront /
Resource Hash
0abf173e5f4d43ac48270635ee838e8cbf98aaaa8bf14ff1fd2f6b785c8c9c22

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 11:38:22 GMT
content-encoding
gzip
last-modified
Fri, 08 Jun 2018 00:24:12 GMT
server
CloudFront
age
846
etag
"7d4437c7800a8629e37ffc33b2e8ee68-1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript;charset=UTF-8
status
200
content-length
22867
via
1.1 bd881f081f56cf6bcf454c79fda1ac83.cloudfront.net (CloudFront)
x-amz-cf-id
3XkE3qpEdnv9t3v6aF84MKOWtK4mbbiW-DCm-h4NC7x7JZd-76RsIw==
cookieconsent.min.css
www.bleepstatic.com/js/cookieconsent/
4 KB
1 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/js/cookieconsent/cookieconsent.min.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
1182
last-modified
Mon, 21 Nov 2016 19:02:34 GMT
server
cloudflare
etag
"2423681425"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eba3acb9744-FRA
expires
Tue, 26 Jun 2018 04:29:32 GMT
font-awesome.css
www.bleepstatic.com/css/redesign/
26 KB
5 KB
Stylesheet
General
Full URL
https://www.bleepstatic.com/css/redesign/font-awesome.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.1.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef0151d0990a1fe95c1392db0d4408a90a348f0dc031e114ba583f1b2237ea1a

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
cf-cache-status
HIT
status
200
content-length
5363
last-modified
Tue, 03 May 2016 04:39:29 GMT
server
cloudflare
etag
"1091977398"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
accept-ranges
bytes
cf-ray
427d8eba3acc9744-FRA
expires
Tue, 26 Jun 2018 04:29:32 GMT
ads
securepubads.g.doubleclick.net/gampad/
32 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3297139274121041&correlator=2809040081233844&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21062069%2C21061763&vrg=213&guci=1.2.0.0.2.2.0&sc=1&sfv=1-0-28&iu_parts=1006593%2CROS_Side_2%2CNews_Sidebar_Sticky%2COnscroll_VET_Unit&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=300x600%7C300x250%2C300x600%7C300x250%2C1x1&cookie_enabled=1&bc=7&abxe=1&lmt=1502846673&dt=1528483967119&frm=20&biw=1585&bih=1200&oid=3&adxs=1072%2C1072%2C0&adys=812%2C1687%2C19&adks=4265011922%2C2863472922%2C1381562078&gut=v2&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&dssz=55&icsg=703698187755520&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=306x600%7C306x600%7C1585x4511&msz=306x600%7C306x600%7C1x-1&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
73ebddcca4303df4a3f6554729d41ad13e0f1ffd0e24a9183e3b3780f9f56dc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
10192
x-xss-protection
1; mode=block
google-lineitem-id
-1,-2,4469143802
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-2,138215017490
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_213.js
securepubads.g.doubleclick.net/gpt/
44 KB
17 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_213.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
a31c69281c7bb7e5ea7389d78c7399b747d9cc0c9e2aca9dba81c1e092c47e2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 04 Jun 2018 18:27:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
16996
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-28/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

expires
Wed, 05 Jun 2019 17:54:44 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 22 May 2018 18:40:55 GMT
content-type
text/html
translator
hbopenbid.pubmatic.com/
0
66 B
XHR
General
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
SPDY
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

status
204
date
Fri, 08 Jun 2018 18:52:47 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-origin
https://www.bleepingcomputer.com
fastlane.json
fastlane.rubiconproject.com/a/api/
323 B
814 B
XHR
General
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11576&site_id=88252&zone_id=416734&size_id=15&alt_size_ids=10%2C54&p_pos=unknown&rp_floor=0.01&rp_secure=1&tk_flint=pbjs_lite_v1.12.0&x_source.tid=96cd5ded-e14c-4eaa-af17-27c0e82b278e&p_screen_res=1600x1200&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&gdpr=1&gdpr_consent=BOORuRfOORuRfAKABDENAcAAAAAUWAAA&tg_i.site=bleepingcomputer.com&tg_i.pos=atf&tg_i.adunit=homepage&slots=1&rand=0.8041605689388609
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
62.67.193.41 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
7541b23deca1701b4e266505ccdbe1fa43f781140ae3d35354a5ff8b4c66579b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/json
Keep-Alive
timeout=5, max=35
Content-Length
323
Expires
Wed, 17 Sep 1975 21:32:10 GMT
cygnus
as-sec.casalemedia.com/
25 B
812 B
XHR
General
Full URL
https://as-sec.casalemedia.com/cygnus?s=186662&v=7.2&r=%7B%22id%22%3A%221704b571149cf6d%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22189904507d64154%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22300x600%22%2C%22siteID%22%3A%22186662%22%7D%7D%2C%7B%22id%22%3A%221937af4c3d2d8ab%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22300x1050%22%2C%22siteID%22%3A%22186662%22%7D%7D%2C%7B%22id%22%3A%2220eb1fa24c0bd65%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22300x250%22%2C%22siteID%22%3A%22186662%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F%22%2C%22ref%22%3A%22%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A1%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22BOORuRfOORuRfAKABDENAcAAAAAUWAAA%22%7D%7D%7D&ac=j&sd=1&
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85b16dbd42f870936751ab1dde82084ae53012da263cdd7ac618bebc40ebc41d

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
45
Expires
Fri, 08 Jun 2018 18:52:47 GMT
prebid
ib.adnxs.com/ut/v3/
21 B
723 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/bleepingcomputer.com.js
Protocol
HTTP/1.1
Server
185.33.223.83 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.51:80
AN-X-Request-Uuid
e7e95f1c-67c4-48d4-837e-4a338001d7b7
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
21
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fontawesome-webfont.woff
www.bleepstatic.com/fonts/
64 KB
64 KB
Font
General
Full URL
https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
104.24.0.61 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.bleepstatic.com/css/redesign/font-awesome.css
Origin
https://www.bleepingcomputer.com

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
last-modified
Thu, 23 Apr 2015 09:36:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
*
accept-ranges
bytes
cf-ray
427d8ebb1a8c970c-FRA
content-length
65452
ads
securepubads.g.doubleclick.net/gampad/
12 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3297139274121041&correlator=2809040081233844&output=json_html&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&adsid=NT&json_a=1&eid=21062069%2C21061763&vrg=213&npa=1&guci=1.2.0.0.2.1.0&sc=1&sfv=1-0-28&iu_parts=4585%2Cns.bleepingcomputer%2Chomepage&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C997x123%7C970x250%7C970x180%7C970x90%2C300x600%7C300x1050%7C300x250&prev_scp=rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%26id%3D2282a076-6b4d-11e8-a18e-00259088293c%26vw%3D40%2C50%26grm%3D40%2C50%26pub%3D40%7Crfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%26id%3D2282a077-6b4d-11e8-a18e-00259088293c%26vw%3D40%2C50%26grm%3D40%2C50%26pub%3D40&cust_params=ref%3D%26zdbb%3D%26amznslots%3D%26gdpr%3D0%26zcp%3Da04af12ae21965ff455e6%26cpid%3D38f037f4bad746a25f5ae50cfed73152%26mop%3Dy%26zdid%3D38f037f4bad746a25f5ae50cfed73152%26zc%3D535ef46f-a152-4adb-a831-9d001dd7cc2f%26fr%3Dtrue%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow&cookie_enabled=1&bc=7&abxe=1&lmt=1502846673&dt=1528483967247&frm=20&biw=1585&bih=1200&oid=3&adxs=429%2C1072&adys=147%2C343&adks=2093159140%2C962065453&gut=v2&ifi=8&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&dssz=56&icsg=703698187755520&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1170x120%7C306x600&msz=1170x90%7C306x600&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
ebfca5a07590adfd3bcfdc503c7b5b5f878ff7a192c8c2435226aa7b4a2afe55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
3842
x-xss-protection
1; mode=block
google-lineitem-id
44049572,44046452
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
53780021972,138234240615
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
layers.105c6c6960a6e63146f5.js
s7.addthis.com/static/
261 KB
74 KB
Script
General
Full URL
https://s7.addthis.com/static/layers.105c6c6960a6e63146f5.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
2.18.232.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-128.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6673a9154eba93ea0148857abafac567d0accf3bc686521cc3d8b531aa840c4c

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
last-modified
Mon, 04 Jun 2018 20:17:14 GMT
server
nginx
etag
"5b159e4a-41463"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86313600
x-host
s7.addthis.com
accept-ranges
bytes
timing-allow-origin
*
132.9523c9fe06b22b232a34.js
s7.addthis.com/static/
418 B
609 B
Script
General
Full URL
https://s7.addthis.com/static/132.9523c9fe06b22b232a34.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
2.18.232.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-128.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bab9dd19b4cf121a8e64052a7bd3c3dcae5ceb36423c8c8893b35039538f6359

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
last-modified
Tue, 29 May 2018 19:30:10 GMT
server
nginx
etag
"5b0daa42-1a2"
content-type
application/javascript
status
200
cache-control
public, max-age=86313600
x-host
s7.addthis.com
accept-ranges
bytes
timing-allow-origin
*
content-length
418
container.html
tpc.googlesyndication.com/safeframe/1-0-28/html/ Frame E7C3
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_213.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-28/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
1479
date
Tue, 05 Jun 2018 17:54:44 GMT
expires
Wed, 05 Jun 2019 17:54:44 GMT
last-modified
Tue, 22 May 2018 18:40:55 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
1; mode=block
cache-control
public, immutable, max-age=31536000
age
262683
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
tag.min.js
get.s-onetag.com/2fa26226-c8f0-4d1d-bcfb-8fce981242a4/ Frame 1D99
28 KB
28 KB
Script
General
Full URL
https://get.s-onetag.com/2fa26226-c8f0-4d1d-bcfb-8fce981242a4/tag.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
54.230.47.244 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-47-244.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
158b054dcd5736747ef430b45ffc144d3fcb0350d67eb50be7717df827906d14

