www.zdnet.com Open in urlscan Pro
2.18.233.143 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Submission: On November 05 via api (November 5th 2019, 4:11:08 am UTC) from HK

Summary HTTP 318 Redirects Links 47 Behaviour Indicators

Summary

This website contacted 65 IPs in 7 countries across 57 domains to perform 318 HTTP transactions. The main IP is 2.18.233.143, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on April 23rd 2019. Valid for: a year.

This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	2.18.233.143 2.18.233.143	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
49	2a04:4e42:1b:... 2a04:4e42:1b::444	54113 (FASTLY) (FASTLY - Fastly)
26	2a04:4e42:3::444 2a04:4e42:3::444	54113 (FASTLY) (FASTLY - Fastly)
1	23.0.46.190 23.0.46.190	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	35.190.38.167 35.190.38.167	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
5	2a02:26f0:6c0... 2a02:26f0:6c00:19c::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
21	172.217.23.162 172.217.23.162	15169 (GOOGLE) (GOOGLE - Google LLC)
1	13.224.196.129 13.224.196.129	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	3.226.5.56 3.226.5.56	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	172.217.21.230 172.217.21.230	15169 (GOOGLE) (GOOGLE - Google LLC)
14	152.199.23.241 152.199.23.241	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	52.49.153.216 52.49.153.216	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff18	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
4	2606:4700::68... 2606:4700::6810:a10d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
8	2606:4700::68... 2606:4700::6810:4da5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 8	52.31.106.135 52.31.106.135	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
4	64.30.230.22 64.30.230.22	6623 (CBSI-1) (CBSI-1 - CBS Interactive Inc.)
2	2606:4700:20:... 2606:4700:20::6819:a222	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	184.31.90.90 184.31.90.90	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	3.220.21.104 3.220.21.104	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY - Fastly)
1	2600:9000:215... 2600:9000:2156:fc00:18:1fcd:349:ca21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	104.111.241.32 104.111.241.32	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 2	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 2	52.215.211.56 52.215.211.56	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 3	18.197.145.83 18.197.145.83	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 4	52.18.181.107 52.18.181.107	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	54.87.95.71 54.87.95.71	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	23.99.128.52 23.99.128.52	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2606:4700::68... 2606:4700::6810:4ea5	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700:20:... 2606:4700:20::6819:a322	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	34.246.252.247 34.246.252.247	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	54.154.151.160 54.154.151.160	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	15.188.105.205 15.188.105.205	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	185.33.223.215 185.33.223.215	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1 4	66.117.28.68 66.117.28.68	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
27	151.101.114.2 151.101.114.2	54113 (FASTLY) (FASTLY - Fastly)
7	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1 6	184.25.159.208 184.25.159.208	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	2600:9000:21f... 2600:9000:21f3:c800:1d:8c8c:47c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	52.18.184.106 52.18.184.106	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1 1	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.227.208.151 35.227.208.151	15169 (GOOGLE) (GOOGLE - Google LLC)
4	151.101.113.181 151.101.113.181	54113 (FASTLY) (FASTLY - Fastly)
1 1	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE - Google LLC)
1 4	2a00:1450:400... 2a00:1450:4001:816::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
4 6	2a00:1450:400... 2a00:1450:4001:825::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1288:110... 2a00:1288:110:c305::9000	34010 (YAHOO-IRD) (YAHOO-IRD)
1	52.28.51.75 52.28.51.75	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
9	2a00:1450:400... 2a00:1450:4001:817::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
12	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
16	2a00:1450:400... 2a00:1450:4001:825::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
5	35.176.192.147 35.176.192.147	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
8	2607:f8b0:400... 2607:f8b0:4006:802::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
3	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY - Fastly)
1	151.101.14.2 151.101.14.2	54113 (FASTLY) (FASTLY - Fastly)
2	13.224.197.94 13.224.197.94	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY - Fastly)
1	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
318	65

6 2.18.233.143 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-143.deploy.static.akamaitechnologies.com

www.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rev.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

49 2a04:4e42:1b::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet2.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet3.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a04:4e42:3::444 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

zdnet1.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zdnet4.cbsistatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.0.46.190 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-0-46-190.deploy.static.akamaitechnologies.com

c.evidon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.38.167 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 167.38.190.35.bc.googleusercontent.com

urs.zdnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.234.21 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:6c00:19c::11a6 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
684dd306.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.217.23.162 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.196.129 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-224-196-129.fra2.r.cloudfront.net

native.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.226.5.56 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-226-5-56.compute-1.amazonaws.com

l.betrad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.230 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s13-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 152.199.23.241 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.153.216 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff18 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

iicbsi-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:a10d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6810:4da5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.31.106.135 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 64.30.230.22 (Fremont, United States)

ASN6623 (CBSI-1 - CBS Interactive Inc., US)
PTR: phx2-dw-cbsi-xw-ext-lb.cnet.com

dw.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::6819:a222 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.31.90.90 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-90-90.deploy.static.akamaitechnologies.com

www.everestjs.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.220.21.104 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-220-21-104.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

vidtech.cbsinteractive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:fc00:18:1fcd:349:ca21 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.241.32 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-241-32.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.72.21 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 21.72.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.201 (Ascension Island) 2 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.215.211.56 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-215-211-56.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.197.145.83 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-197-145-83.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.18.181.107 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-18-181-107.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.87.95.71 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-87-95-71.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.99.128.52 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: waws-prod-dm1-001.cloudapp.net

lightboxapi1.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4ea5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

api1.lightboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::6819:a322 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

beacon.tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.246.252.247 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-246-252-247.eu-west-1.compute.amazonaws.com

api.viglink.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.154.151.160 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-154-151-160.eu-west-1.compute.amazonaws.com

cbsi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.188.105.205 (Paris, France)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

saa.cbsi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.33.223.215 (Netherlands)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 66.117.28.68 (United States) 1 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 151.101.114.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 184.25.159.208 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-159-208.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.208.240 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:c800:1d:8c8c:47c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cdn-magiclinks.trackonomics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.18.184.106 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-18-184-106.eu-west-1.compute.amazonaws.com

secure-us.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.117.28.86 (United States) 2 redirects

ASN15224 (OMNITURE - Adobe Systems Inc., US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.2 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.208.151 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 151.208.227.35.bc.googleusercontent.com

web-sdk.urbanairship.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.113.181 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

widget.perfectmarket.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.98 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s45-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:816::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:825::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::9000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

ad.yieldmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.51.75 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-28-51-75.eu-central-1.compute.amazonaws.com

www.summerhamster.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:817::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.176.192.147 (London, United Kingdom)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-176-192-147.eu-west-2.compute.amazonaws.com

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4006:802::2003 (United States)

ASN15169 (GOOGLE - Google LLC, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.14.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

15.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
imprammp.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
convammp.basebanner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

vidstat.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.197.94 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-224-197-94.fra2.r.cloudfront.net

www.cmbestsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY - Fastly, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
75	cbsistatic.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com zdnet1.cbsistatic.com zdnet4.cbsistatic.com	1 MB
30	taboola.com cdn.taboola.com trc.taboola.com images.taboola.com 15.taboola.com vidstat.taboola.com imprammp.taboola.com	395 KB
27	doubleclick.net 2 redirects securepubads.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net	332 KB
17	moatads.com z.moatads.com geo.moatads.com px.moatads.com	612 KB
16	ampproject.org cdn.ampproject.org	390 KB
14	tiqcdn.com tags.tiqcdn.com	90 KB
10	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	65 KB
9	gstatic.com csi.gstatic.com fonts.gstatic.com	14 KB
9	googletagservices.com www.googletagservices.com	244 KB
9	ml314.com 2 redirects ml314.com in.ml314.com	16 KB
9	lightboxcdn.com www.lightboxcdn.com api1.lightboxcdn.com	161 KB
8	cbsi.com dw.cbsi.com saa.cbsi.com rev.cbsi.com	13 KB
8	viglink.com cdn.viglink.com api.viglink.com	58 KB
8	google.com 4 redirects adservice.google.com www.google.com	851 B
6	scorecardresearch.com 1 redirects sb.scorecardresearch.com	4 KB
6	everesttech.net 3 redirects pixel.everesttech.net cm.everesttech.net	3 KB
6	demdex.net 1 redirects dpm.demdex.net cbsi.demdex.net	4 KB
6	zdnet.com www.zdnet.com urs.zdnet.com	190 KB
5	adnxs.com secure.adnxs.com	3 KB
4	perfectmarket.com widget.perfectmarket.com	94 KB
3	eyeota.net 2 redirects ps.eyeota.net	897 B
3	everestjs.net www.everestjs.net	8 KB
3	tru.am tru.am beacon.tru.am	14 KB
3	go-mpulse.net c.go-mpulse.net	57 KB
2	cmbestsrv.com www.cmbestsrv.com	532 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	facebook.com www.facebook.com	258 B
2	google.de www.google.de adservice.google.de	429 B
2	imrworldwide.com 1 redirects secure-us.imrworldwide.com	843 B
2	facebook.net connect.facebook.net	87 KB
2	casalemedia.com as-sec.casalemedia.com	1 KB
2	akstat.io 684dd306.akstat.io	708 B
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	mathtag.com 2 redirects pixel.mathtag.com	1 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com	727 B
2	betrad.com l.betrad.com	240 B
1	jsdelivr.net cdn.jsdelivr.net	1 KB
1	googleapis.com fonts.googleapis.com	451 B
1	basebanner.com convammp.basebanner.com	295 B
1	summerhamster.com www.summerhamster.com	181 B
1	yieldmanager.com ad.yieldmanager.com	341 B
1	googleadservices.com 1 redirects www.googleadservices.com	306 B
1	urbanairship.com web-sdk.urbanairship.com	17 KB
1	trackonomics.net cdn-magiclinks.trackonomics.net	18 KB
1	qualtrics.com zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	15 KB
1	azurewebsites.net lightboxapi1.azurewebsites.net	583 B
1	chartbeat.net ping.chartbeat.net	168 B
1	bluekai.com 1 redirects tags.bluekai.com	856 B
1	chartbeat.com static.chartbeat.com	14 KB
1	cbsinteractive.com vidtech.cbsinteractive.com	281 KB
1	akamaihd.net iicbsi-a.akamaihd.net	272 B
1	google.nl adservice.google.nl	717 B
1	adsrvr.org match.adsrvr.org	536 B
1	sharethrough.com native.sharethrough.com	120 KB
1	indexww.com js-sec.indexww.com	29 KB
1	evidon.com c.evidon.com	511 B
0	disqus.com Failed zdnet-1.disqus.com Failed
318	57