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Thu, 02 Nov 2017 15:37:18 GMT
content-encoding
utf8
last-modified
Thu, 02 Nov 2017 15:19:33 GMT
server
AmazonS3
age
20365
etag
"265f53013d20412c6d4d003b216bba83"
x-cache
Hit from cloudfront
x-amz-version-id
yFdoJ1QfVv_bvQmm5rwzb0iFLOsUy3FJ
status
200
accept-ranges
bytes
content-type
text/javascript
content-length
28425
via
1.1 f17892129c0657c8d9d0809a1b0b00be.cloudfront.net (CloudFront)
x-amz-cf-id
ysLJwzxC6C2pA7i6Lsdvepje4P7Gcfr12aZTU4Bt_bxa5GFExOttRQ==
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180606/r20110914/activeview/ Frame 1D99
69 KB
25 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180606/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
cafe /
Resource Hash
9bb74272e1b56376efcfdb67b5d8252269e024a1947ac037ef2e7b632235bb44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Wed, 06 Jun 2018 13:18:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
192868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
25828
x-xss-protection
1; mode=block
server
cafe
etag
16968308265266717277
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Jun 2018 13:18:19 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 1D99
0
83 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvR47D5quRELcSah3g-bJcIMLikNP2V9ZX2sxQus3UwD74XaqusIPq1l5XSqPcsOb3bu8PFZOc7fikuCljw9DHGe5eJx9hN30GvtkqpKTyTLSe-u9TKgIEOuKEjd3__H0fdwaUqmT5LbygHYcAcXYskmT5ZT8EPfLnORLaTVhLjipbsLmLgfGAnd-Xk8eUp5BsOieKpfygLTgIxQp4-Ex6UsTa3AGnDKUqWdVpwFKvTKvKUT4SsywHLt2YaxKBcFtPa4uu-aLr3ros&sai=AMfl-YR1ObczS2h97Yxi0YIKIJqwdKgEYyyOGoCCDLDT_2o8cS7npon6iDn2yuyTyKnlvJsTCjPJazPTfSiEvBT1e5hzov-M2zBcbJm9TmFeQYVM8aG8kdGOH3VWKIA&sig=Cg0ArKJSzBFz-kj1B4ivEAE&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control
private
content-type
text/html; charset=UTF-8
jload
pixel.adsafeprotected.com/ Frame 5BE3
38 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=7529&campId=728x90&pubId=25349972&chanId=175702292&placementId=44049572&pubCreative=53780021972&pubOrder=129076172&cb=903959442&adsafe_par&impId=2282a076-6b4d-11e8-a18e-00259088293c
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
6ea534a2144a80caf83d82c77e46c79faa16fef770b61b9cec98e4ab96109827

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
X-Server-Name
app38ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 5487
19 KB
8 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
d7ece9c8c7bfd4c9732c71235cecc8800dc0deb8e1652aa7d97325eff94e74c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"5 / 633 of 1000 / last-modified: 1528464387"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
7619
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180606/r20110914/activeview/ Frame 5487
69 KB
25 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180606/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
cafe /
Resource Hash
9bb74272e1b56376efcfdb67b5d8252269e024a1947ac037ef2e7b632235bb44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Wed, 06 Jun 2018 13:18:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
192868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
25828
x-xss-protection
1; mode=block
server
cafe
etag
16968308265266717277
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Jun 2018 13:18:19 GMT
moatad.js
z.moatads.com/ziffdaviscwnew43828694654/ Frame 5487
276 KB
85 KB
Script
General
Full URL
https://z.moatads.com/ziffdaviscwnew43828694654/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
45e3123bef5813859fad482b2a191baa3f082dea1326f2461bb9d46b5189deee

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 May 2018 18:56:34 GMT
Server
AmazonS3
x-amz-request-id
9D7B7E8EE66CCD7D
ETag
"69f51cbdc20f7e7123c3646ebe55a570"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=49931
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86480
x-amz-id-2
Yo0MbOVc0eyh2UTd0Y1Sg9XMnrcGcA/tlTFkfd2mPiBhSX4ZrOcUZo60HR7IVlBBHNp5xavNRBA=
zdvtools.min.js
static.ziffdavis.com/jst/ Frame 5487
16 KB
5 KB
Script
General
Full URL
https://static.ziffdavis.com/jst/zdvtools.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1edf0d5a8022d32e025aa68393986b16b3354087e322dd2142d1032b9deb6ed3

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
nP6Pc7fjQHi8Ai.rT5Imo5m3mXg8vqAv
content-encoding
gzip
last-modified
Wed, 20 Sep 2017 17:34:47 GMT
x-amz-request-id
4C4EC389AFC6A327
date
Fri, 08 Jun 2018 18:52:47 GMT
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=604800
x-amz-replication-status
COMPLETED
accept-ranges
bytes
content-length
5032
x-amz-id-2
jt6E6Cv6g1Of006yOo8wiyeewHQj35WWWKFQi6D08PGTd8tqgqskYjhMwpX9JQ9UXMQFKism2MI=
expires
Fri, 15 Jun 2018 18:52:47 GMT
jload
pixel.adsafeprotected.com/ Frame 63E1
38 KB
13 KB
Script
General
Full URL
https://pixel.adsafeprotected.com/jload?anId=7529&campId=300x250&pubId=25349972&chanId=175702292&placementId=44046452&pubCreative=138234240615&pubOrder=129076172&cb=1547039622&adsafe_par&impId=2282a077-6b4d-11e8-a18e-00259088293c
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e9e8daaf6f563b5faec898162ce48a361f3bbfa4cd063425e62445ce705e2f1a

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
X-Server-Name
app09ami.ami.303net.pvt
Transfer-Encoding
chunked
Content-Type
application/javascript;charset=utf-8
Access-Control-Allow-Origin
pixel.adsafeprotected.com
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
close
Server
nginx
Expires
Wed, 31 Dec 1969 23:59:59 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 11B8
19 KB
8 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
d7ece9c8c7bfd4c9732c71235cecc8800dc0deb8e1652aa7d97325eff94e74c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"5 / 163 of 1000 / last-modified: 1528464387"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
7619
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180606/r20110914/activeview/ Frame 11B8
69 KB
25 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180606/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
cafe /
Resource Hash
9bb74272e1b56376efcfdb67b5d8252269e024a1947ac037ef2e7b632235bb44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Wed, 06 Jun 2018 13:18:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
192868
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
25828
x-xss-protection
1; mode=block
server
cafe
etag
16968308265266717277
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Jun 2018 13:18:19 GMT
moatad.js
z.moatads.com/ziffdaviscwnew43828694654/ Frame 11B8
276 KB
85 KB
Script
General
Full URL
https://z.moatads.com/ziffdaviscwnew43828694654/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
45e3123bef5813859fad482b2a191baa3f082dea1326f2461bb9d46b5189deee

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 31 May 2018 18:56:34 GMT
Server
AmazonS3
x-amz-request-id
9D7B7E8EE66CCD7D
ETag
"69f51cbdc20f7e7123c3646ebe55a570"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=49931
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86480
x-amz-id-2
Yo0MbOVc0eyh2UTd0Y1Sg9XMnrcGcA/tlTFkfd2mPiBhSX4ZrOcUZo60HR7IVlBBHNp5xavNRBA=
zdvtools.min.js
static.ziffdavis.com/jst/ Frame 11B8
16 KB
5 KB
Script
General
Full URL
https://static.ziffdavis.com/jst/zdvtools.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
23.67.139.108 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-139-108.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1edf0d5a8022d32e025aa68393986b16b3354087e322dd2142d1032b9deb6ed3

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

x-amz-version-id
nP6Pc7fjQHi8Ai.rT5Imo5m3mXg8vqAv
content-encoding
gzip
last-modified
Wed, 20 Sep 2017 17:34:47 GMT
x-amz-request-id
4C4EC389AFC6A327
date
Fri, 08 Jun 2018 18:52:47 GMT
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=604800
x-amz-replication-status
COMPLETED
accept-ranges
bytes
content-length
5032
x-amz-id-2
jt6E6Cv6g1Of006yOo8wiyeewHQj35WWWKFQi6D08PGTd8tqgqskYjhMwpX9JQ9UXMQFKism2MI=
expires
Fri, 15 Jun 2018 18:52:47 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5487
0
47 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuhNl3Iz8P5H0DpkQYmD-gf4heblYgmxisZDfkL_tgVbZ0MhPKzH77sGH8KERMSF_Q3_TxCWpwrBww_WPXEY42TVJW5PubRPZVwnhlJqNOpTgjkUF1eGqsBH7x0byVqDb7wRz34-usp0NG1qYbJq8HFzlJXC7zJGUGDBlHimxnvtiZh4nkEZKJgJr5gA6BCSopuQIvIvCh0a4WqJnl3afMbW7ASfx_i2Py4vBs-h2Uvl8vXaQWrDzuoYZmBPH7I5hVE-5uh6G5HkxG6T42-Bqy&sai=AMfl-YSYApsyK_q4MG9GAhkCKCJcyDTU23PurPW1nATRhK5sUiuGilpLGyovmIUjAI5Aefsifo3j15tCryzaRBuBMxb5Yxt2QoJNAv6sYvc_Pifc-LAnVrHXCHhz6_jk&sig=Cg0ArKJSzNdfQa6Syr-dEAE&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control
private
content-type
text/html; charset=UTF-8
view
securepubads.g.doubleclick.net/pcs/ Frame 11B8
0
56 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss3rX5WbSCg_RmixrcKyulztO_TVxXsFmXVOKhcWn2RBQDuO6J58sXxtLIVO4MVaNl-NfERAWlb-RDCg4Xe_iB9K9T96awORMhgyaUYGlny9EHfFZpCLEgC9nKABLTrdX75dCCl9pJdJc0lrmK8NLOtz6eHI8tvd0GZiTKfpBCkPwjlXeI8e8byEVwBmnd4A1Mt1EWI4abRj-UTBK-AiXgKym6L9Lovbcg3f3UhZE5C3E3T2OgNeBr03tv747o_MBJgl4UxBCiaLWtcCv6LTpe6&sai=AMfl-YSrdOErGaehmpmRNa3tX-TsVV118ManMJ2zKtvbukhDM-gElhiX6FMD7CuSKVtnY7ofr7huSZzuf6RW2y1IFeaywMnewSg8DLdKDrmBaTa_0h_WMq7M0_ywJ62z&sig=Cg0ArKJSzBCKYEE9A7YHEAE&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

cache-control
private
content-type
text/html; charset=UTF-8
pubads_impl_213.js
securepubads.g.doubleclick.net/gpt/ Frame 5487
174 KB
60 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js?v=214
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
e30451ab10c133aa79ea31bc8db83eeb2fbea2d2b811e5564dff42c7d42e398f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 04 Jun 2018 18:27:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
61467
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
integrator.sync.js
adservice.google.de/adsid/ Frame 5487
113 B
178 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.sync.js?domain=www.bleepingcomputer.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
108
x-xss-protection
1; mode=block
pubads_impl_213.js
securepubads.g.doubleclick.net/gpt/ Frame 11B8
174 KB
60 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
e30451ab10c133aa79ea31bc8db83eeb2fbea2d2b811e5564dff42c7d42e398f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 04 Jun 2018 18:27:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
61467
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
integrator.sync.js
adservice.google.de/adsid/ Frame 11B8
113 B
175 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.sync.js?domain=www.bleepingcomputer.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Server
172.217.22.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s18-in-f2.1e100.net
Software
cafe /
Resource Hash
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
108
x-xss-protection
1; mode=block
main.17.4.109.js
static.adsafeprotected.com/ Frame 5BE3
138 KB
44 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.17.4.109.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=728x90&pubId=25349972&chanId=175702292&placementId=44049572&pubCreative=53780021972&pubOrder=129076172&cb=903959442&adsafe_par&impId=2282a076-6b4d-11e8-a18e-00259088293c
Protocol
HTTP/1.1
Server
69.172.216.58 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b2ad83b4e5a4331a17c58dfdbefaea5f62d5cd01cd987f89b190ab8bfdc01c0c

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 30 May 2018 15:38:35 GMT
X-Server-Name
app04ami.ami.303net.pvt
ETag
"5b0ec57b-ae53"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
close
Content-Length
44627
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
main.17.4.109.js
static.adsafeprotected.com/ Frame 63E1
138 KB
44 KB
Script
General
Full URL
https://static.adsafeprotected.com/main.17.4.109.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=300x250&pubId=25349972&chanId=175702292&placementId=44046452&pubCreative=138234240615&pubOrder=129076172&cb=1547039622&adsafe_par&impId=2282a077-6b4d-11e8-a18e-00259088293c
Protocol
HTTP/1.1
Server
69.172.216.58 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b2ad83b4e5a4331a17c58dfdbefaea5f62d5cd01cd987f89b190ab8bfdc01c0c

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 30 May 2018 15:38:35 GMT
X-Server-Name
app29ami.ami.303net.pvt
ETag
"5b0ec57b-ae53"
Content-Type
application/javascript
Cache-Control
max-age=315360000
Connection
close
Content-Length
44627
Server
nginx
Expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ Frame 1D99
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f0d06f0c4ab947fdf1f8afb1cc249fde6d4262ed8883d5492fd421033fcdfa6a

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
ziffdavis.json
cdn-gl.imrworldwide.com/ci/
677 B
1 KB
XHR
General
Full URL
https://cdn-gl.imrworldwide.com/ci/ziffdavis.json
Requested by
Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol
HTTP/1.1
Server
54.230.44.63 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-63.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
58d199beb6bf57bba7c33c96e11f1ef582d1aedb609817dd7411b23e63286a75

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Origin
https://www.bleepingcomputer.com

Response headers

Date
Fri, 08 Jun 2018 18:41:48 GMT
Via
1.1 605e6ba1f1cba02856e68eba7a887943.cloudfront.net (CloudFront)
Vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
Age
660
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
677
Last-Modified
Fri, 08 Jun 2018 17:02:35 GMT
Server
AmazonS3
ETag
"1dbe80a020b3de70dec1ecbb69f996ac"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
x-amz-version-id
r5JNjrcVDPbDWfnzKw5xzkrGNSq2cygs
Access-Control-Allow-Origin
*
Accept-Ranges
bytes
Content-Type
application/json
X-Amz-Cf-Id
UQWfXpGkQ9r-_bI8aMyVi3idBDGZSj72-imfoZp8ZWSkumtkmfwuJg==
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1528483967775&ci=ziffdavis&js=1&cg=0&ts=bk-coretag.js&vn=6.0.58&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsec...
  • https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1528483967775&ci=ziffdavis&js=1&cg=0&ts=bk-coretag.js&vn=6.0.58&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsec...
44 B
402 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1528483967775&ci=ziffdavis&js=1&cg=0&ts=bk-coretag.js&vn=6.0.58&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&sr=1600x1200&ja=1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
138.108.96.100 Schaumburg, United States, ASN16477 (ACNIELSEN-AS - ACNIELSEN, US),
Reverse DNS
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=5
Content-Length
44
Expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Location
https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1528483967775&ci=ziffdavis&js=1&cg=0&ts=bk-coretag.js&vn=6.0.58&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&sr=1600x1200&ja=1
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=5
Content-Length
0
Expires
Thu, 01 Dec 1994 16:00:00 GMT
hqdefault.jpg
i.ytimg.com/vi/izBxC4uINRE/ Frame BFFE
27 KB
27 KB
Image
General
Full URL
https://i.ytimg.com/vi/izBxC4uINRE/hqdefault.jpg
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
172.217.21.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f22.1e100.net
Software
sffe /
Resource Hash
05009f280062d69bd4136f4c7181ca59cabac05983a621960a64c7b52ab05e1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:11:09 GMT
x-content-type-options
nosniff
server
sffe
age
2498
etag
"1497967145"
content-type
image/jpeg
status
200
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
https://imasdk.googleapis.com
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
27469
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 20:11:09 GMT
hqdefault.jpg
i.ytimg.com/vi/ShoDLNdMLv4/ Frame BFFE
15 KB
15 KB
Image
General
Full URL
https://i.ytimg.com/vi/ShoDLNdMLv4/hqdefault.jpg
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
172.217.21.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f22.1e100.net
Software
sffe /
Resource Hash
51143c591c24c8aea630c8ee7e89d9c1c94421a975e68e9b76af079c06875207
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 16:57:09 GMT
x-content-type-options
nosniff
server
sffe
age
6938
etag
"0"
content-type
image/jpeg
status
200
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
https://imasdk.googleapis.com
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
14885
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:57:09 GMT
hqdefault.jpg
i.ytimg.com/vi/EWbVtr676Ts/ Frame BFFE
15 KB
16 KB
Image
General
Full URL
https://i.ytimg.com/vi/EWbVtr676Ts/hqdefault.jpg
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
172.217.21.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f22.1e100.net
Software
sffe /
Resource Hash
18e919441487a7727b10f240e8f2f181fc5c0b8b2bc4119b5cdef0b003eec4b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:27:45 GMT
x-content-type-options
nosniff
server
sffe
age
1502
etag
"0"
content-type
image/jpeg
status
200
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
https://imasdk.googleapis.com
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
15841
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 20:27:45 GMT
maxresdefault.jpg
i.ytimg.com/vi/6rdnc6bkd2M/ Frame BFFE
68 KB
68 KB
Image
General
Full URL
https://i.ytimg.com/vi/6rdnc6bkd2M/maxresdefault.jpg
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
172.217.21.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f22.1e100.net
Software
sffe /
Resource Hash
5f62a0ff5caac611d412976915e7fe1147b183638c0523f0cd8206c18c6fc217
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:27:32 GMT
x-content-type-options
nosniff
server
sffe
age
1515
etag
"0"
content-type
image/jpeg
status
200
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
https://imasdk.googleapis.com
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
69220
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 20:27:32 GMT
sddefault.jpg
i.ytimg.com/vi/dZYZJ24dBiQ/ Frame BFFE
31 KB
31 KB
Image
General
Full URL
https://i.ytimg.com/vi/dZYZJ24dBiQ/sddefault.jpg
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
172.217.21.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f22.1e100.net
Software
sffe /
Resource Hash
303c24f6aa76ab22792ace7cbe3b244078b141959064fcb6f0fc5d9353002e4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:20:15 GMT
x-content-type-options
nosniff
server
sffe
age
1952
etag
"1509585838"
content-type
image/jpeg
status
200
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
https://imasdk.googleapis.com
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
31686
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 20:20:15 GMT
maxresdefault.jpg
i.ytimg.com/vi/GhYUAxizfcY/ Frame BFFE
66 KB
66 KB
Image
General
Full URL
https://i.ytimg.com/vi/GhYUAxizfcY/maxresdefault.jpg
Requested by
Host: videos-bleepingcomputers-com.tvpagecdn.com
URL: https://videos-bleepingcomputers-com.tvpagecdn.com//sidebar/dist/js/scripts.min.js
Protocol
SPDY
Server
172.217.21.214 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f22.1e100.net
Software
sffe /
Resource Hash
b425ea792e2609fd5c4b96c092402c766332151b3b812d97ebd327da7019746e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:50:26 GMT
x-content-type-options
nosniff
server
sffe
age
141
etag
"0"
content-type
image/jpeg
status
200
cache-control
public, max-age=7200
accept-ranges
bytes
timing-allow-origin
https://imasdk.googleapis.com
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
67603
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 20:50:26 GMT
config250.js
cdn-gl.imrworldwide.com/conf/
11 KB
4 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/conf/config250.js
Requested by
Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol
HTTP/1.1
Server
54.230.44.128 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-128.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d8bacdb80d8789532f595bd20e39f7cc0f89c7dfbc38d288111f0123b2a0be70

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:41:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Jun 2018 16:53:16 GMT
Server
AmazonS3
Age
662
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
chpSbAuQmt.GYM6xgDZsg6G0XqouPFWm
Via
1.1 5d53a1d9ef3a6f7480785993c37a7ad5.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
application/javascript
X-Amz-Cf-Id
1IH24QPrY2yw1LubBYkcufWHrg4TlKueVknEcLy8GHGSsIUmxQ4cBg==
ads
securepubads.g.doubleclick.net/gampad/ Frame 11B8
313 B
313 B
Script
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1036227809103398&correlator=4092180748459343&output=json_html&callback=googletag.impl.pubads.setPassbackAdContents&impl=s&vrg=213&npa=1&guci=1.2.0.0.2.1.0&sc=1&sfv=1-0-28&iu=%2F1006593%2FHomepage-Side&sz=300x250&eri=2&cookie=ID%3Dd1cdaf6fb0b4727f%3AT%3D1528483967%3AS%3DALNI_MZbPdoUtgufOj4Ni-QL2TAu_TjpJw&cdm=www.bleepingcomputer.com&bc=7&lmt=1528483967&dt=1528483967824&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adk=2702083573&ifi=1&ifk=1863898685&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&dssz=7&icsg=10&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=826393954.1528483968&ga_sid=1528483968&ga_hid=1770181932
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
c96d21225ee8cdc9844f5da093a6b92bb2e8aaff6d9c6a1995da240f25bf21fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
225
x-xss-protection
1; mode=block
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_213.js
securepubads.g.doubleclick.net/gpt/ Frame 11B8
44 KB
17 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_213.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
a31c69281c7bb7e5ea7389d78c7399b747d9cc0c9e2aca9dba81c1e092c47e2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 04 Jun 2018 18:27:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
16996
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-28/html/ Frame 11B8
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js
Protocol
SPDY
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

expires
Wed, 05 Jun 2019 17:55:32 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 22 May 2018 18:40:55 GMT
content-type
text/html
ads
securepubads.g.doubleclick.net/gampad/ Frame 5487
29 KB
9 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1540997164353455&correlator=1204152426031636&output=json_html&callback=googletag.impl.pubads.setPassbackAdContents&impl=s&eid=21062203%2C21062068&vrg=213&npa=1&guci=1.2.0.0.2.1.0&sc=1&sfv=1-0-28&iu=%2F1006593%2FHomepage-Top&sz=728x90&eri=2&cookie=ID%3Dd1cdaf6fb0b4727f%3AT%3D1528483967%3AS%3DALNI_MZbPdoUtgufOj4Ni-QL2TAu_TjpJw&cdm=www.bleepingcomputer.com&bc=7&lmt=1528483967&dt=1528483967853&ea=0&frm=23&biw=1585&bih=1200&isw=728&ish=90&oid=3&adk=1735222793&ifi=1&ifk=2642803827&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&dssz=7&icsg=10&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=2044148142.1528483968&ga_sid=1528483968&ga_hid=1628097831
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js?v=214
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
24193a656f2746825c9beb84c9092ada1ba9338560460694f9a6626d0b6c8125
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
9186
x-xss-protection
1; mode=block
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, must-revalidate
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_213.js
securepubads.g.doubleclick.net/gpt/ Frame 5487
44 KB
17 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_213.js?cb=214
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js?v=214
Protocol
SPDY
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
sffe /
Resource Hash
a31c69281c7bb7e5ea7389d78c7399b747d9cc0c9e2aca9dba81c1e092c47e2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 04 Jun 2018 18:27:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
16996
x-xss-protection
1; mode=block
expires
Fri, 08 Jun 2018 18:52:47 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-28/html/ Frame 5487
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js?v=214
Protocol
SPDY
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

expires
Wed, 05 Jun 2019 17:55:32 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Tue, 22 May 2018 18:40:55 GMT
content-type
text/html
nlsSDK600.bundle.min.js
cdn-gl.imrworldwide.com/novms/js/2/
147 KB
43 KB
Script
General
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/config250.js
Protocol
HTTP/1.1
Server
54.230.44.128 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-128.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1f64b21a4ff87a1287d3a6c9d647b2f12a2b565442d510c3df06477bc90582ce