	Domain	Requested by
26	zdnet2.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
23	zdnet3.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
21	securepubads.g.doubleclick.net	www.zdnet.com securepubads.g.doubleclick.net www.googletagservices.com
17	images.taboola.com	www.googletagservices.com cdn.ampproject.org www.cmbestsrv.com
16	cdn.ampproject.org	securepubads.g.doubleclick.net
14	tags.tiqcdn.com	zdnet2.cbsistatic.com tags.tiqcdn.com
14	zdnet1.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
12	zdnet4.cbsistatic.com	www.zdnet.com zdnet2.cbsistatic.com zdnet3.cbsistatic.com
9	www.googletagservices.com	www.zdnet.com securepubads.g.doubleclick.net rev.cbsi.com
8	csi.gstatic.com	cdn.ampproject.org securepubads.g.doubleclick.net
8	ml314.com	2 redirects tags.tiqcdn.com ml314.com www.zdnet.com
8	www.lightboxcdn.com	www.zdnet.com www.lightboxcdn.com
7	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.zdnet.com
6	trc.taboola.com	cdn.taboola.com
6	px.moatads.com
6	z.moatads.com	securepubads.g.doubleclick.net
6	www.google.com	4 redirects www.zdnet.com
6	sb.scorecardresearch.com	1 redirects tags.tiqcdn.com cdn.taboola.com widget.perfectmarket.com
5	geo.moatads.com	z.moatads.com
5	secure.adnxs.com	js-sec.indexww.com
5	www.zdnet.com	zdnet3.cbsistatic.com
4	googleads.g.doubleclick.net	1 redirects www.zdnet.com
4	widget.perfectmarket.com	cdn.taboola.com widget.perfectmarket.com
4	cdn.taboola.com	zdnet2.cbsistatic.com cdn.taboola.com
4	pixel.everesttech.net	1 redirects
4	api.viglink.com	cdn.viglink.com
4	dpm.demdex.net	1 redirects www.zdnet.com tags.tiqcdn.com
4	dw.cbsi.com	tags.tiqcdn.com www.zdnet.com
4	cdn.viglink.com	tags.tiqcdn.com www.zdnet.com
3	pagead2.googlesyndication.com
3	saa.cbsi.com	tags.tiqcdn.com
3	ps.eyeota.net	2 redirects www.zdnet.com
3	www.everestjs.net	tags.tiqcdn.com www.everestjs.net
3	c.go-mpulse.net	www.zdnet.com c.go-mpulse.net zdnet1.cbsistatic.com
2	www.cmbestsrv.com	vidstat.taboola.com
2	www.google-analytics.com	widget.perfectmarket.com
2	www.facebook.com	connect.facebook.net
2	cm.everesttech.net	2 redirects
2	secure-us.imrworldwide.com	1 redirects
2	connect.facebook.net	tags.tiqcdn.com connect.facebook.net
2	as-sec.casalemedia.com	js-sec.indexww.com
2	cbsi.demdex.net	tags.tiqcdn.com
2	684dd306.akstat.io	zdnet1.cbsistatic.com c.go-mpulse.net
2	sync.crwdcntrl.net	2 redirects
2	pixel.mathtag.com	2 redirects
2	idsync.rlcdn.com	2 redirects
2	tru.am	tags.tiqcdn.com tru.am
2	adservice.google.com	securepubads.g.doubleclick.net www.googletagservices.com
2	l.betrad.com	www.zdnet.com
1	fonts.gstatic.com	www.lightboxcdn.com
1	cdn.jsdelivr.net	www.lightboxcdn.com
1	fonts.googleapis.com	www.lightboxcdn.com
1	convammp.basebanner.com
1	imprammp.taboola.com	www.zdnet.com
1	vidstat.taboola.com	cdn.taboola.com
1	15.taboola.com	cdn.taboola.com
1	adservice.google.de	www.googletagservices.com
1	rev.cbsi.com	www.zdnet.com
1	www.summerhamster.com
1	ad.yieldmanager.com
1	www.google.de
1	www.googleadservices.com	1 redirects
1	web-sdk.urbanairship.com	zdnet3.cbsistatic.com
1	cm.g.doubleclick.net	1 redirects
1	cdn-magiclinks.trackonomics.net	tags.tiqcdn.com
1	zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com	tags.tiqcdn.com
1	beacon.tru.am	tru.am
1	api1.lightboxcdn.com	www.lightboxcdn.com
1	lightboxapi1.azurewebsites.net	www.lightboxcdn.com
1	ping.chartbeat.net	www.zdnet.com
1	tags.bluekai.com	1 redirects
1	static.chartbeat.com	zdnet2.cbsistatic.com
1	vidtech.cbsinteractive.com	zdnet2.cbsistatic.com
1	in.ml314.com	ml314.com
1	iicbsi-a.akamaihd.net	tags.tiqcdn.com
1	adservice.google.nl	securepubads.g.doubleclick.net
1	match.adsrvr.org	js-sec.indexww.com
1	ad.doubleclick.net	www.zdnet.com
1	native.sharethrough.com	www.zdnet.com
1	js-sec.indexww.com	www.zdnet.com
1	urs.zdnet.com	zdnet2.cbsistatic.com
1	c.evidon.com	www.zdnet.com
0	zdnet-1.disqus.com Failed	zdnet2.cbsistatic.com
318	83

This site contains links to these domains. Also see Links.

Domain
www.zdnet.com.cn
www.zdnet.fr
www.zdnet.de
www.zdnet.co.kr
japan.zdnet.com
www.techrepublic.com
downloads.zdnet.com
blog.malwarebytes.com
www.symantec.com
www.reddit.com
support.google.com
www.pcsecurity-99.com
www.cnet.com
popup.taboola.com
www.familyminded.com
trkwl.me
www.nationaalbespaarcentrum.nl
k.ilius.net
bg.search.etargetnet.com
trendingalleries.com
12tracku.com
betrouwbaardating.nl
cbsi.force.com
www.cbsinteractive.com
cbsi.secure.force.com
cbslnk.cbsileads.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
legalterms.cbsinteractive.com
narratives.zdnet.com
academy.zdnet.com

Subject Issuer	Validity	Valid
www.cbs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-07-22`	a year	crt.sh
*.cbsistatic.com DigiCert SHA2 High Assurance Server CA	`2019-02-22` - `2021-02-26`	2 years	crt.sh
*.evidon.com DigiCert ECC Secure Server CA	`2019-02-01` - `2020-05-02`	a year	crt.sh
*.zdnet.com DigiCert SHA2 High Assurance Server CA	`2017-12-12` - `2020-12-15`	3 years	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2019-07-17` - `2020-03-09`	8 months	crt.sh
akstat.io DigiCert SHA2 Secure Server CA	`2019-04-16` - `2020-06-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.sharethrough.com Go Daddy Secure Certificate Authority - G2	`2018-09-18` - `2019-11-17`	a year	crt.sh
l.betrad.com Go Daddy Secure Certificate Authority - G2	`2019-04-25` - `2021-06-24`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2017-10-25` - `2020-05-13`	3 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-10` - `2020-02-16`	6 months	crt.sh
ssl516460.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-24` - `2020-03-01`	6 months	crt.sh
*.ml314.com Amazon	`2019-03-16` - `2020-04-16`	a year	crt.sh
*.cbsi.com DigiCert SHA2 High Assurance Server CA	`2017-11-07` - `2021-02-04`	3 years	crt.sh
ssl389962.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-03` - `2020-05-11`	6 months	crt.sh
www.everestjs.net DigiCert SHA2 Secure Server CA	`2018-10-15` - `2020-10-15`	2 years	crt.sh
vidtech.cbsinteractive.com DigiCert SHA2 High Assurance Server CA	`2018-12-13` - `2020-12-17`	2 years	crt.sh
*.chartbeat.com Gandi Standard SSL CA 2	`2019-04-10` - `2020-04-10`	a year	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2019-09-19` - `2019-12-18`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2018-12-20` - `2020-01-01`	a year	crt.sh
*.azurewebsites.net Microsoft IT TLS CA 5	`2019-09-24` - `2021-09-24`	2 years	crt.sh
viglink.com Amazon	`2019-02-09` - `2020-03-09`	a year	crt.sh
saa.cbsi.com DigiCert SHA2 High Assurance Server CA	`2019-06-23` - `2020-09-25`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-07-30` - `2020-07-25`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA	`2018-11-28` - `2019-12-26`	a year	crt.sh
*.qualtrics.com DigiCert SHA2 Secure Server CA	`2018-10-08` - `2021-01-06`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-09-22` - `2019-12-20`	3 months	crt.sh
*.trackonomics.net Go Daddy Secure Certificate Authority - G2	`2018-12-22` - `2020-02-20`	a year	crt.sh
*.imrworldwide.com DigiCert SHA2 Secure Server CA	`2019-02-25` - `2020-02-25`	a year	crt.sh
*.everesttech.net DigiCert SHA2 Secure Server CA	`2017-04-13` - `2020-04-17`	3 years	crt.sh
*.urbanairship.com DigiCert ECC Secure Server CA	`2018-06-20` - `2020-06-24`	2 years	crt.sh
p.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-09-03` - `2021-02-22`	a year	crt.sh
www.google.de GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2019-06-27` - `2019-12-24`	6 months	crt.sh
*.summerhamster.com Let's Encrypt Authority X3	`2019-09-30` - `2019-12-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
moatads.com DigiCert ECC Secure Server CA	`2018-11-10` - `2020-02-09`	a year	crt.sh
misc-sni.google.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
www.google.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
g2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-03` - `2019-11-19`	7 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.googleapis.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-29` - `2020-04-23`	a year	crt.sh

This page contains 23 frames:

Primary Page: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Frame ID: CFFC58B53BD57676B3876BA675859380
Requests: 235 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: 792289B67BE6B2919CF6840016897DC3
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1572927052128&lv=1
Frame ID: 20FF891782275E45BA2FA3B29029CD50
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637082285918091960
Frame ID: EA4394365887CB5B44698ADFA5A6DB4D
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 727344CDD09B5B0E1F3D9A2608AE10BC
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: B74076CEF7F9CCB05D13EF7B5BD7DFC7
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 15C8BC26F2B363D5959B625DBAF2EA27
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 3D2295BA624ED5A4A2DE19830DC49562
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstp0z4i9jPHaEJka4btT21l2cwmaz7FmNp4heUXS-GYWFBcV5Tzhor4LKWnkHDKVhUDg6sIidoVjdpcC2CBFzl4-f7XMYbTTjJ3O-7xCWYu3ZpTLyGYjC_920t28_s9UiEdD04gy1ZSVdElDQs_HEXdk-srYLmAXq_7VDwiu7bn7nzzr_JGML8Py1kTmfxQGpyEvKwRIhqrXHCRwJuP7TzzHzFAyaYde9bs8nsxg7ls42nUpHdixVtWmfxR1WMRGcnQEtcp7uMy&sig=Cg0ArKJSzAcvkAKoGzYdEAE&urlfix=1&adurl=
Frame ID: F682366E9E10764D53BDF7F638792710
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Frame ID: 79C1E82C3692F1835CE57E96B694F455
Requests: 11 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Frame ID: EE71FC7531193F1EA142BD002D63D422
Requests: 12 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssEwxGdq2TQvr2p33TDAzBqXQxkKZRpxmiiqTbrJRPUydMoZkc1YYB8mm0Ax2oaPBFpI7k6MkPbRbzr4weC6CJQxCtc5PBcyuhM2W5QaioY9q_jV5BDk_mBhUxKdyxQhWEU23K21T1avFPjSmDnVzRYldL0DrV3ObIdTwV_BmRkjbRso8Jxky6gQEvyDgsm4fccu867l1C6byX1Trq1NTTSV2OionI-TdD3Jf83HXeMv4z55-JpJo5Ua0sfdAhRYPlLjz1QSw8c&sig=Cg0ArKJSzBQ3SHKGsSGTEAE&urlfix=1&adurl=
Frame ID: 72EA709408D59A47B4349E165781A92C
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Frame ID: 5004D1601B241F9C87544A9E2797C158
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html
Frame ID: 178973188292D39DCB3FC4550BD0DA18
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvd8yhzZyGSV6OUV_awPRJf18mwzu6QOGs1rQAJ88NDTLCqjBGBJ-5Jn_kf5qUka8_0daBME2Po4COjutE_bC5y0LXEa8mHzN2dIjGBnQYmodqMdyzDwSZ5tVE17zuvocXD_Kmxhvj6MkUZ9WciDs-mvLbH4EyW79KY4SYeHezfzYne9ejNtQqWUF-r37X-TzJzi-d0OSVuMSVNm5hmiN3A5jjaLCEiCfjtcwgW50ZEtnWMI8XMjTu_nkBBkouKlbKpo9pbH_WX&sig=Cg0ArKJSzLNm5nEtGYDxEAE&urlfix=1&adurl=
Frame ID: B9844AE473954DE686AA5223255000B7
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html
Frame ID: 7D8177F4E779E9455C96B516C24F5BF7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssYZcFwe9WwUPXW8zGDzMHRZYuV3Xo0Z7Kczdp-U83r0bx4DXLkipW7gRuEqXoZ0ey6uM1gLbA9brB3ZZaBJuLpDd2BAU3sitgMMVVHJ_t-ywno_n7giZ7RuJ3DnIpVwTtfUN0mPm2sqbdK4BNYTT-ssQcmLYQTKyoNRkepkOn2AzU790WOpkq1-yCMyZ5fY1UKJ_qFejxPnlG2gXM_YNIAHJALmicGp8aELbD0DeTC1DBIgAgXOfnJRUFxcD74tC74iS2wP31G&sig=Cg0ArKJSzJF3xLwGVZlAEAE&urlfix=1&adurl=
Frame ID: BE9BD740100FBE60DF87D45CB6F84EAA
Requests: 18 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 36E4CB65A833FD3922023A26286809DB
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: 62E2811830A7ECD7206E72A3F8F7DF4B
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7y2azNalAnWkcciKTY18pYmrxUakK5BHkH3qm-QbMT0rz4qHyyeMStKKRLOfs3uLS_WAh6y8T8TogH81JsR8AyZxjHe3GN2TU57_8xYqXLL8SfnIKULv2hcuDBxlU0Tqa3842e2W8ZlZx47JXQ9J95GkAt3O6S5fAWeUTPfKJtP7T5_5lJ2iba24h5ap7YwrMIVRKXv18az0rxasnWlt9o0MdJNwYfZhbqAzbyOqnU33fW16eeBHZxHJjW-GcujMgBjn5_eJ8&sig=Cg0ArKJSzIYdV2bnnWWDEAE&urlfix=1&adurl=
Frame ID: 5775AD7DB0ACC1C219B2FD52EB9FE593
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuR2aaJ93e4rxrKspd0Jrlk3AB2oUGPWsyvxJZuv0smU0WDjjy4_8Pdqko2H9QYHdzGjKVMFLEqp_UefXj3KW65A9TrQq7JW7hgzh61vt1DXOkdR1Hza1L3bpLp1BUPh7U2GBpNFNuuU42pEJ3W_f1w_5xuQrhn2arStF_iVtcvwm-QReLGSWDyfDiMOfEcX9I9CKWTF7iqjelJIb1d2656DtX1NcVJawPPZxxuI89GBBIebPajOquksu9036XfxlCfPhYoqhUB&sig=Cg0ArKJSzLW2k9846THnEAE&urlfix=1&adurl=
Frame ID: 708E86724FF3F85A70E6846738A00C87
Requests: 3 HTTP requests in this frame

Frame: https://imprammp.taboola.com/st?cipid=7991117&ttype=0&cirid=5F537084B744803193954497308&cicmp=1337627&cijs=1&dast=V7fTYCFgOx980rMCEZ1gSx980rMCEZ1gUAAAAGBugHGzVjbXaD4WjCG42Gg81iOVkuBqPRbjcYTMFgC5_T3d2GMDSdDp_rXq_7_e7Sk91lumv8br_Ccnp6zC6_3OV7q-6Wl9tve1jMLrfw6DIbXpa32mH2PSwvt9DheSvtNpfH9DK5RavBYLBW2E2Wv9PkFrlsT4_L85cDAAAAwAMAUUs0xI5vQ3sEAAAAgATPyLUCRUDFv4XABQAAAAAGAIFYuAYAJUdCuD2nl-XkcPsDAOAhAAQAYECBBEAgsbAEwOFu8QQAAOCgTuZpm-X___8_BiDvvUkGgCJt48agB-DBB-BBCAAAIGtIBgKF0E9njJyo4LCIEQAAAEAbu1fF0aROqCyq_v___60ArgAAAtxyhEsIsm5OilnDAAAABMYW6GHx-80Ou8bvdtn_________v9n_GQCaUNQcdBqQZvaFGs_ItcLaLyAAANu7AQC8BcDFHIAdAAAAwN3___9_HgAAAMEeJdtrNZ49ynqfwRY-p7u7fhO2GK0mk81yOFsuJoPhaDga7U_ghgOcoOFwsNgNFrvFYjhZTEaD5WCBAjGY4IQMR5vJarRb7SbL4WQ0mm0mG6Ro1Wo22gyGq9lkttuthoPhcjRCitYsZpPJYjZa7jaD5WQ0GE6GQ4SB5Wyx8g13a43LtFmLZjOXWzla2NYyh2Njcc4WHodltRa9PqbTxOGbeGx-bIjBci7ZzObK0VyyWCUAAAAAAAAAgCVMmTcBAAAAOA1iNpvsdituHA!&excid=22&tst=1&docw=0&cs=false
Frame ID: B2B52766072CBC78A1DC9DE61AA9737F
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637082285918091960
Frame ID: 07976D70A605C7CDFA5D7F0AA374BEFD
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

VigLink (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:^[^\/]*\/\/[^\/]*viglink\.com\/api\/|vglnk\.js)/i

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

Page Statistics

318
Requests

98 %
HTTPS

39 %
IPv6

57
Domains

83
Subdomains

65
IPs

7
Countries

5138 kB
Transfer

13886 kB
Size

29
Cookies

47 Outgoing links

These are links going to different origins than the main page.

URL: http://www.zdnet.com.cn/
Title: ZDNet China

Search URL Search Domain Scan URL

URL: http://www.zdnet.fr/
Title: ZDNet France

Search URL Search Domain Scan URL

URL: http://www.zdnet.de/
Title: ZDNet Germany

Search URL Search Domain Scan URL

URL: http://www.zdnet.co.kr/
Title: ZDNet Korea

Search URL Search Domain Scan URL

URL: http://japan.zdnet.com/
Title: ZDNet Japan

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/
Title: White Papers

Search URL Search Domain Scan URL

URL: https://downloads.zdnet.com/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/forums/
Title: TechRepublic Forums

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/whitepapers/10-dangerous-app-vulnerabilities-to-watch-out-for-free-pdf/?ftag=CMG-01-10aaa1b
Title: 10 dangerous app vulnerabilities to watch out for (free PDF)

Search URL Search Domain Scan URL

URL: https://blog.malwarebytes.com/android/2019/08/mobile-menace-monday-android-trojan-raises-xhelper/
Title: per Malwarebytes

Search URL Search Domain Scan URL

URL: https://www.symantec.com/blogs/threat-intelligence/xhelper-android-malware
Title: per Symantec

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/antivirus/comments/bj6isa/xhelper_keeps_installing_itself_on_android_phone/
Title: Reddit

Search URL Search Domain Scan URL

URL: https://support.google.com/googleplay/thread/5398460?hl=en
Title: 1

Search URL Search Domain Scan URL

URL: https://support.google.com/googleplay/thread/10807377?hl=en
Title: 2

Search URL Search Domain Scan URL

URL: https://www.pcsecurity-99.com/2019/04/30/xhelper-keeps-installing-itself-on-android-phone-how-to-get-rid-oef-it-permanently/
Title: tech support forums

Search URL Search Domain Scan URL

URL: https://www.cnet.com/how-to/the-best-home-security-systems-of-2019/?ftag=CMG-01-10aaa1b
Title: Best home security of 2019: Professional monitoring and DIY (CNET)

Search URL Search Domain Scan URL

URL: https://popup.taboola.com/en/?template=colorbox&utm_source=cbsinteractive-zdnet&utm_medium=referral&utm_content=alternating-thumbnails-a:ZDNETarticleDesktop/Tablet-Below%20Article%20Thumbnails:
Title: by Taboola