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:41:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jun 2018 21:19:05 GMT
Server
AmazonS3
Age
662
x-amz-server-side-encryption
AES256
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
onIpuktD05.rpdSyoRe1H4lBmEgMPgPn
Via
1.1 5d53a1d9ef3a6f7480785993c37a7ad5.cloudfront.net (CloudFront)
Cache-Control
max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript
X-Amz-Cf-Id
Htq3o0qNLcoDogL97y_EQG7kwTCzd4xxDFLJMM6WnDDlBrIh0WmQ6w==
mon
pixel.adsafeprotected.com/
43 B
304 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=7529&campId=728x90&pubId=25349972&chanId=175702292&placementId=44049572&pubCreative=53780021972&pubOrder=129076172&cb=903959442&adsafe_par&impId=2282a076-6b4d-11e8-a18e-00259088293c&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&adsafe_type=abdfq&adsafe_jsinfo=,id:fc402189-f8d4-4a17-105b-2e2f6a64539b,c:eYsehJ,sl:inView,em:true,fr:true,mn:app38ami,pt:1-5-15,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,br:u,fv:0,abv:na,an:n,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d1|1e1,idMap:1c*,pl:,es:0,sc:0,ha:1,gm:1,tt:jload,et:151,oid:22e35e1f-6b4d-11e8-a2a0-70106fb72758,v:17.4.109,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
X-Server-Name
app30ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
mon
pixel.adsafeprotected.com/
43 B
304 B
Image
General
Full URL
https://pixel.adsafeprotected.com/mon?anId=7529&campId=300x250&pubId=25349972&chanId=175702292&placementId=44046452&pubCreative=138234240615&pubOrder=129076172&cb=1547039622&adsafe_par&impId=2282a077-6b4d-11e8-a18e-00259088293c&adsafe_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&adsafe_type=abdfq&adsafe_jsinfo=,id:a4be2b0c-1322-ee36-ebc0-363015b99c63,c:eYsehW,sl:inView,em:true,fr:true,mn:app09ami,pt:1-5-15,wc:0.0.1600.1200,ac:1072.343.300.250,am:i,cc:1072.343.300.250,piv:100,obst:0,th:0,reas:,br:u,fv:0,abv:na,an:n,fm:qUpkXzZ+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c1|1d*.7529|1d1|1e1,idMap:1d*,pl:,es:0,sc:0,ha:1,gm:1,tt:jload,et:157,oid:22e8b58e-6b4d-11e8-a9c8-0025908827e8,v:17.4.109,sp:1,wr:1600.1200,sr:1600.1200,ov:0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.55 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
X-Server-Name
app04ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYsei0,pingTime:0,time:168,type:pf,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:168,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[34~100],as:[34~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d1|1e1,idMap:1c*}&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:47 GMT
X-Server-Name
dt03ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame 63AF
0
0
Document
General
Full URL
https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.44.128 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-44-128.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Host
cdn-gl.imrworldwide.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Accept-Encoding
gzip, deflate
Cookie
IMRID=683fbeb5-9f79-4140-837b-45a8f0769bca
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Date
Fri, 08 Jun 2018 18:41:46 GMT
Last-Modified
Fri, 01 Jun 2018 21:19:03 GMT
x-amz-server-side-encryption
AES256
Cache-Control
max-age=86400
x-amz-version-id
x8TDfWJ74L_fs_Eu54G1yMYjCW8jafAz
Server
AmazonS3
Content-Encoding
gzip
Vary
Accept-Encoding
Age
663
X-Cache
Hit from cloudfront
Via
1.1 5d53a1d9ef3a6f7480785993c37a7ad5.cloudfront.net (CloudFront)
X-Amz-Cf-Id
4JbC02uEHl9NjjKOMB3FCHFDTbWThGcd4jly1yrziKnlSdUTe7xMgQ==
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYseiw,pingTime:0,time:193,type:pf,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:193,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.343.300.250,am:i,cc:1072.343.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[47~100],as:[47~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*}&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt30ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYseiE,pingTime:-2,time:208,type:a,im:{prf:{beA:155,beZ:157,mfA:286,cmA:286,inA:287,inZ:292,prA:293,prZ:300,si:307,poA:307,poZ:308,cmZ:308,mfZ:308,loA:325,loZ:327,ltA:363,ltZ:363,mdA:157,mdZ:258}},sca:{dfp:{df:0}},env:{sf:0,pom:1},clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:208,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[73~100],as:[73~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*,slid:[google_ads_iframe_/4585/ns.bleepingcomputer/homepage_0,google_ads_iframe_/4585/ns.bleepingcomputer/homepage_0__container__,nsgpt-billboard-1],sinceFw:55,readyFired:true}&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt56ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYseiI,pingTime:-2,time:205,type:a,im:{prf:{beA:119,beZ:120,mfA:266,cmA:266,inA:266,inZ:268,prA:268,prZ:273,si:276,poA:276,poZ:276,cmZ:276,mfZ:276,loA:316,loZ:317,ltA:323,ltZ:323,mdA:120,mdZ:215}},sca:{dfp:{df:0}},env:{sf:0,pom:1},clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:205,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.343.300.250,am:i,cc:1072.343.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[58~100],as:[58~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*,slid:[google_ads_iframe_/4585/ns.bleepingcomputer/homepage_1,google_ads_iframe_/4585/ns.bleepingcomputer/homepage_1__container__,nsgpt-portrait-1],sinceFw:47,readyFired:true}&br=u
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt49ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
52.b09970149127b2df7259.js
s7.addthis.com/static/
281 B
471 B
Script
General
Full URL
https://s7.addthis.com/static/52.b09970149127b2df7259.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
2.18.232.128 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-128.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7b579e18db9d7183b30ddb01f3b5f4eb07c7c390aefed3300f7bb842b7a55fa1

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:48 GMT
last-modified
Tue, 29 May 2018 19:30:10 GMT
server
nginx
etag
"5b0daa42-119"
content-type
application/javascript
status
200
cache-control
public, max-age=86313600
x-host
s7.addthis.com
accept-ranges
bytes
timing-allow-origin
*
content-length
281
/
graph.facebook.com/
657 B
839 B
Script
General
Full URL
https://graph.facebook.com/?id=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&callback=_ate.cbs.rcb_kla20
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
185.60.216.15 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
874151ba51c88deffd7a4329b48d9df5102546935c9226d62732f478d0527779
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
etag
"79391222dde2e6a5f3f033d120305f8f01dbc6ed"
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
x-fb-rev
3986674
content-length
424
pragma
no-cache
x-fb-debug
QZAtjkMVz0yWOdFqfLSurVcPzWxlevoF1MfIpual/pwyfKQgf+2OCOn4rNbu86peR3g1YnkNX5+ec387rIJYqw==
x-fb-trace-id
HcnQHwVMBTQ
date
Fri, 08 Jun 2018 18:52:48 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.6
expires
Sat, 01 Jan 2000 00:00:00 GMT
share
www.linkedin.com/countserv/count/
201 B
1 KB
Script
General
Full URL
https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&callback=atajsshctcbQKmwq
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
91.225.248.129 , Ireland, ASN197612 (LINKEDIN-1, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
17126d02292c48831888a0a9879358d9d348e6cc09cf30e55bfad03cf4a883ca
Security Headers
Name Value
Content-Security-Policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding
x-li-uuid
hyy4LhJENhXAZCNYJCsAAA==
server
Apache-Coyote/1.1
pragma
no-cache
x-li-pop
PROD-IDB2
x-frame-options
sameorigin
strict-transport-security
max-age=2592000
content-type
text/javascript;charset=UTF-8
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto
http/2
x-li-fabric
prod-ltx1
expires
Thu, 01 Jan 1970 00:00:00 GMT
info.json
www.reddit.com/api/
4 KB
3 KB
Script
General
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&jsonp=_ate.cbs.rcb_2r5z0
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
SPDY
Server
151.101.13.140 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
snooserv /
Resource Hash
831dc7b2b47a779064f80041e5fec174b256609fe5fdededf2aaac2f8d8130e2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:52:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
access-control-allow-origin
*
x-cache
MISS
status
200
vary
accept-encoding
content-length
1567
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
expires
-1
server
snooserv
x-timer
S1528483968.108650,VS0,VE135
x-frame-options
SAMEORIGIN
x-served-by
cache-fra19136-FRA
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
application/javascript; charset=UTF-8
via
1.1 varnish
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, max-age=0, must-revalidate
accept-ranges
bytes
x-cache-hits
0
truncated
/ Frame 11B8
208 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19e805c87e33d02add0bae5247737f8f1b1504fc9533d974f2c1c5f91c5318b1

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
n.js
geo.moatads.com/ Frame 11B8
78 B
239 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&gz=0&hh=0&hn=0&qt=0&i=ZIFFDAVISCWV2&hp=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&tw=null&j=&o=3&t=1528483968138&de=517871683693&m=0&ar=6dfa4e0-clean&q=2&cb=0&cu=1528483968138&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25349972%3A129076172%3A44046452%3A138234240615&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&bo=175565492&bd=175702292&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&gw=ziffdaviscwnew43828694654&fd=1&ac=1&it=500&fs=145751&na=619118131&cs=0&callback=MoatSuperV26.gna33044
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/ziffdaviscwnew43828694654/moatad.js
Protocol
HTTP/1.1
Server
52.200.111.235 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-200-111-235.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
827166b3c18eca3d8efa7c240bdb3d492b0bf5fe301b74bdee17ec79c22e5242

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
78
Content-Type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=ZIFFDAVISCWV2&hp=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&tw=null&j=&o=3&t=1528483968138&de=517871683693&m=0&ar=6dfa4e0-clean&q=3&cb=0&cu=1528483968138&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25349972%3A129076172%3A44046452%3A138234240615&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&bo=175565492&bd=175702292&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&gw=ziffdaviscwnew43828694654&fd=1&ac=1&it=500&fs=145751&na=388631877&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:48 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-28/html/ Frame D644
0
0
Document
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-28/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_213.js?cb=214
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.21.225 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s13-in-f225.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-28/html/container.html?n=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
C8BEBF0D0D0C8709A1F2EA1231921C10
Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
timing-allow-origin
*
content-length
1479
date
Tue, 05 Jun 2018 17:55:32 GMT
expires
Wed, 05 Jun 2019 17:55:32 GMT
last-modified
Tue, 22 May 2018 18:40:55 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
1; mode=block
cache-control
public, immutable, max-age=31536000
age
262636
alt-svc
quic=":443"; ma=2592000; v="43,42,41,39,35"
osd.js
pagead2.googlesyndication.com/pagead/ Frame 5487
71 KB
26 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_213.js?v=214
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
a390cf62fca4217670690ed84dcb7f8d569348f6ef9ef61b3ea4bc15c4548561
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Fri, 08 Jun 2018 18:01:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3084
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
26505
x-xss-protection
1; mode=block
server
cafe
etag
18183909933677749988
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Fri, 08 Jun 2018 19:01:24 GMT
truncated
/ Frame 5487
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9993aec888f8709dd868f8dad53cf3646577b1b22f17af00caedaa651d1c7dc5