Search URL Search Domain Scan URL

URL: https://www.familyminded.com/s/celeb-couples-with-major-age-differences-50dac89107af4ec0?utm_campaign=agedifferences-f43f45b1c6cf4fe5&utm_source=tab&utm_medium=cpc&utm_term=cbsinteractive-zdnet
Title: FamilyMinded

Search URL Search Domain Scan URL

URL: https://trkwl.me/?flux_fts=ciqxqiqqcxxczztzaaeciqxqpcalzitcltaaoef3a0&campaign={campaign}&publisher=cbsinteractive-zdnet&ad=Is+This+the+Solution+To+Netherlands%E2%80%99s+Mosquitos+We%E2%80%99ve+All+Been+Looking+For%3F&creative=http%3A%2F%2Fblogs.dailylifetech.com%2Fb%2Fmoskinator%2F235%2F006.jpg&banner_id=2839691338&tb_cid=CjBkMzI2MzRkOS1kOTU4LTQ0ZTUtODFlNS0yMzc4OWZiNjIxNjYtdHVjdDRiYTdiY2USEndvcmxkbGVhZHNtZWRpYS1zYw
Title: Moskinator

Search URL Search Domain Scan URL

URL: https://www.nationaalbespaarcentrum.nl/hypotheekberekening/?utm_source=taboola&utm_medium=referral&br=1&bi=4&me=1&ua=www.senbc1297169.nl
Title: Nationaalbespaarcentrum.nl

Search URL Search Domain Scan URL

URL: http://k.ilius.net/?mtcmk=907539&fsid=186&utm_source=taboola&utm_term=cbsinteractive-zdnet&utm_medium=display&utm_campaign=1691443
Title: OurtimeAdvertisement GO TOOurtimeCANCEL

Search URL Search Domain Scan URL

URL: https://bg.search.etargetnet.com/rtb/go.php?cid=39310&cmp=3637&crid=14094&from=taboola&rue=cbsinteractive-zdnet&utm_source=taboola&utm_medium=referral
Title: moqrog

Search URL Search Domain Scan URL

URL: https://trendingalleries.com/slechts-28-m2-maar-dit-huis-heeft-van-binnen-iets-ongelooflijks/?utm_source=taboola&utm_medium=referral&utm_campaign=LEDHuisDesktopNL
Title: Trendingalleries

Search URL Search Domain Scan URL

URL: https://12tracku.com/path/lp.php?trvid=13719&trvx=bed166f7&exid=CjBkMzI2MzRkOS1kOTU4LTQ0ZTUtODFlNS0yMzc4OWZiNjIxNjYtdHVjdDRiYTdiY2USDXlub3QtbXVhbWEtc2M&site=cbsinteractive-zdnet&ci=2314193&cii=2842314628&utm_source=gg1&utm_medium=cbsinteractive-zdnet&utm_term=Deze+Japanse+Uitvinding+Laat+Je+In+40+Talen+Spreken&utm_content=https%3A%2F%2Fs3.eu-central-1.amazonaws.com%2Fad-uploads-long%2F1%2F1485d0ac-d77a-4afb-a623-a44c7df37815.jpg&wid=1039694&platform=Desktop&name=EVENT_NAME&utm_source=taboola&utm_medium=referral
Title: MUAMA Enence

Search URL Search Domain Scan URL

URL: https://betrouwbaardating.nl/r/5-desktop-2
Title: Betrouwbaar Dating

Search URL Search Domain Scan URL

URL: http://cbsi.force.com/CBSi/zdnetcommunityfaq
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: http://www.cbsinteractive.com/legal/cbsi/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/articles/FAQ/Privacy-Policy?categories=CBS_Interactive%3AmPrivacy&template=template_mobilePrivacy&referer=mobileprivacy.com&data=&cfs=default
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/articles/FAQ/mThird-Party-Social-Networking-Services?template=template_mobilepp&referer=mobilepp.com&data=&cfs=default
Title: Video Services Policy

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=new+%27unremovable%27+xhelper+malware+has+infected+45%2C000+android+devices&assettype=content_article&topicguid=&viewguid=fd535992-ecdd-4096-8d70-2d3ec6ec661d&docid=33161585&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fit-security-and-privacy-concerns-initiatives-and-predictions-techrepublic-premium%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&assetguid=1472dbfa-b22c-4455-9cb9-152ad86c58bb&q=&cval=33161585;2150&ttag=&bhid=
Title: IT security and privacy: Concerns, initiatives, and predictions (TechRepublic Premium)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/company/techrepublic-premium/
Title: TechRepublic Premium

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=new+%27unremovable%27+xhelper+malware+has+infected+45%2C000+android+devices&assettype=content_article&topicguid=&viewguid=fd535992-ecdd-4096-8d70-2d3ec6ec661d&docid=33167141&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fthe-4-benefits-of-vpn-elimination-german%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&assetguid=1472dbfa-b22c-4455-9cb9-152ad86c58bb&q=&cval=33167141;2150&ttag=&bhid=
Title: The 4 Benefits of VPN Elimination (German)

Search URL Search Domain Scan URL

URL: https://www.techrepublic.com/resource-library/company/akamai/
Title: Akamai

Search URL Search Domain Scan URL

URL: https://cbslnk.cbsileads.com/redir?edition=en&ursuid=&devicetype=desktop&pagetype=article&assettitle=new+%27unremovable%27+xhelper+malware+has+infected+45%2C000+android+devices&assettype=content_article&topicguid=&viewguid=fd535992-ecdd-4096-8d70-2d3ec6ec661d&docid=33167534&promo=2150&ftag_cd=LGN22ef1e6&spotname=right-rail&destUrl=https%3A%2F%2Fwww.techrepublic.com%2Fresource-library%2Fwhitepapers%2Fscaling-identity-management-to-ensure-customer-loyalty-program-success-four-case-studies-german%2F%3Fpromo%3D2150%26ftag%3DLGN22ef1e6%26cval%3Dright-rail%26source%3Dzdnet&ctag=medc-right-rail&siteId=2&rsid=cnetzdnetglobalsite&sl=en&sc=eu&assetguid=1472dbfa-b22c-4455-9cb9-152ad86c58bb&q=&cval=33167534;2150&ttag=&bhid=
Title: Scaling Identity Management to Ensure Customer Loyalty Program Success: Four Case Studies (German)

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pages/ZDNet/5953112932
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/zdnet
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/zdnet-com
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCr9QWb5RKLfaunjKHJZAdQQ
Title:

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/cookies
Title: Cookies

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/adchoice
Title: Ad Choice

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://legalterms.cbsinteractive.com/eula
Title: Mobile User Agreement

Search URL Search Domain Scan URL

URL: http://narratives.zdnet.com/
Title: Sponsored Narratives

Search URL Search Domain Scan URL

URL: https://cbsi.secure.force.com/CBSi/knowledgehome?referer=zdnet.com
Title: Site Assistance

Search URL Search Domain Scan URL

URL: https://academy.zdnet.com/
Title: ZDNet Academy

Search URL Search Domain Scan URL

URL: https://www.cbsinteractive.com/legal/cbsi/privacy-policy/cookies-and-beacons
Title: cookie policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 68

https://tags.bluekai.com/site/20486?limit=0&id=3605829230968963095&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3605829230968963095%26eid=50056 HTTP 302
https://ml314.com/csync.ashx?fp=sBdlmy9999OvoLO5&person_id=3605829230968963095&eid=50056

Request Chain 69

https://idsync.rlcdn.com/395886.gif?partner_uid=3605829230968963095 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNTgyOTIzMDk2ODk2MzA5NRAAGg0IzOyD7gUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=72746a8f1cc437d2afae6158766062a02c0cbc5fcffbed955471c91ce7ff5648f4cb09cee1a4f8eb&person_id=3605829230968963095&eid=50082

Request Chain 70

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605829230968963095%26eid=50220 HTTP 302
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605829230968963095%26eid=50220&mm_bnc&mm_bct&UUID=d4e85dc0-e7e2-4c00-97de-3d97482e0887 HTTP 302
https://ml314.com/csync.ashx?fp=d4e85dc0-e7e2-4c00-97de-3d97482e0887&person_id=3605829230968963095&eid=50220

Request Chain 71

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605829230968963095 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605829230968963095 HTTP 302
https://ml314.com/csync.ashx?fp=8e4230c9ce5e67f8c1cb62a2c328f66d&eid=50146&person_id=3605829230968963095

Request Chain 72

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2wG3OuheUFCxbfX6cK0jjHwurBL7XCt9fYIom3tIBL3A&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
https://ml314.com/csync.ashx?fp=2wG3OuheUFCxbfX6cK0jjHwurBL7XCt9fYIom3tIBL3A&person_id=3605829230968963095&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

Request Chain 73

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3605829230968963095&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605829230968963095&redir=

Request Chain 102

https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23ecid%3D__EFIMSORGID__%26google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
https://www.everestjs.net/static/pixel_details.html

Request Chain 138

https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1572927053254&ns_c=UTF-8&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1572927053254&ns_c=UTF-8&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&c9=

Request Chain 142

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/&rp=&ts=compact&rnd=1572927053257 HTTP 302
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/&rp=&ts=compact&rnd=1572927053257&ja=1

Request Chain 163

https://cm.everesttech.net/cm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGNEMlRRQUFBUHk1V1NzTA HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEJczk6uF_NBabt4BMxNNuV8&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 171

https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0 HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=TfbAXejHFauNmLAPgPS5-A8&random=595070135&sscte=1&crd=&gtd= HTTP 302
https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=595070135&crd=&is_vtc=1&random=1539513216 HTTP 302
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=595070135&crd=&is_vtc=1&random=1539513216&ipr=y

Request Chain 232

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 233

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 234

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

318 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/ 464 KB
107 KB 224ms
164ms Document
text/html 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6a8b69c61bdc6255b01f894c4e0a51538f60b9bb42818a0ca11ca03853fb1203