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
n.js
geo.moatads.com/ Frame 5487
78 B
239 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&gz=0&hh=0&hn=0&qt=0&i=ZIFFDAVISCWV2&hp=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&tw=null&j=&o=3&t=1528483968225&de=807800162728&m=0&ar=6dfa4e0-clean&q=6&cb=0&cu=1528483968225&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25349972%3A129076172%3A44049572%3A53780021972&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&bo=175565492&bd=175702292&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&gw=ziffdaviscwnew43828694654&fd=1&ac=1&it=500&fs=145751&na=361254349&cs=0&callback=MoatSuperV26.gna105690
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/ziffdaviscwnew43828694654/moatad.js
Protocol
HTTP/1.1
Server
35.169.143.38 Seattle, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-169-143-38.compute-1.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
31a73b479bd7e697016c9c1b2cf5c0ded36cba048325036d4a9be1a26c497802

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 08 Jun 2018 18:52:48 GMT
Server
nginx/1.7.9
Connection
keep-alive
Content-Length
78
Content-Type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=ZIFFDAVISCWV2&hp=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&tw=null&j=&o=3&t=1528483968225&de=807800162728&m=0&ar=6dfa4e0-clean&q=7&cb=0&cu=1528483968225&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25349972%3A129076172%3A44049572%3A53780021972&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&bo=175565492&bd=175702292&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&gw=ziffdaviscwnew43828694654&fd=1&ac=1&it=500&fs=145751&na=437521579&cs=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:48 GMT
pixel.gif
ziffdavis697674298673.moatads.com/
0
419 B
Image
General
Full URL
https://ziffdavis697674298673.moatads.com/pixel.gif?m=1&iv=0&tuv=-1&tet=63&fi=1&apd=126&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=bleepingcomputer.com&L1id=25349972&L2id=129076172&L3id=44049572&L4id=53780021972&S1id=175565492&S2id=175702292&ord=1528483968225&r=807800162728&t=meas&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.0
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Content-Type
text/html
Expires
Fri, 08 Jun 2018 18:52:48 GMT
pixel.gif
ziffdavis697674298673.moatads.com/
0
419 B
Image
General
Full URL
https://ziffdavis697674298673.moatads.com/pixel.gif?m=1&iv=0&tuv=-1&tet=63&fi=1&apd=126&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=bleepingcomputer.com&L1id=25349972&L2id=129076172&L3id=44049572&L4id=53780021972&S1id=175565492&S2id=175702292&ord=1528483968225&r=807800162728&t=fv&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.0
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Content-Type
text/html
Expires
Fri, 08 Jun 2018 18:52:48 GMT
pixel.gif
ziffdavis697674298673.moatads.com/
0
419 B
Image
General
Full URL
https://ziffdavis697674298673.moatads.com/pixel.gif?m=1&iv=0&tuv=-1&tet=63&fi=1&apd=126&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=bleepingcomputer.com&L1id=25349972&L2id=129076172&L3id=44049572&L4id=53780021972&S1id=175565492&S2id=175702292&ord=1528483968225&r=807800162728&t=nht&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.0
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Content-Type
text/html
Expires
Fri, 08 Jun 2018 18:52:48 GMT
H4jyvsy8EeSUDxIxPSpF6g
zdbb.net/n/
43 B
262 B
Image
General
Full URL
https://zdbb.net/n/H4jyvsy8EeSUDxIxPSpF6g?segment=S160
Protocol
SPDY
Server
54.72.182.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-182-106.eu-west-1.compute.amazonaws.com
Software
Ziff Davis BuyerBase /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:48 GMT
server
Ziff Davis BuyerBase
status
200
p3p
CP="ALL DSP COR NID"
access-control-allow-origin
*
cache-control
No-Cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
expires
0
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&kq=1&lo=1&qs=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsafeframe%2F1-0-28%2Fhtml%2Fcontainer.html%3Fn%3D1&i=ZIFFDAVISCWV2&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&gz=0&hh=0&hn=0&qt=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&f=0&j=&o=3&t=1528483968225&de=807800162728&cu=1528483968225&m=571&ar=6dfa4e0-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&tw=null&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&lb=4610&le=1&lf=407&lg=1&lh=11&gm=1&io=1&ct=undefined&as=0&ag=63&an=0&gf=63&gg=0&ix=63&ic=63&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=63&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&bu=126&cd=0&ah=126&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25349972%3A129076172%3A44049572%3A53780021972&bo=175565492&bd=175702292&gw=ziffdaviscwnew43828694654&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=0%3A1%3A1600%3A1200%3A0&fs=145751&na=151589162&cs=0
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:48 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 1D99
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv_B7bUaxtc9wP8KUDilpqoGLLBVoQ6r2HEiiTlOucf9392J31haVE4l0wUTvWZ3AALUgofhsAHNlmhIi6xV2HWmsEPRU1xP4Y&sig=Cg0ArKJSzB71ZQ0aBOTvEAE&id=osdim&ti=1&adk=1381562078&tt=1855&bs=1585,1200&mtos=1025,1025,1025,1025,1025&tos=1025,0,0,0,0&p=19,0,20,1&iehp=1&mcvt=1025&rs=3&ht=0&tfs=827&tls=1852&mc=1&lte=1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,4610&ss=1600,1200&pt=1851&deb=1-7-7-26-14--1-113-6&tvt=1844&op=1&r=v&uc=40&tgt=BODY&cl=1&cec=5&clc=0&cac=0&cd=1x0&v=r20180606
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:48 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
ziffdavis697674298673.moatads.com/
0
419 B
Image
General
Full URL
https://ziffdavis697674298673.moatads.com/pixel.gif?m=1&iv=0&tuv=-1&tet=137&fi=1&apd=200&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=bleepingcomputer.com&L1id=25349972&L2id=129076172&L3id=44049572&L4id=53780021972&S1id=175565492&S2id=175702292&ord=1528483968225&r=807800162728&t=hdn&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.0
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Content-Type
text/html
Expires
Fri, 08 Jun 2018 18:52:48 GMT
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYseya,pingTime:1,time:1170,type:p,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1170,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[1036~100],as:[1036~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:54,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt36ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYseyd,pingTime:1,time:1173,type:pf,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1173,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[1038~100],as:[1038~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:54,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt50ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYseyd,pingTime:1,time:1173,type:c,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1173,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[1038~100],as:[1038~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:54,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*,metricId:publ1}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYseyg,pingTime:1,time:1176,type:c,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1176,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[1041~100],as:[1041~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:54,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*,metricId:grpm1}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:48 GMT
X-Server-Name
dt41ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYseyH,pingTime:1,time:1196,type:p,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1196,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.348.300.250,am:i,cc:1072.348.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1049~100],as:[1049~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:48,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
X-Server-Name
dt42ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYseyI,pingTime:1,time:1197,type:pf,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1197,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.348.300.250,am:i,cc:1072.348.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1050~100],as:[1050~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:48,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
X-Server-Name
dt49ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYseyI,pingTime:1,time:1197,type:c,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1197,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.348.300.250,am:i,cc:1072.348.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1050~100],as:[1050~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:48,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*,metricId:publ1}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
X-Server-Name
dt56ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYseyJ,pingTime:1,time:1198,type:c,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:1198,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.348.300.250,am:i,cc:1072.348.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1051~100],as:[1051~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:48,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*,metricId:grpm1}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
X-Server-Name
dt40ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame 11B8
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss1WZbAQJw705TZtllsk7S9hkSQ2daUzp1qg_7OsRMIoD4oxT6yZSd6rYMOoFP_H4fZAIu6JeQtqLBk2dthN50tIhZhBPckqoM&sig=Cg0ArKJSzNcZpj6ko2GxEAE&id=osdim&ti=1&adk=962065453&tt=829&bs=1585,1200&mtos=1060,1060,1060,1060,1060&tos=1060,0,0,0,0&p=348,1072,598,1372&iehp=1&ujs=1&mcvt=1060&rs=3&ht=0&tfs=1618&tls=2678&mc=1&lte=1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,4610&ss=1600,1200&pt=1851&deb=1-7-7-39-22-6-329-14&tvt=2669&op=1&r=v&uc=10&tgt=BODY&cl=1&cec=13&clc=0&cac=0&cd=300x0&v=r20180606
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 5487
42 B
110 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssyqpkZSDOqS9Tb43X6cSjWo7m_7cNNliXkIy6RGsH7zQaq606lT0WQLuE-wsccguavVBgJjID2DzV7NEGIo-8XiE5PZoeeTKs&sig=Cg0ArKJSzDxS_ZdXfxYlEAE&id=osdim&ti=1&adk=2093159140&tt=932&bs=1585,1200&mtos=1092,1092,1092,1092,1092&tos=1092,0,0,0,0&p=147,429,237,1157&iehp=1&ujs=1&mcvt=1092&rs=3&ht=0&tfs=1690&tls=2782&mc=1&lte=1&bas=0&bac=0&avms=geo&bos=1600,1200&ps=1585,4610&ss=1600,1200&pt=1851&deb=1-7-7-40-23-6-356-15&tvt=2772&op=1&r=v&uc=10&tgt=DIV&cl=1&cec=14&clc=1&cac=0&cd=728x90&v=r20180606
Protocol
SPDY
Server
172.217.21.194 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s12-in-f194.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:49 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="43,42,41,39,35",quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&kq=1&lo=1&qs=1&ak=-&i=ZIFFDAVISCWV2&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&vf=1&vg=100&gz=0&hh=0&hn=0&qt=0&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&f=0&j=&o=3&t=1528483968225&de=807800162728&cu=1528483968225&m=1610&ar=6dfa4e0-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&tw=null&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&lb=4610&le=1&lf=407&lg=1&lh=11&gm=1&io=1&ct=undefined&as=1&ag=1143&an=63&gi=1&gf=1143&gg=63&ix=1143&ic=1143&ez=1&ck=1143&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1143&bx=63&ci=1143&jz=1005&dj=1&aa=1&ad=1043&cn=0&gn=1&gk=1043&gl=0&ik=1043&co=1043&cp=1005&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=1005&cd=126&ah=1005&am=126&rf=0&re=0&wb=1&cl=0&at=0&d=25349972%3A129076172%3A44049572%3A53780021972&bo=175565492&bd=175702292&gw=ziffdaviscwnew43828694654&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=0%3A1%3A1600%3A1200%3A0&fs=145751&na=884748577&cs=0
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:49 GMT
pixel.gif
ziffdavis697674298673.moatads.com/
0
419 B
Image
General
Full URL
https://ziffdavis697674298673.moatads.com/pixel.gif?m=1&iv=1&tuv=1005&tet=1143&fi=1&apd=1206&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=bleepingcomputer.com&L1id=25349972&L2id=129076172&L3id=44049572&L4id=53780021972&S1id=175565492&S2id=175702292&ord=1528483968225&r=807800162728&t=iv&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.0
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Content-Type
text/html
Expires
Fri, 08 Jun 2018 18:52:49 GMT
JZN0Nsy8EeSUDxIxPSpF6g
zdbb.net/n/
43 B
262 B
Image
General
Full URL
https://zdbb.net/n/JZN0Nsy8EeSUDxIxPSpF6g?camp=129076172&li=44049572&creative=53780021972&slot=atf&ggcorr=2477879929723
Protocol
SPDY
Server
54.72.182.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-182-106.eu-west-1.compute.amazonaws.com
Software
Ziff Davis BuyerBase /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 08 Jun 2018 18:52:49 GMT
server
Ziff Davis BuyerBase
status
200
p3p
CP="ALL DSP COR NID"
access-control-allow-origin
*
cache-control
No-Cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
expires
0
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&kq=1&lo=1&qs=1&ak=-&i=ZIFFDAVISCWV2&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&vf=1&vg=100&gz=0&hh=0&hn=0&qt=0&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&f=0&j=&o=3&t=1528483968225&de=807800162728&cu=1528483968225&m=1610&ar=6dfa4e0-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&tw=null&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&lb=4610&le=1&lf=407&lg=1&lh=11&gm=1&io=1&ct=undefined&as=1&ag=1143&an=1143&gi=1&gf=1143&gg=1143&ix=1143&ic=1143&ez=1&ck=1143&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1143&bx=1143&ci=1143&jz=1005&dj=1&aa=1&ad=1043&cn=1043&gn=1&gk=1043&gl=1043&ik=1043&co=1043&cp=1005&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=1005&cd=1005&ah=1005&am=1005&rf=0&re=0&wb=1&cl=0&at=0&d=25349972%3A129076172%3A44049572%3A53780021972&bo=175565492&bd=175702292&gw=ziffdaviscwnew43828694654&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=0%3A1%3A1600%3A1200%3A0&fs=145751&na=135332927&cs=0
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:49 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&kq=1&lo=1&qs=1&ak=-&i=ZIFFDAVISCWV2&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&vf=1&vg=100&gz=0&hh=0&hn=0&qt=0&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&f=0&j=&o=3&t=1528483968225&de=807800162728&cu=1528483968225&m=1611&ar=6dfa4e0-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&tw=null&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&lb=4610&le=1&lf=407&lg=1&lh=11&gm=1&io=1&ct=undefined&as=1&ag=1143&an=1143&gi=1&gf=1143&gg=1143&ix=1143&ic=1143&ez=1&ck=1143&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1143&bx=1143&ci=1143&jz=1005&dj=1&aa=1&ad=1043&cn=1043&gn=1&gk=1043&gl=1043&ik=1043&co=1043&cp=1005&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=1005&cd=1005&ah=1005&am=1005&rf=0&re=0&wb=1&cl=0&at=0&d=25349972%3A129076172%3A44049572%3A53780021972&bo=175565492&bd=175702292&gw=ziffdaviscwnew43828694654&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=0%3A1%3A1600%3A1200%3A0&fs=145751&na=1118953053&cs=0
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:49 GMT
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&kq=1&lo=1&qs=1&ak=-&i=ZIFFDAVISCWV2&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&vf=1&vg=100&gz=0&hh=0&hn=0&qt=0&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&f=0&j=&o=3&t=1528483968225&de=807800162728&cu=1528483968225&m=1613&ar=6dfa4e0-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&tw=null&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&lb=4610&le=1&lf=407&lg=1&lh=11&gm=1&io=1&ct=undefined&as=1&ag=1143&an=1143&gi=1&gf=1143&gg=1143&ix=1143&ic=1143&ez=1&ck=1143&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1143&bx=1143&ci=1143&jz=1005&dj=1&aa=1&ad=1043&cn=1043&gn=1&gk=1043&gl=1043&ik=1043&co=1043&cp=1005&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=1206&cd=1005&ah=1206&am=1005&rf=0&re=0&wb=1&cl=0&at=0&d=25349972%3A129076172%3A44049572%3A53780021972&bo=175565492&bd=175702292&gw=ziffdaviscwnew43828694654&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=0%3A1%3A1600%3A1200%3A0&fs=145751&na=1028994384&cs=0
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:49 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:49 GMT
gn
secure-us.imrworldwide.com/cgi-bin/
44 B
402 B
Image
General
Full URL
https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=au-408075&ch=au-408075_b99_0&sessionId=DVwbCTDN91j1LY32hcoY4Ezg79YDh1528483967&asn=0&prv=1&c6=vc,b99&ca=NA&c13=asid,NA&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,v60Bsdk&sup=0&segment2=&segment1=&forward=1&ad=0&cr=V&c9=devid,&enc=true&c1=nuid,999&at=view&rt=text&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,1528483967939441&c30=bldv,6.0.0.158-3&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&devtypid=&pc=NA&si=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&c73=phtype,&c74=dvcnm,&df=&c62=sendTime,1528483970&rnd=232423
Protocol
HTTP/1.1
Server
138.108.96.100 Schaumburg, United States, ASN16477 (ACNIELSEN-AS - ACNIELSEN, US),
Reverse DNS
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:50 GMT
Server
nginx
P3P
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=5
Content-Length
44
Expires
Thu, 01 Dec 1994 16:00:00 GMT
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYsfAG,pingTime:5,time:5170,type:p,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:5170,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[5035~100],as:[5035~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:85,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:52 GMT
X-Server-Name
dt63ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=fc402189-f8d4-4a17-105b-2e2f6a64539b&tv={c:eYsfAH,pingTime:5,time:5171,type:pf,clog:[{piv:100,vs:i,r:,w:728,h:90,t:150}],es:0,sc:0,ha:1,gm:1,slTimes:{i:5171,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:150,wc:0.0.1600.1200,ac:429.147.728.90,am:i,cc:429.147.728.90,piv:100,obst:0,th:0,reas:,bkn:{piv:[5036~100],as:[5036~728.90]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:85,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c*.7529|1c1|1d.7529|1d1|1e1,idMap:1c*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:52 GMT
X-Server-Name
dt50ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYsfBc,pingTime:5,time:5195,type:p,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:5195,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.348.300.250,am:i,cc:1072.348.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[5049~100],as:[5049~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:105,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:52 GMT
X-Server-Name
dt17ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/
43 B
303 B
Image
General
Full URL
https://dt.adsafeprotected.com/dt?anId=7529&asId=a4be2b0c-1322-ee36-ebc0-363015b99c63&tv={c:eYsfBd,pingTime:5,time:5196,type:pf,clog:[{piv:100,vs:i,r:,w:300,h:250,t:157}],es:0,sc:0,ha:1,gm:1,slTimes:{i:5196,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:156,wc:0.0.1600.1200,ac:1072.348.300.250,am:i,cc:1072.348.300.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[5049~100],as:[5049~300.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:105,fm:qUpkXzS+111|1121|1122|121|131|14|15|16|17|18|19|1a|1b|1c.7529|1c1|1d*.7529|1d1|1e1,idMap:1d*}&br=u
Protocol
HTTP/1.1
Server
69.172.216.111 New York, United States, ASN7415 (ADSAFE-1 - Integral Ad Science, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:53 GMT
X-Server-Name
dt61ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
close
Content-Type
image/gif
Content-Length
43
Server
nginx
pixel.gif
px.moatads.com/
43 B
409 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&kq=1&lo=1&qs=1&ak=-&i=ZIFFDAVISCWV2&ud=false&ue=false&uu=false&qm=0&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D%5B%3B1RX%25lQMV9%22W6~P6Jn)s)%3Ee3wW0uC%2BA5%3Deu!LfBB2%2B%7BLT7%25%40qwMoI3%2B%3BggqhB3U4(%5B*rUo81C%24k%25zrI81V5.NO)Wx%7C*G%24%3D!L2tEKm3MAJ1%5D6WAJN3NZ_h)G%3E3%5D*lTr1W*d%5B4kf%2FLyUoRdByZ%3ClF&qp=00000&qq=000000000000&qr=0&is=voqBBkBBBBHhBBBBBZkJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoKOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvBCfBBBBBBBBBBBBBBCBMBaBeBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGxCBcBBBC9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCS6IDDDCCCCDDCCCCCCCBdh2eBBBGI79kNB8DJoDBBBBCiBBiB&iv=6&vf=1&vg=100&gz=0&hh=0&hn=0&qt=0&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&f=0&j=&o=3&t=1528483968225&de=807800162728&cu=1528483968225&m=5636&ar=6dfa4e0-clean&cb=0&ll=2&lm=0&ln=1&r=0&dl=0&dm=1000&dn=0&gh=1&tw=null&td=1&qa=1600&qb=1200&qi=1600&qj=1200&qf=1600&qe=1200&qh=1600&qg=1200&lk=undefined&lb=4610&le=1&lf=407&lg=1&lh=11&gm=1&io=1&ct=undefined&as=1&ag=5169&an=1143&gi=1&gf=5169&gg=1143&ix=5169&ic=5169&ez=1&ck=1143&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5169&bx=1143&ci=1143&jz=1005&dj=1&aa=1&ad=5069&cn=1043&gn=1&gk=5069&gl=1043&ik=5069&co=1043&cp=1005&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=5028&cd=1206&ah=5028&am=1206&rf=0&re=0&wb=2&cl=0&at=0&d=25349972%3A129076172%3A44049572%3A53780021972&bo=175565492&bd=175702292&gw=ziffdaviscwnew43828694654&zMoatOrigSlicer1=175565492&zMoatOrigSlicer2=175702292&dfp=0%2C1&la=175702292&zMoatImpCorrelator=535ef46f-a152-4adb-a831-9d001dd7cc2f&zMoatPVCorrelator=a04af12ae21965ff455e6&zMoatMMV=-&zMoatMMV_MAX=na&zMoatMGV=-&zMoatMData=-&zMoatMSafety=-&zMoatDivID=-&zMoatPS=atf&zMoatMD=-&zMoatMS=-&zMoatCURL=bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users&zMoatDev=Desktop&ab=2&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=0%3A1%3A1600%3A1200%3A0&fs=145751&na=920783112&cs=0
Protocol
HTTP/1.1
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.bleepingcomputer.com/news/security/eight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 08 Jun 2018 18:52:53 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Fri, 08 Jun 2018 18:52:53 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
googleads.g.doubleclick.net
URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3249370012249755&output=html&h=90&slotname=1089300124&adk=4118485907&adf=452058354&w=728&lmt=1502846673&guci=1.2.0.0.2.2.0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Feight-chrome-extensions-hijacked-to-deliver-malicious-code-to-4-8-million-users%2F&flash=0&wgl=1&adsid=NT&dt=1528483966643&bpp=9&bdt=396&fdt=256&idt=257&shv=r20180606&cbv=r20180604&saldr=sa&abxe=1&prev_slotnames=5975899204&correlator=2477879929723&frm=20&pv=1&ga_vid=246142973.1528483967&ga_sid=1528483967&ga_hid=1223192875&ga_fc=0&iag=0&icsg=175924546938880&dssz=47&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=3961&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21061122%2C368226400&oid=3&rx=0&eae=0&fc=528&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=7&ifi=2&xpc=Cx55Pmzrqd&p=https%3A//www.bleepingcomputer.com&dtd=267