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.zdnet.com
:scheme: https
:path: /article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
expires: Tue, 05 Nov 2019 04:16:28 GMT
last-modified: Tue, 05 Nov 2019 02:46:28 GMT
cache-control: max-age=5400, private
server: nginx
content-type: text/html; charset=UTF-8
x-tx-id: a0bc03cf-0994-4a80-9e7a-7d8c02485b15
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://www.zdnet.com
content-encoding: gzip
accept-ranges: bytes
content-length: 108571
date: Tue, 05 Nov 2019 04:10:51 GMT
set-cookie: fly_device=desktop; expires=Tue, 12-Nov-2019 04:10:51 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "nl"}; expires=Tue, 12-Nov-2019 04:10:51 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
vary: Accept-Encoding, User-Agent
strict-transport-security: max-age=63072000; includeSubDomains; preload

GET
H2 200 main-b1848352da-rev.css
zdnet2.cbsistatic.com/fly/1839-fly/css/core/ 357 KB
65 KB 32ms
6ms Stylesheet
text/css 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

eabd13452c89bab44124b6608b8dc1c663fbe1ca26ee5f3a30a428a0d61f0e03

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29215
status: 200
vary: Accept-Encoding
content-length: 65694
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:25:17 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07b1d-59431"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:03:55 GMT

GET
H2 200 controls-3ff717d36c-rev.css
zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/ 41 KB
7 KB 31ms
6ms Stylesheet
text/css 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-3ff717d36c-rev.css

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

400ad64ef234d255a1c9ddd567bfe202d42bb7bd85a8efe6f366c2acc35ee470

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29213
status: 200
vary: Accept-Encoding
content-length: 6562
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:25:31 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07b2b-a53d"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:03:55 GMT

GET
H2 200 catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 910 B
1 KB 27ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
x-content-type-options: nosniff
nncoection: close
age: 3521723
status: 200
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 910
x-xss-protection: 1; mode=block
last-modified: Mon, 03 Sep 2018 02:32:23 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Sep 2020 09:53:51 GMT

GET
H2 200 android.png
zdnet3.cbsistatic.com/hub/i/2019/10/29/8869fe03-a3ba-4470-933d-e8088f9521ff/eded974f5eec0c5a83ecfa44bbdc232d/ 16 KB
15 KB 27ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/2019/10/29/8869fe03-a3ba-4470-933d-e8088f9521ff/eded974f5eec0c5a83ecfa44bbdc232d/android.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

72b5122d64e7b20a4a3c065686243a9a222f9c20bdb8eff347931b02172dd590

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 561582
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 14885
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"039b598aac0db8cf2c78f97f06efbdaa"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-11-53-27.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/02/693a6666-8a45-4d1f-b003-6a64fab150bd/thumbnail/170x128/500bbbd09ca802215d90cd24f0f9a99a/ 29 KB
29 KB 7ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/02/693a6666-8a45-4d1f-b003-6a64fab150bd/thumbnail/170x128/500bbbd09ca802215d90cd24f0f9a99a/screenshot-2019-07-02-at-11-53-27.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5c00c44eb252280eab2fe99bd3ba0bc33a133659b07a1dbc9c30011bfbf54724

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8735537
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 29120
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "2bc3900bff210b080e6bd19c10331244"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-12-04-41.png
zdnet1.cbsistatic.com/hub/i/r/2019/07/02/67bb04db-9222-41ae-8f5d-582a7e000aab/thumbnail/170x128/88875e6c5c4981991bf07f4a4b8731c4/ 47 KB
47 KB 32ms
6ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/07/02/67bb04db-9222-41ae-8f5d-582a7e000aab/thumbnail/170x128/88875e6c5c4981991bf07f4a4b8731c4/screenshot-2019-07-02-at-12-04-41.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

421efdd0c793078b4e6e63fdea8d184db42032cea9959a2db26bf2bef2422b1f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2947329
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 47980
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "2db6c70605a36497764d214c2a7b8347"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-12-10-24.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/02/4af61d77-2f2c-4405-9a74-cb59b5a9c34b/thumbnail/170x128/46fe046a62e79ccc85abdc22cfd5a0f5/ 27 KB
27 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/02/4af61d77-2f2c-4405-9a74-cb59b5a9c34b/thumbnail/170x128/46fe046a62e79ccc85abdc22cfd5a0f5/screenshot-2019-07-02-at-12-10-24.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

851db61c6e463cb49c776e1c5817454d56edfa53a5fb354c3c499189939abc1c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 622985
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 27441
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"93b5129e24b9c92e5b8e7115056b46bd"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-12-05-33.png
zdnet1.cbsistatic.com/hub/i/r/2019/07/02/e04b83ed-31c4-41ee-968d-907d45e67d9c/thumbnail/170x128/19f13bf10b1924a48289b8590a622f30/ 36 KB
36 KB 7ms
6ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/07/02/e04b83ed-31c4-41ee-968d-907d45e67d9c/thumbnail/170x128/19f13bf10b1924a48289b8590a622f30/screenshot-2019-07-02-at-12-05-33.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2e1484790717d965e7b6618ef9d72cc6061e637393d04fd78969314a42d033e5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 194934
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 37055
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "58d858ea57b83aa5edf16c4c2d67e5dd"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-12-06-32.png
zdnet1.cbsistatic.com/hub/i/r/2019/07/02/a33f5509-c158-4a85-a7c7-ef436657f505/thumbnail/170x128/db3e34d184762e8c54e4a65f1e7dd063/ 32 KB
32 KB 8ms
7ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/07/02/a33f5509-c158-4a85-a7c7-ef436657f505/thumbnail/170x128/db3e34d184762e8c54e4a65f1e7dd063/screenshot-2019-07-02-at-12-06-32.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

3900fe84624daa61bf04b4758e1cf6fc7192359f15782747e05631181e0514ad

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8461719
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 32619
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "4531d349d3269ac4f3e1d34864ba4bd6"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 require-2.1.2.js Show response
zdnet2.cbsistatic.com/fly/1839-fly/js/libs/ 16 KB
6 KB 10ms
10ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29215
status: 200
vary: Accept-Encoding
content-length: 6305
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:25:12 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07b18-3f09"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:03:55 GMT

GET
H2 200 evidon-sitenotice-tag.js Show response
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 69 KB
14 KB 7ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432953
status: 200
vary: Accept-Encoding
content-length: 13960
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:10:45 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ee45-1134e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Nov 2019 03:52:48 GMT

GET
H2 200 country.js Show response
c.evidon.com/geo/ 260 B
511 B 84ms
25ms Script
application/x-javascript 23.0.46.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/geo/country.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.0.46.190 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-0-46-190.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
last-modified: Wed, 30 May 2018 22:22:39 GMT
server: AkamaiNetStorage
status: 200
etag: "8d3bb7b8708f6911ebe937e111b09ec4:1527718959"
access-control-max-age: 86400
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
accept-ranges: bytes
access-control-allow-headers: *
content-length: 260

GET
H2 200 snthemes.js Show response
zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 94 KB
8 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/snthemes.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164491
status: 200
vary: Accept-Encoding
content-length: 7763
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:10:45 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ee45-177f3"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Nov 2019 06:29:19 GMT

GET
H2 200 settings.js Show response
zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/ 33 KB
2 KB 19ms
5ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/settings.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114786
status: 200
vary: Accept-Encoding
content-length: 1669
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:10:45 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ee45-828e"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Nov 2019 20:17:45 GMT

GET
DATA 200
OK truncated
/ 917 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 200 mag-white01.png
zdnet2.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/core/ 1 KB
1 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/core/mag-white01.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29214
status: 200
vary: Accept-Encoding
content-length: 936
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:20:35 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07a03-4f1"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:03:56 GMT

GET
H2 200 Raleway-Bold.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 51 KB
51 KB 35ms
23ms Font
font/woff2 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
x-content-type-options: nosniff
nncoection: close
age: 9626638
status: 200
vary: Accept-Encoding
content-length: 52212
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-cbf4"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
H2 200 Raleway-Regular.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
51 KB 23ms
11ms Font
font/woff2 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
x-content-type-options: nosniff
age: 9080812
status: 200
vary: Accept-Encoding
content-length: 51572
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jul 2019 16:01:41 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d35dde5-c974"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Jul 2020 01:11:57 GMT

GET
H2 200 Raleway-Light.woff2
zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 50 KB
51 KB 34ms
23ms Font
font/woff2 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
x-content-type-options: nosniff
age: 9626637
status: 200
vary: Accept-Encoding
content-length: 51608
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Jul 2019 08:38:39 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5d2d8d0f-c998"
strict-transport-security: max-age=31536000
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jul 2020 18:06:51 GMT

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 en.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/ 311 KB
14 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/translations/en.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85430
status: 200
vary: Accept-Encoding
content-length: 14353
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:32 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef28-4ddff"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 04:27:00 GMT

GET
H2 200 logo.png
zdnet3.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/core/ 4 KB
4 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/core/logo.png

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29214
status: 200
vary: Accept-Encoding
content-length: 4128
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:20:35 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07a03-1009"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:03:56 GMT

GET
H2 200 main.default.js Show response
zdnet3.cbsistatic.com/fly/1839-fly/js/ 209 KB
69 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7b2cbf83bc5a9e6f3bd77976605dad88ef15387ff83d5850da1df2e611af6936

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29215
status: 200
vary: Accept-Encoding
content-length: 70809
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:25:14 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07b1a-34353"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:03:56 GMT

GET
H2 200 vendorlist.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 113 KB
51 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/vendorlist.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 257407
status: 200
vary: Accept-Encoding
content-length: 52305
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:32 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef28-1c3b9"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Nov 2019 04:40:37 GMT

GET
H2 200 urs.js Show response
urs.zdnet.com/sdk/ 50 KB
50 KB 304ms
118ms Script
application/javascript 35.190.38.167
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://urs.zdnet.com/sdk/urs.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.38.167 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 167.38.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
via: 1.1 google
last-modified: Thu, 07 Feb 2019 14:05:56 GMT
etag: "5c5c3b44-c7f5"
content-type: application/javascript
status: 200
accept-ranges: bytes
alt-svc: clear
content-length: 51189

GET
H/1.1 200
OK ls-zdnet.js Show response
js-sec.indexww.com/ht/ 94 KB
29 KB 91ms
32ms Script
text/javascript 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72d17955a9639827785e752152d5641881e5c9781a5ed2069e871af0f0b5a619

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Nov 2019 03:15:38 GMT
Server: Apache
ETag: "76249b-176c0-59690d8ac3fcc"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=379
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 29092
Expires: Tue, 05 Nov 2019 04:17:10 GMT