Verdicts & Comments Add Verdict or Comment

280 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dataLayer function| $ function| jQuery object| googletag object| apd_options object| google_ad_client object| google_ad_slot object| google_ad_width object| google_ad_height object| google_js_reporting_queue object| google_ad_modifications boolean| google_measure_js_timing boolean| google_onload_fired object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| google_ad_block object| google_ad_channel object| google_ad_format object| google_ad_host object| google_ad_host_channel object| google_ad_host_tier_id object| google_ad_layout object| google_ad_layout_key object| google_ad_output object| google_ad_region object| google_ad_section object| google_ad_type object| google_ad_unit_key object| google_ad_dom_fingerprint object| google_adtest object| fwifhbc object| google_allow_expandable_ads object| google_alternate_ad_url object| google_alternate_color object| google_ama object| google_analytics_url_parameters object| google_available_width object| google_captcha_token object| google_city object| google_color_bg object| google_color_border object| google_color_line object| google_color_link object| google_color_text object| google_color_url object| google_container_id object| google_content_recommendation_ad_positions object| google_content_recommendation_columns_num object| google_content_recommendation_rows_num object| google_content_recommendation_ui_type object| google_contents object| google_core_dbp object| google_country object| google_cpm object| google_ctr_threshold object| google_cust_age object| google_cust_ch object| google_cust_criteria object| google_cust_gender object| google_cust_id object| google_cust_interests object| google_cust_job object| google_cust_l object| google_cust_lh object| google_cust_u_url object| google_disable_video_autoplay object| google_eids object| google_enable_content_recommendations object| google_enable_ose object| google_encoding object| google_font_face object| google_font_size object| google_frame_id object| google_full_width_responsive_allowed object| efwr object| google_full_width_responsive object| gfwroh object| gfwrow object| gfwroml object| gfwromr object| gfwroz object| gfwrnh object| gfwrnwer object| gfwrnher object| google_gl object| google_hints object| google_image_size object| google_kw object| google_kw_type object| google_lact object| google_language object| google_loeid object| google_max_num_ads object| google_max_radlink_len object| google_max_responsive_height object| google_mtl object| google_native_ad_template object| google_native_settings_key object| google_num_radlinks object| google_num_radlinks_per_unit object| google_only_pyv_ads object| google_override_format object| google_page_url object| google_pgb_reactive object| google_pucrd object| google_referrer_url object| google_region object| google_resizing_allowed object| google_resizing_height object| google_resizing_width object| google_responsive_formats object| google_responsive_auto_format object| google_rl_dest_url object| google_rl_filtering object| google_rl_mode object| google_rt object| google_safe object| google_safe_for_responsive_override object| google_scs object| google_source_type object| google_sui object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_tag_origin object| google_tag_partner object| google_targeting object| google_tfs object| google_video_doc_id object| google_video_product_type object| google_video_url_to_fetch object| google_webgl_support object| google_yt_pt object| google_yt_up object| google_sv_map object| google_t12n_vars object| google_jobrunner object| google_iframe_oncopy object| adsbygoogle object| google_tag_manager function| google_spfd string| GoogleAnalyticsObject function| ga object| __TVPage__ object| jQuery111107515464451966911 object| $jscomp object| __ZDABCB object| __stitialW function| __NSGPTB object| pbjs function| __NSGPTDummyCMP object| NSGPT string| __ZDGC object| stitial function| pbjsChunk object| __core-js_shared__ object| _comscore boolean| __NSGPTBp object| __iasPET object| gaplugins object| gaGlobal object| gaData object| google_persistent_state_async object| google_reactive_ads_global_state object| google_pub_config object| __google_ad_urls number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_AdSense_getAdAdapterInstance boolean| google_osd_loaded function| udm_ object| ns_p object| COMSCORE object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut object| zd function| NolTracker function| nol_t function| logger undefined| _rsCC undefined| _rsCG undefined| _rsDN undefined| v52v53_pvar undefined| v52v53_trac undefined| _rsEvent undefined| _rsLinkTrack undefined| _rsClick object| fixto function| validate_comment_box_not_empty function| cz_strip_tags function| cz_br2nl function| editForm string| loginhash boolean| main_nav_hide_flag number| scrollTop string| main_nav_hide_timer function| call_main_nav_hide number| cz_header_pos number| prevScrollTop boolean| __ZDAB string| zd_domain_match object| zd_walker_skip_nodes object| zd_domain_regex string| zd_bbdomain function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| loadDeferredStyles function| raf function| __cmp function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| addthis_share object| addthis_config object| elem object| scpt object| GPT_jstiming object| closure_memoize_cache_ boolean| google_noFetch boolean| google_DisableInitialLoad function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID function| Goog_AdSense_OsdAdapter object| __ZD_SEG_ string| __ZD_CPID_ object| oattr object| _atw string| state object| pvar object| V60 object| NOLBUNDLE object| ciDdrs object| l_pattern string| key string| emmUrlKey string| optoutCookieKey object| ns object| paramsPassed object| stateObject string| BUILDVERSION object| stateEvents string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks function| atajsshctcbQKmwq object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 function| google_osd_amcb

6 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: DSID
Value: NO_DATA
.bleepingcomputer.com/ Name: __gads
Value: ID=d1cdaf6fb0b4727f:T=1528483967:S=ALNI_MZbPdoUtgufOj4Ni-QL2TAu_TjpJw
.doubleclick.net/ Name: IDE
Value: AHWqTUk3sDNhmpSIi2Xfkasgg0tXOWSHUVPrnDSXh4dxojARiw1gTVaESVGrNsUM
www.bleepingcomputer.com/ Name: __atuvs
Value: 5b1ad07ff65dcc6d000
.imrworldwide.com/ Name: IMRID
Value: 683fbeb5-9f79-4140-837b-45a8f0769bca
www.bleepingcomputer.com/ Name: __atuvc
Value: 1%7C23

1 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.static.zdbb.net/js/zd-core-olt.min.js?v=5(Line 1)
Message:
ZD Core :: Outbound Link Tracking Initialized