GET
H/1.1 200
OK YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response
c.go-mpulse.net/boomerang/ Frame 7922 187 KB
55 KB 30ms
16ms Script
application/javascript 2a02:26f0:6c00:19c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/javascript;charset=UTF-8
Cache-Control: max-age=604800, s-maxage=604800
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Timing-Allow-Origin: *

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 49 KB
16 KB 83ms
33ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

a15e125b5fca0c237c1cc2ae74a65a0b1a6e00c62f72e875cfe71a9a0aa86d77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "327 / 760 of 1000 / last-modified: 1572905287"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15505
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:51 GMT

GET
H2 200 sfp.js Show response
native.sharethrough.com/assets/ 426 KB
120 KB 146ms
58ms Script
application/javascript 13.224.196.129
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/sfp.js
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.196.129 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-196-129.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d88f11d103fbc604d33c9256841bfe44efd57dc9d162d3389d0c4408a5beb813

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Wed, 30 Oct 2019 20:55:28 GMT
content-encoding: gzip
last-modified: Wed, 30 Oct 2019 19:33:26 GMT
server: AmazonS3
age: 1756
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=3600
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: siXcWSAbOD-K3bpQI2yk12f7uKbkqyYkDaSPSxM1vMOr_g-KZrimgA==
via: 1.1 eb83e7e264681d87a86c9b6a2159e502.cloudfront.net (CloudFront)
expires: Wed, 30 Oct 2019 20:33:24 GMT

GET
H2 200 evidon-banner.js Show response
zdnet2.cbsistatic.com/fly/js/libs/evidon/ 8 KB
2 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/libs/evidon/evidon-banner.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/libs/evidon/evidon-sitenotice-tag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 94429
status: 200
vary: Accept-Encoding
content-length: 2440
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:29 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef25-1faf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 01:56:35 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/8/1/2/2/ 0
120 B 394ms
131ms Image
text/plain 3.226.5.56
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/8/1/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.5.56 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-226-5-56.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

status: 204
date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 ;ord=1572927051858
ad.doubleclick.net/ddm/ad/qqecvfsz/zd/ 43 B
205 B 34ms
33ms Image
image/gif 172.217.21.230
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/ad/qqecvfsz/zd/;ord=1572927051858?

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.230 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s13-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 scrolling-mpu-22779a851e-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 956 B
603 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/scrolling-mpu-22779a851e-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 474581
status: 200
vary: Accept-Encoding
content-length: 491
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 10:21:21 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5db96421-3bc"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Nov 2019 16:21:10 GMT

GET
H2 204 18863
l.betrad.com/site/v3/425/3445/8/4/2/2/ 0
120 B 355ms
131ms Image
text/plain 3.226.5.56
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/425/3445/8/4/2/2/18863?consent=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.5.56 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-226-5-56.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

status: 204
date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 93 KB
19 KB 136ms
31ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8DD6) /
Resource Hash: 64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
last-modified: Mon, 16 Sep 2019 18:11:12 GMT
server: ECAcc (lha/8DD6)
etag: "4063075910"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=300
accept-ranges: bytes
content-length: 19393
expires: Tue, 05 Nov 2019 04:15:52 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ Frame 7922 2 KB
1 KB 31ms
18ms XHR
application/json 2a02:26f0:6c00:19c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5243090&v=1.571.0&if=&sl=0&si=p4vpgjjexa8-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by: Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 07aa330f5c10904e0bc406c5be65525f91ce2a206aeba9b897d1f51de18ef00d

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 697

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
536 B 116ms
34ms XHR
application/json 52.49.153.216
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.153.216 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 085d7156ad033537ba51a23a501d431af91f34721bbcd419ce7a314b2fdaafc6

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
x-aspnet-version: 4.0.30319
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.zdnet.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Thu, 05 Dec 2019 04:10:52 GMT

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 109 B
717 B 63ms
17ms Script
application/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
319 B 15ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019103101.js Show response
securepubads.g.doubleclick.net/gpt/ 159 KB
58 KB 35ms
35ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019103101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

e4ab34b8a905b1076f36fddd2dc1e2dacd9c1bbca6614ab260e9b40aa0dced41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 31 Oct 2019 13:10:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 59272
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:51 GMT

GET
H/1.1 200
OK isInternalUser.js Show response
iicbsi-a.akamaihd.net/common/js/esi/ 22 B
272 B 172ms
6ms Script
application/x-javascript 2a01:4a0:1338:28::c38a:ff18
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to

Full URL: https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff18 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Cache-Control: max-age=120448
Server: AkamaiNetStorage
Connection: keep-alive
ETag: "fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length: 22
Content-Type: application/x-javascript

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
28 KB 62ms
25ms Script
text/javascript 2606:4700::6810:a10d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1238229
cf-ray: 530bfafbddcd59e8-VIE
status: 200
content-length: 27746
x-amz-id-2: XaZZfksc5tY2QYKqWg2l9SF0g4tYYLB4/OoiMCVw8qhEZI1HOeFOpmyjOyB6h9h9/hQcx65+CBU=
last-modified: Mon, 21 Oct 2019 20:13:23 GMT
server: cloudflare
etag: "df893ab92782cedac4da4785df9ec68e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: CED68FA43CA7DB4B
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Tue, 05 Nov 2019 04:40:52 GMT

GET
H2 200 utag.1779.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 3 KB
2 KB 33ms
32ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D1E) /
Resource Hash: cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:57 GMT
server: ECAcc (lha/8D1E)
etag: "392561602+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1785
expires: Wed, 20 Nov 2019 04:10:51 GMT

GET
H2 200 utag.1782.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 37ms
36ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D27) /
Resource Hash: 791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:49 GMT
content-encoding: gzip
last-modified: Mon, 29 Oct 2018 17:20:42 GMT
server: ECAcc (lha/8D27)
etag: "3447796852"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1071
expires: Wed, 20 Nov 2019 04:10:49 GMT

GET
H2 200 utag.1787.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 142 KB
48 KB 37ms
37ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8DDB) /
Resource Hash: 95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
last-modified: Wed, 04 Sep 2019 18:05:01 GMT
server: ECAcc (lha/8DDB)
etag: "3504427907+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 48569
expires: Wed, 20 Nov 2019 04:10:52 GMT

GET
H2 200 utag.1790.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
962 B 54ms
53ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D3E) /
Resource Hash: 10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (lha/8D3E)
etag: "2267415266+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 872
expires: Wed, 20 Nov 2019 04:10:52 GMT

GET
H2 200 utag.1791.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 54ms
53ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D32) /
Resource Hash: 7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
last-modified: Mon, 01 Aug 2016 14:31:10 GMT
server: ECAcc (lha/8D32)
etag: "3334871598"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1196
expires: Wed, 20 Nov 2019 04:10:52 GMT

GET
H2 200 utag.1792.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 4 KB
2 KB 55ms
54ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D1A) /
Resource Hash: dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:31 GMT
content-encoding: gzip
last-modified: Thu, 28 Jul 2016 14:28:47 GMT
server: ECAcc (lha/8D1A)
etag: "2022868805"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1664
expires: Wed, 20 Nov 2019 04:10:31 GMT

GET
H2 200 utag.1797.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
972 B 54ms
54ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8C89) /
Resource Hash: 3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
last-modified: Wed, 25 Jan 2017 20:07:58 GMT
server: ECAcc (lha/8C89)
etag: "1907756232+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 883
expires: Wed, 20 Nov 2019 04:10:52 GMT

GET
H2 200 lightbox.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 20FF 326 B
548 B 59ms
18ms Script
application/javascript 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1572927052128&lv=1
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5d0219878301d5c9146fb6edf607c2280f4f1c35911fa39d02dfa6819e2e9cc6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 295259
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cf-ray: 530bfafc1bd459ee-VIE

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 36ms
36ms Script
application/javascript 52.31.106.135
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?5102019
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:51 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Nov 2019 07:40:05 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=12553
Connection: keep-alive
Content-Length: 11932
Expires: Tue, 05 Nov 2019 07:40:05 GMT

GET
H/1.1 200
OK anonc.js Show response
dw.cbsi.com/ 73 B
620 B 646ms
163ms Script
application/javascript 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/anonc.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: 674d00d92cf08fa16978688fefab65a323e15aa4e075bba6584393a0d49ba1f1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Apache/2.4.25
Etag: GksdB13A9kxxhdXg7PU.1.dw_anonc
P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control: private, max-age=43200, s-max-age=0
Connection: Keep-Alive
Content-Type: application/javascript
Keep-Alive: timeout=80, max=773
Content-Length: 73
Expires: Mon, 05 Jan 1970 12:12:12 GMT

GET
H2 200 article-9a9082bd56-rev.js Show response
zdnet4.cbsistatic.com/fly/js/pages/ 160 KB
45 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/pages/article-9a9082bd56-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

dcf3f2a13f83e47224020dd0090285204819f22ad0bc72432d53d37411e90542

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 493691
status: 200
vary: Accept-Encoding
content-length: 45893
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 10:21:30 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9642a-28022"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Nov 2019 11:02:38 GMT

GET
H/1.1 200
OK ds.js Show response
dw.cbsi.com/js/cbsi/ 18 KB
7 KB 645ms
161ms Script
application/javascript 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://dw.cbsi.com/js/cbsi/ds.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Sep 2017 19:06:40 GMT
Server: Apache/2.4.25
ETag: "1917-55916dc13f000"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200, s-maxage=1800
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=452
Content-Length: 6423
Expires: Tue, 05 Nov 2019 04:40:52 GMT

GET
H2 200 cbsinteractive.js Show response
tru.am/scripts/custom/ 3 KB
1 KB 250ms
206ms Script
text/javascript 2606:4700:20::6819:a222
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/custom/cbsinteractive.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: br
cf-cache-status: MISS
x-guploader-uploadid: AEnB2UpCnIJqjxhNFF84Bm43jAiCvzrgdBmk5QvVN0UzQiae8WhAgO3w5orI6PkZ3GZcebq0trDhjySwhL7VpxTKKZcjsUDQFQ
x-goog-storage-class: REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: text/javascript
last-modified: Tue, 30 Apr 2019 19:32:26 GMT
server: cloudflare
etag: W/"c486c91d1321adf59073588524182108"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=9gbW7g==, md5=xIbJHRMhrfWQc1iFJBghCA==
x-goog-generation: 1556652746634603
cache-control: public, max-age=86400
x-goog-stored-content-length: 2725
cf-ray: 530bfafc5960cb98-VIE
expires: Wed, 06 Nov 2019 04:10:52 GMT

GET
H/1.1 200
OK st.v3.js Show response
www.everestjs.net/static/ 25 KB
8 KB 79ms
25ms Script
application/x-javascript 184.31.90.90
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/st.v3.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-90.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 364efc68e57240e144c1334b7b4e77dcac0dc65d71777b38992f6cd8ffc67b73

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Nov 2019 14:50:09 GMT
Server: Apache
ETag: "1ff0663-64fd-596866ea656d9"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=38508
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7335
Expires: Tue, 05 Nov 2019 14:52:40 GMT

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
265 B 23ms
23ms Image
image/gif 2606:4700::6810:a10d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=1&rn=0.331655468501308
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
cf-cache-status: HIT
age: 12
cf-ray: 530bfafc2ddf59e8-VIE
status: 200
content-length: 43
x-amz-id-2: pUIcNHuEITwITJAFv0zf1eMWqWeJVfzBeFeZF51cZGt5vvArCq3oVjQ/5N6crQW0Hv3Wnj02BRA=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 8D4FAEC87454B7B3
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-type: image/gif

GET
H2 200 pixel.gif
cdn.viglink.com/images/ 43 B
103 B 24ms
24ms Image
image/gif 2606:4700::6810:a10d
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.viglink.com/images/pixel.gif?ch=2&rn=0.331655468501308
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
cf-cache-status: HIT
age: 12
cf-ray: 530bfafc2de159e8-VIE
status: 200
content-length: 43
x-amz-id-2: pUIcNHuEITwITJAFv0zf1eMWqWeJVfzBeFeZF51cZGt5vvArCq3oVjQ/5N6crQW0Hv3Wnj02BRA=
last-modified: Tue, 10 Feb 2015 03:29:39 GMT
server: cloudflare
etag: "221d8352905f2c38b3cb2bd191d630b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: 8D4FAEC87454B7B3
cache-control: max-age=15, must-revalidate
accept-ranges: bytes
content-type: image/gif

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 906 B
1 KB 37ms
36ms Script
application/javascript 52.31.106.135
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&pv=1572927052181_a60lq7h01&bl=en-us&cb=6065515&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1572927052181_a60lq7h01&cid=fd535992-ecdd-4096-8d70-2d3ec6ec661d&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?5102019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 86c1e3a3815c655210d29f99125ec6713834bb81959193dd7126c60466c029d7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:51 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 521
Expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 20 B
698 B 611ms
216ms Script
application/javascript 3.220.21.104
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=5102019
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?5102019
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.21.104 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-3-220-21-104.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:51 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 138
Expires: Wed, 06 Nov 2019 04:10:52 GMT

GET
H2 200 CBSI-PLAYER.js Show response
vidtech.cbsinteractive.com/uvpjs/0.42.297/ 1 MB
281 KB 91ms
30ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
age: 3355657
x-cache: HIT, HIT
status: 200
content-length: 286838
x-amz-id-2: eFLdg4aPXUFc7W4j8Nhh9UdduMDflMLRIufQ6v/Vh6+pWt+vfGcNnF3gpKRr47exsFfoiPpv1MY=
x-served-by: cache-dca17783-DCA, cache-fra19126-FRA
last-modified: Fri, 01 Feb 2019 18:20:56 GMT
server: AmazonS3
x-timer: S1572927052.272157,VS0,VE2
etag: "eb5dd4ed3dcb7641ebbcb604d7ddb038"
vary: Accept-Encoding
x-amz-request-id: F767A360D0453B01
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=2592000
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 3, 4

GET
H2 200 user.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 20FF 768 KB
125 KB 20ms
19ms Script
application/javascript 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1572927052128&lv=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ca9514d24bc9ec9dbaa3388d9343c33edd1e23a50f2398ef0da0ad840ddba4d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: QGI93J0qMrMuEMviunZmAw==
age: 295259
cf-polished: origSize=1208281
status: 200
last-modified: Fri, 01 Nov 2019 18:09:52 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: d651ecb9-b01e-00b7-32df-905ac4000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 530bfafc4be259ee-VIE
expires: Wed, 04 Nov 2020 04:10:52 GMT

GET
H2 200 chartbeat.js Show response
static.chartbeat.com/js/ 35 KB
14 KB 23ms
7ms Script
application/x-javascript 2600:9000:2156:fc00:18:1fcd:349:ca21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:fc00:18:1fcd:349:ca21 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 02:24:35 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 02:24:02 GMT
server: nginx
age: 6377
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: JzwsBkyO6quwITW0ns8DNiQ22tz1awRlgBXWANe996SEIrv-hoRSHw==
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
expires: Tue, 05 Nov 2019 04:24:35 GMT

GET
H2 200 mpulse-1.0.2.js Show response
zdnet1.cbsistatic.com/fly/js/libs/ 12 KB
5 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309075
status: 200
vary: Accept-Encoding
content-length: 4877
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:34 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef2a-2fdf"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Nov 2019 14:19:35 GMT

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/v2/ 2 KB
1 KB 19ms
19ms XHR
application/json 2a02:26f0:6c00:19c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1572927052216&s=30355ad29c9e18b51e65d3f5adcf2122f563fa3f1708548bcf83f3fb630e0c74
Requested by: Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: c014ecce43faaf9ff5d5f6d08944fc14ea434f5bbc423151d3bd158790daa91b

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 743

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://tags.bluekai.com/site/20486?limit=0&id=3605829230968963095&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3605829230968963095%26eid=50056
https://ml314.com/csync.ashx?fp=sBdlmy9999OvoLO5&person_id=3605829230968963095&eid=50056

43 B
312 B

66ms
33ms

Image
image/gif

52.31.106.135
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=sBdlmy9999OvoLO5&person_id=3605829230968963095&eid=50056
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 05 Nov 2019 23:10:52 GMT

Redirect headers

Location: https://ml314.com/csync.ashx?fp=sBdlmy9999OvoLO5&person_id=3605829230968963095&eid=50056
Date: Tue, 05 Nov 2019 04:10:52 GMT
Connection: keep-alive
Content-Length: 0
BK-Server: 483f
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3605829230968963095
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYwNTgyOTIzMDk2ODk2MzA5NRAAGg0IzOyD7gUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=72746a8f1cc437d2afae6158766062a02c0cbc5fcffbed955471c91ce7ff5648f4cb09cee1a4f8eb&person_id=3605829230968963095&eid=50082

43 B
312 B

41ms
40ms

Image
image/gif

52.31.106.135
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=72746a8f1cc437d2afae6158766062a02c0cbc5fcffbed955471c91ce7ff5648f4cb09cee1a4f8eb&person_id=3605829230968963095&eid=50082
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 05 Nov 2019 23:10:52 GMT

Redirect headers

date: Tue, 05 Nov 2019 04:10:52 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=72746a8f1cc437d2afae6158766062a02c0cbc5fcffbed955471c91ce7ff5648f4cb09cee1a4f8eb&person_id=3605829230968963095&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605829230968963095%26eid=50220
https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3605829230968963095%26eid=50220&mm_bnc&mm_bct&UUID=d4e85dc0-e7e2-4c00-97de-3d97482e0887
https://ml314.com/csync.ashx?fp=d4e85dc0-e7e2-4c00-97de-3d97482e0887&person_id=3605829230968963095&eid=50220

43 B
312 B

36ms
35ms

Image
image/gif

52.31.106.135
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=d4e85dc0-e7e2-4c00-97de-3d97482e0887&person_id=3605829230968963095&eid=50220
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 05 Nov 2019 23:10:52 GMT

Redirect headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: MT3 1854 1adf9ae master cdg-pixel-x20
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://ml314.com/csync.ashx?fp=d4e85dc0-e7e2-4c00-97de-3d97482e0887&person_id=3605829230968963095&eid=50220
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Tue, 05 Nov 2019 04:10:51 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605829230968963095
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3605829230968963095
https://ml314.com/csync.ashx?fp=8e4230c9ce5e67f8c1cb62a2c328f66d&eid=50146&person_id=3605829230968963095

43 B
312 B

67ms
37ms

Image
image/gif

52.31.106.135
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=8e4230c9ce5e67f8c1cb62a2c328f66d&eid=50146&person_id=3605829230968963095
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.106.135 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-31-106-135.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 05 Nov 2019 23:10:52 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:52 GMT
P3P: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location: https://ml314.com/csync.ashx?fp=8e4230c9ce5e67f8c1cb62a2c328f66d&eid=50146&person_id=3605829230968963095
Cache-Control: no-cache
X-Server: 10.45.5.197
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2wG3OuheUFCxbfX6cK0jjHwurBL7XCt9fYIom3tIBL3A&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
https://ml314.com/csync.ashx?fp=2wG3OuheUFCxbfX6cK0jjHwurBL7XCt9fYIom3tIBL3A&person_id=3605829230968963095&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil

70 B
171 B

30ms
29ms

Image
image/gif

18.197.145.83
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.197.145.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-197-145-83.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Content-Length: 70
Content-Type: image/gif

Redirect headers

Date: Tue, 05 Nov 2019 04:10:51 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control: private
Connection: keep-alive
Content-Length: 168
Expires: Tue, 05 Nov 2019 23:10:52 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3605829230968963095&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605829230968963095&redir=

42 B
873 B

39ms
38ms

Image
image/gif

52.18.181.107
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605829230968963095&redir=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.18.181.107 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-18-181-107.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v050-015c0469e.edge-irl1.demdex.com 5.62.0.20191030104901 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: vTxt1W1rREM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: T55VmXIZRX0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3605829230968963095&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 397ms
130ms Image
image/gif 54.87.95.71
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=zdnet.com&p=%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&u=C70jSDB7BNcNr9L5y&d=zdnet.com&g=65713&g0=security&g1=catalin%20cimpanu&n=1&f=00001&c=0&x=0&m=0&y=5332&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=973&t=OsYzYCW1NUyCeuNbuBZdhR9DZexFL&V=118&i=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&tz=-60&_acct=anon&sn=1&sv=DyqQ1uDBDVLz41i9MDscATfDC7wuR&sd=1&im=067b2ff3&_
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.87.95.71 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-87-95-71.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Tue, 05 Nov 2019 04:10:52 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 fb_lightbox.2.1.5.css
www.lightboxcdn.com/static/ 4 KB
1 KB 16ms
16ms Stylesheet
text/css 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/static/fb_lightbox.2.1.5.css?cb=637082285918091960
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: q4B4xYJoZwx9ikt94o1nCA==
age: 295256
cf-polished: origSize=6016
x-ms-meta-cbmodifiedtime: Wed, 10 Apr 2019 18:50:43 GMT
status: 200
last-modified: Wed, 10 Apr 2019 19:06:17 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-ms-request-id: d3b67eed-e01e-0027-01df-90cf88000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 530bfafccbf959ee-VIE
expires: Wed, 04 Nov 2020 04:10:52 GMT