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
api.tvpage.com
as-sec.casalemedia.com
cdn-gl.imrworldwide.com
cdn.adsafeprotected.com
cdn.nsstatic.com
cdn.nsstatic.net
cdn.static.zdbb.net
cse.google.com
dt.adsafeprotected.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g.pcmag.com
geo.moatads.com
get.s-onetag.com
googleads.g.doubleclick.net
graph.facebook.com
gurgle.zdbb.net
hbopenbid.pubmatic.com
i.ytimg.com
ib.adnxs.com
m.addthisedge.com
native.sharethrough.com
ns.zdbb.net
pagead2.googlesyndication.com
pixel.adsafeprotected.com
px.moatads.com
quantcast.mgr.consensu.org
s7.addthis.com
s9.addthis.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
securepubads.g.doubleclick.net
stags.bluekai.com
static.adsafeprotected.com
static.adziff.com
static.ziffdavis.com
stats.g.doubleclick.net
tags.bkrtx.com
tpc.googlesyndication.com
videos-bleepingcomputers-com.tvpagecdn.com
walker.zdbb.net
www.bleepingcomputer.com
www.bleepstatic.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.reddit.com
z.moatads.com
zdbb.net
ziffdavis697674298673.moatads.com
googleads.g.doubleclick.net
104.108.51.30
104.20.60.209
104.24.0.61
104.24.1.61
138.108.96.100
151.101.13.140
172.217.21.194
172.217.21.214
172.217.21.225
172.217.21.238
172.217.22.98
185.33.223.83
185.60.216.15
185.64.189.112
2.18.232.128
2.18.234.21
2.18.235.40
2.19.32.164
2.19.43.224
216.58.207.34
216.58.207.66
216.58.207.67
216.58.207.68
216.58.207.72
216.58.207.74
216.58.207.78
23.67.132.148
23.67.139.108
35.169.143.38
52.200.111.235
52.89.201.181
54.230.44.100
54.230.44.128
54.230.44.147
54.230.44.243
54.230.44.63
54.230.47.244
54.72.182.106
54.93.39.116
62.67.193.41
66.102.1.157
69.172.216.111
69.172.216.55
69.172.216.58
91.225.248.129
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05009f280062d69bd4136f4c7181ca59cabac05983a621960a64c7b52ab05e1e
05b9d55fa713061f2a66b576aa499141aa505fd76989cda669e86197c39dbb18
0804129dfb42df37903e68fcddbc2ce4a377460d1ce3686a881b1c25f0cb2953
0abf173e5f4d43ac48270635ee838e8cbf98aaaa8bf14ff1fd2f6b785c8c9c22
0e72b1eb40bc5b4b9fd74544d13be8234c9f52c89f6bb6d472f6190935afe22f
10a2075bd80aa6e145816c982e326353fad91dff2c07ec83665261a477aa7701
128f32bd40bd478cffb974e34ac29e53e1515381427a4124482b91721a68c65a
1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2
13451dcbf777017c91b11755237fe091c7be397db95bb659dd92bc82e0263d23
13c9e692ecdcdc0f1203c1fe459e4da7b7fd66a89c4cad51c3ce12705e204762
150b898680e649f163d8bcca0ff5deae40909421fb01d0d867e38ec3f4603f7e
15318cd7cfd934ad4be8a9d2b57ab84bee103a3efffb30ea9f70b7f4acbcf825
158b054dcd5736747ef430b45ffc144d3fcb0350d67eb50be7717df827906d14
16385b778e893fea4ce7daa7b01645297e44ad6622136cfa7a6525ac3cb060bc
17126d02292c48831888a0a9879358d9d348e6cc09cf30e55bfad03cf4a883ca
1878c3e6e47ab99b415a0af0dd75b714c1025ad355aaa886c0dde34a19847e90
18e919441487a7727b10f240e8f2f181fc5c0b8b2bc4119b5cdef0b003eec4b9
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019
19e805c87e33d02add0bae5247737f8f1b1504fc9533d974f2c1c5f91c5318b1
1de6869366acfb4fda2da2dd9ef085d2a5c375657344d4395726fbe2524f4bfb
1edf0d5a8022d32e025aa68393986b16b3354087e322dd2142d1032b9deb6ed3
1f64b21a4ff87a1287d3a6c9d647b2f12a2b565442d510c3df06477bc90582ce
24193a656f2746825c9beb84c9092ada1ba9338560460694f9a6626d0b6c8125
29d2faa2144367069d8cacce9600470a99f6ce3d2d0ce5641c38044adc77cbc8
30168c118c3243cb81b671312f3f0e99c1ff82cb0ac1d31d484ce46aab9c0c6e
303c24f6aa76ab22792ace7cbe3b244078b141959064fcb6f0fc5d9353002e4b
31a73b479bd7e697016c9c1b2cf5c0ded36cba048325036d4a9be1a26c497802
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590
370a4c08fcc68e1a97e3004e338748d7cc253bd1540a192172f95d565265f5a7
3d11d8938e6e3f5415928e012bc31d32753ee9792c5fe8df57f42f4f2b41fdec
3ee85c770966bfd58a0c807851e2c14d2c63abadcfb45ce30fbfbe871152caf2
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
40a5f4ef0d4f9d3afd9255d53bf582bfff4913065c81b3f1dd77c30c6a49d096
444e7a52ef48556debcc9c567fd0d01eaf9cc0cb02871510e100b97f159b0f36
456ab1a71507ed91abae14c9d08faffb373a7bc711a66e44341b7b8b7bb72ab4
45e3123bef5813859fad482b2a191baa3f082dea1326f2461bb9d46b5189deee
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f
496f81a050e3eff47a78755cb2b4bb870d1b944af42bd078baa72cd9ece46fd5
4e523a5ae5b4636c75901b79fafbd3912e41dc7987414e688b09d4b436ff22b3
4eeb4df3522892ea2ec61de6a58e870e8262019f8e3c759c099450cefb589313
51143c591c24c8aea630c8ee7e89d9c1c94421a975e68e9b76af079c06875207
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
558d4a629da14b07cb7beeb983dd5f549f0e0a19f001c3de784083b62bce2f10
5689ee50aaeb228e297fd9276acd41518dce62e3e76b292fdec050436878dfb8
5803a80762d6f911fd8dd5dc1823145f6f43b0ff0ee5b2ce2e8f9ce09b970861
58d199beb6bf57bba7c33c96e11f1ef582d1aedb609817dd7411b23e63286a75
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5f62a0ff5caac611d412976915e7fe1147b183638c0523f0cd8206c18c6fc217
5fbea6940d27958f33a5f388caca8dd12c410a88fb41a49e60780c51f645efd9
5fe405e64b42b49a5813c2c7b8e48ccf290310c5eb351d2b15966856d1a2f06e
6143557b7f5f19ba25f0b8ef707599a5bb13952a4ff867e6652677ff5260ec20
6430c8baccb3354e98553cc6c598c0e919f52d8f628b91ccf1f7210c7e67ca96
6673a9154eba93ea0148857abafac567d0accf3bc686521cc3d8b531aa840c4c
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2
6a387c230af7c053b21d96c296fe7bbcd2f8db68dbdd96e14de77a632c40dfd9
6c16f78c1e9e84c7634504ec4a27f8b4e491b0944226fb1d5b387c7dcb816ffa
6c78ce6b6d1928630b903084ea9d503643f303ba05455860cc7cd17f7687cc65
6d5632d024b7f80bf952f983a9b733e17994232a66a460bea7db5c5a3d5b79c0
6ea534a2144a80caf83d82c77e46c79faa16fef770b61b9cec98e4ab96109827
70e339a1a220298dd1d9c6a69bbb3e3f7e2b4e655c85da9f127cb21a699f99d8
70eb7b474480f19a1eecefd6edbb3c31a93faeb7088f9c3c86dc7746422554b4
71e4ed905483936fd3bf5c82f41988757ea8e812107c0c79ab496b9a7e75718d
73ebddcca4303df4a3f6554729d41ad13e0f1ffd0e24a9183e3b3780f9f56dc8
7541b23deca1701b4e266505ccdbe1fa43f781140ae3d35354a5ff8b4c66579b
75f4d66faf9ecb5ee9162622e8463ad53da62fbf7776a196f331a9b8f5bcfce5
766f9a424b57841fd8f8a7ec5c2bf1718818a2c52008b7d05b23ab7bdcb9c276
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
7b579e18db9d7183b30ddb01f3b5f4eb07c7c390aefed3300f7bb842b7a55fa1
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39
827166b3c18eca3d8efa7c240bdb3d492b0bf5fe301b74bdee17ec79c22e5242
82c7fdbc4d001907e1e5d56cd335af3f0d48e0ffa7f0ad2aa3486ebb1123cb21
831dc7b2b47a779064f80041e5fec174b256609fe5fdededf2aaac2f8d8130e2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b
85b16dbd42f870936751ab1dde82084ae53012da263cdd7ac618bebc40ebc41d
874151ba51c88deffd7a4329b48d9df5102546935c9226d62732f478d0527779
886666fb6f1d41f3ff1aa78dc1b4c6c87f3110cab6e6f47052c2d0ce2a7e3a3e
8b9ff14a2ba603e1a32fddd3da2ffd8b50e201a9874ea3fafb50d537117153eb
8e5884d1be3041eafbab27d898b8e401e0263c5bebaba17c97d82240064a362c
8e9b4191148339344ecfe7f1d6eb12dc65b784acb69cecdc0a0200aa52b633ef
8ef6f1bf3735aec0829e69209b989f049b0f2b2f428c312bfc4aadb86711bb14
8fe610f9d8cd1dc1d95881f10497cd420be1df13a95e2567c42a7fc30af04215
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339
951ddf22d995a038ead9f2e91ab18ab2829e8a382eda519342b0b998f36cf1af
968a8e56e4adaf8c135199ebd7f6cc065424ca45974d4dfbeb5607e69fe72fcd
99012f79791e46655e96223362ed8aebbbe59904fae29988033fe4c91d7c2d8d
9993aec888f8709dd868f8dad53cf3646577b1b22f17af00caedaa651d1c7dc5
99ecb14ec0a4e706ee386f1bde1a4684119fa8e100f24821f71f7fa75ccd481d
9bb74272e1b56376efcfdb67b5d8252269e024a1947ac037ef2e7b632235bb44
9ca47ac7522c32eb4a4acb2f20034928c5fd492308eb0bef86402aad46ee0ab9
a31c69281c7bb7e5ea7389d78c7399b747d9cc0c9e2aca9dba81c1e092c47e2a
a390cf62fca4217670690ed84dcb7f8d569348f6ef9ef61b3ea4bc15c4548561
a595fcc49d99638da4d2003d86dddfc70eceebb9ab0ba9f6acee9c0de9b8fa0f
aaaabde3f68c325033b37bb3ebff887e3b589b7137e717e96648a52221881429
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460
ad00ce0c27a5316106aa3a6b6bcc0b9036e1d6c2078dbbaff4f6fdda718e8be1
ad3f5743027d58f0c5e8b2f074edc3fb50e776ddecdb8a90531fd30407d6ff48
aec23e33e546e31c593bcc44f10e9419a4b20ebc961663ef1b0b9eb4ff39a989
b12e1bf44cf2298027405746f211bcfcb1073db3a964e97445c4c5d93c0e73c1
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2ad83b4e5a4331a17c58dfdbefaea5f62d5cd01cd987f89b190ab8bfdc01c0c
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1
b425ea792e2609fd5c4b96c092402c766332151b3b812d97ebd327da7019746e
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1
b7d713512d82c73090b70a70ee41c3b9cd26179a73db4090af86a9c9e4bd1809
b8cac7efd6ea95e27c24392b93c9bdd6e02e28d3e32b6c3bd48c49344319fc5a
bab9dd19b4cf121a8e64052a7bd3c3dcae5ceb36423c8c8893b35039538f6359
bc1a5cd1bdb60c4796325ad79c483e5b6dcedad884c14fdfa2f7dc1a5407e4a1
bfc8e65089dc5421d56ecc71a0328eafd4feb2a602503ae5c15bfa3189c02f7e
c13f7a7ae91136735e8b9a518535d5832b5683aa86089f02fbb28419724de6c0
c1474b847c4be14b2fbaf5d65ef989712f309ebd4bb48b87cf6b3bfa3ba583a4
c1fd10f83242c8c832d6c8d3243d7180ec71c4f8473acd129ab8dbbd4e93f408
c2ba2eb0ae248fdbb8072b2e13da7994d02dee0696a9313cbdd22b747e0ba3a5
c495867cc3ab5c7cae6316d4157ff672ce172d86efed63d678151927030989a7
c50c64d2ce67ce581ad26345ac68fd1ba3d10e76554753b3cfe3da65a0b73c90
c96d21225ee8cdc9844f5da093a6b92bb2e8aaff6d9c6a1995da240f25bf21fd
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d
d103739880dfde0845ea6d235002e500adc8621625307635140dd9d6f67dfd76
d15b95bf4970eddb971b099a14f94c0de981ec80b720e7d21ba30c4e420a8444
d2a42cbfbf8f1f8f16343570edca6a1a004f0613da5bdcc1b070026b93adce2e
d7befd17f6e2d040a6bc9e7abd8528fa87d853a928f7603e32b6cd36e19ef2a9
d7d22751f1faf2473ebf462474c1c84a07c5b9d18cc09fc0ded523d73a4c674e
d7ece9c8c7bfd4c9732c71235cecc8800dc0deb8e1652aa7d97325eff94e74c9
d8950f9cbb7896df7fe26f759bf72223f92b33de77d315e0cb4ec3a772a9f3ca
d8bacdb80d8789532f595bd20e39f7cc0f89c7dfbc38d288111f0123b2a0be70
d9ab271a58bd3e13c43b449f2f9a547f13a8acb8f8d266602d8acbd2679ac5a1
daa85ded4156b780540061c948a34b1ed8fc31d93655bac407bb12b41752596d
dbc006c71450e4ff941bc74f43e0ece97b97b77b5fc8a7976e8416f797864ada
ded8ccc0bf2159ddbcda148611365dd27ddbca253518d5a939a6b9159263416e
e0b1148f37919a145504d62500b2e4778f1a8f96fc51454ebe7bc20e9f9f0f0c
e30451ab10c133aa79ea31bc8db83eeb2fbea2d2b811e5564dff42c7d42e398f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4d8d85fd9a2ae5712b38eac679930914cc8b6705fa36c62e447228ffa7801e7
e5c8508b5403b3ca03c904bd90b08428114c6f8a6cec720fe588f146a2c11664
e9e8daaf6f563b5faec898162ce48a361f3bbfa4cd063425e62445ce705e2f1a
ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742
ebead41b592cff0f3b123181a85b91ac004f530f03ba97fdec945fb1c89ac5df
ebfca5a07590adfd3bcfdc503c7b5b5f878ff7a192c8c2435226aa7b4a2afe55
ec569f2ff9e47f52d3710ed53fa8cf0a014ea79fb54cf091f0239cfbdae56990
ed0d67dcf6a6cb0716be1dbaa0fa2b9059c7649161137efe0dca6c403d3ec6db
ed8d3c278099f59854449fea39c7e95f3cbf41be2424511010c8248821b552fc
ef0151d0990a1fe95c1392db0d4408a90a348f0dc031e114ba583f1b2237ea1a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0d06f0c4ab947fdf1f8afb1cc249fde6d4262ed8883d5492fd421033fcdfa6a
f18abebfda1e0d5479ac5ee54ee605a173a77a01f3170917fc709251f448556d
f445112c3e40e803ac15c79cdc4e51e95697795899e584de5f1b422aac363d7d
f4cb3fbf585c232657aff936688387e882ff196d600475f67bdebb286a994d5c
f9741b66aa221bcff2c8901dfd50a449c564405f970fb269c3412bf9619d2a2d
fb8538dffb0334e2d261233f2de275907a4a5582e38c3879e2015eddb35ac9d4