GET
H2 200 ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame EA43 0
0 17ms
17ms Document
text/html 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637082285918091960
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.lightboxcdn.com
:scheme: https
:path: /lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=637082285918091960
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
cookie: __cfduid=d910c070045790d91e5d3de858aa4dabf1572927052
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 200
date: Tue, 05 Nov 2019 04:10:52 GMT
content-type: text/html
content-md5: xa1/rdPe0J6SwxlD7atkzw==
last-modified: Fri, 01 Nov 2019 18:09:51 GMT
x-ms-request-id: 4f3a6a52-b01e-0059-60e6-905047000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
cf-cache-status: HIT
age: 292168
expires: Wed, 04 Nov 2020 04:10:52 GMT
cache-control: public, max-age=31536000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 530bfafcdbfc59ee-VIE
content-encoding: br

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
256 B 15ms
15ms Image
image/gif 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1572927052281&h=www.zdnet.com&e=p&u=40913
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Nov 2019 04:10:52 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 335375
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 530bfafccbfb59ee-VIE
cf-bgj: imgq:85

GET
H2 200 ta-pagesocial-sdk.js Show response
tru.am/scripts/ 35 KB
12 KB 22ms
22ms Script
application/javascript 2606:4700:20::6819:a222
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by: Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a222 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 18 Apr 2019 03:51:14 GMT
server: cloudflare
age: 6562
etag: W/"942d5ae1e512ccdf18813550428dd002"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
cf-ray: 530bfafdaba5cb98-VIE
expires: Wed, 06 Nov 2019 04:10:52 GMT

GET
H/1.1 200
OK z Show response
lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/ 339 B
583 B 555ms
126ms Script
application/javascript 23.99.128.52
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://lightboxapi1.azurewebsites.net/z9l/40913/www.zdnet.com/jsonp/z?cb=1572927052431&callback=jQuery1710544235991152415_1572927052276&_=1572927052432
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS: waws-prod-dm1-001.cloudapp.net
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 9b728c06afa13ff6065ff54b31d3346ee4cfac00b8caca260c8051a302699157

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Content-Length: 370
Vary: Accept-Encoding
Content-Type: application/javascript

GET
H2 200 z.gif Show response
api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PQAONEMATlQRZD0MDlgA... 182 B
575 B 45ms
16ms XHR
application/javascript 2606:4700::6810:4ea5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://api1.lightboxcdn.com/z9u/LIewXglgNlCGD0BWAdABgAQApiwMYQDsAXEAZwAsBudASWIFMp0dd0B5AZXQA10BGVAH0-AFkGIAlOgCCAB1lR6AdXoAjANIQiSAMwB2ZDoBsWdQAkAKsAAyAGnRQIAa3roA4vVxOQUgMLkAJxAAW3p4PQAONEMATlQRZD0MDlgAM1gAiF0DYyA_XZX/z.gif
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4ea5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 73438a77c4b5ef6bdfdb761e8d4e86ac508540b890d01cc5bc556bd381c44f4b

Request headers

Accept: */*
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
content-encoding: br
cf-cache-status: HIT
age: 64039
x-powered-by: ASP.NET
status: 200
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin,Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
access-control-allow-credentials: true
cf-ray: 530bfafde928cbb4-VIE
expires: Wed, 06 Nov 2019 04:10:52 GMT

POST
H2 200 beacon Show response
beacon.tru.am/ 0
351 B 187ms
145ms Fetch 2606:4700:20::6819:a322
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.tru.am/beacon
Requested by: Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:52 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, private, max-age=0
cf-ray: 530bfafe197acbb0-VIE
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H/1.1 200
OK ping Show response
api.viglink.com/api/ 266 B
946 B 170ms
44ms XHR
text/javascript 34.246.252.247
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/ping
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: f61ef6a6d7b1cb3221909bd196c8cdbb0694cfcb6fedb8ccd40a0a2f959e811a

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 266
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content / Show response
684dd306.akstat.io/ 0
354 B 62ms
18ms XHR
image/gif 2a02:26f0:6c00:19c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://684dd306.akstat.io/?h.pg=article&when=1572927052694&t_other=custom4%7C268&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=f9af33161f3b2409cce22c62f02ccd99c48a8093&h.t=1572927052224&http.initiator=api&rt.start=api&rt.si=944c657f-7372-44cf-8cf8-f6e1f6d01355&rt.ss=1572927053148&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1

Requested by

Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:52 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Tue, 05 Nov 2019 04:10:52 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 41ms
41ms XHR
application/json 52.18.181.107
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1572927052818

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.18.181.107 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-18-181-107.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f55a9877ce7f6c4513f552c7e01fb4dbd98d3e7ef2513a479a9b91933b7dbe7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v050-04890d7df.edge-irl1.demdex.com 5.62.0.20191030104901 4ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: STGvxzjcTbI=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 673
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
117 B 33ms
33ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201909161811&cb=1572927052819
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D6F) /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:52 GMT
last-modified: Thu, 14 Apr 2016 16:59:33 GMT
server: ECAcc (lha/8D6F)
etag: "2243872957"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Tue, 05 Nov 2019 04:20:52 GMT

GET
H/1.1 200
OK c.gif
dw.cbsi.com/clear/ 42 B
346 B 162ms
162ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=1472dbfa-b22c-4455-9cb9-152ad86c58bb&assettitle=new%20%27unremovable%27%20xhelper%20malware%20has%20infected%2045%2C000%20android%20devices&assettype=content_article&pubdate=2019-10-29%2016%3A05%3A00&viewguid=fd535992-ecdd-4096-8d70-2d3ec6ec661d&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1572927052822&ld=www.zdnet.com&ldc=ac895b87-0cc2-4f90-b121-d05306619792&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=GksdB13A9kxxhdXg7PU&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&title=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Keep-Alive: timeout=80, max=444
Content-Length: 42
Expires: Mon, 05 Jan 1970 12:12:12 GMT

GET
H/1.1 200
OK Cookie set dest5.html
cbsi.demdex.net/ Frame 7273 0
0 147ms
36ms Document
text/html 54.154.151.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cbsi.demdex.net/dest5.html?d_nsid=undefined

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-154-151-160.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: cbsi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=72674303528070863893467454340398013869
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 30 Oct 2019 17:32:50 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=72674303528070863893467454340398013869;Path=/;Domain=.demdex.net;Expires=Sun, 03-May-2020 04:10:53 GMT;Max-Age=15552000
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: 6YVRy0DmSSI=
Content-Length: 2764
Connection: keep-alive

GET
H2 200 id Show response
saa.cbsi.com/ 90 B
625 B 126ms
33ms XHR
application/x-javascript 15.188.105.205
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=72453281799470152453479406370189777109&ts=1572927052917

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

deb156323ff45dd4d2fd6d7a7a869191648188c38cc84287a1d2cf35b8f71e47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Tue, 05 Nov 2019 04:10:52 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-d76fdf885-q9qm8
vary: Origin
x-c: master-1058.I94f02a.M0-309
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript
content-length: 90
x-xss-protection: 1; mode=block

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 94 B
539 B 42ms
42ms XHR
text/javascript 34.246.252.247
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: b57ee8f5b83ee0d2418749b371907a745258bafb6a40e8e121f41f7b1828abe0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 94
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 2 KB
1 KB 42ms
41ms XHR
application/json 52.18.181.107
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=72453281799470152453479406370189777109&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012EE07B2685158000-4018A8E1223DCFE6&ts=1572927053045

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.18.181.107 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-18-181-107.eu-west-1.compute.amazonaws.com

Software

Resource Hash

0adb41e12db27b18dbc4cd98dc3d219f64627810ffa357e4ebae1e71557b2afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v050-043d9b703.edge-irl1.demdex.com 5.62.0.20191030104901 6ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: ffKgzTBjQ/A=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 672
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 66 B
749 B 85ms
32ms XHR
text/javascript 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A78702761%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%228d5f8ad2-e38e-4108-89cc-b10bfd496b3d%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-11-05T04%3A10%3A52%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3e8aea095e2ff8138df7d80ad638bfd1f8ccb0e1337dd14da442f10c57216dbf

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 86
Expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
682 B 18ms
18ms XHR
text/html 185.33.223.215
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=7KayLdfU&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:55 GMT
X-Proxy-Origin: 109.236.94.21; 109.236.94.21; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.145:80
AN-X-Request-Uuid: 6f88a50d-1531-480d-8f98-a9853d8bf7ca
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
681 B 37ms
18ms XHR
text/html 185.33.223.215
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=cRXGbLEg&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:55 GMT
X-Proxy-Origin: 109.236.94.21; 109.236.94.21; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.10:80
AN-X-Request-Uuid: 0e96c479-b5eb-469d-be0b-95837effbc42
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
681 B 55ms
19ms XHR
text/html 185.33.223.215
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=vOq8svRV&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:55 GMT
X-Proxy-Origin: 109.236.94.21; 109.236.94.21; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.56:80
AN-X-Request-Uuid: 8d7ea19c-fde6-49af-abec-d812bcf5576f
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
682 B 54ms
19ms XHR
text/html 185.33.223.215
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=OsgNdAhG&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:55 GMT
X-Proxy-Origin: 109.236.94.21; 109.236.94.21; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.139:80
AN-X-Request-Uuid: 24a1877f-3f78-4ad8-b369-5e7bd0684154
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
682 B 55ms
19ms XHR
text/html 185.33.223.215
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=1drKmHNB&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.215 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

315.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:55 GMT
X-Proxy-Origin: 109.236.94.21; 109.236.94.21; 315.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.244:80
AN-X-Request-Uuid: 295fc625-f4c2-42bb-9d84-f587e149c35b
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 utag.1775.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 26 KB
9 KB 35ms
34ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D39) /
Resource Hash: 0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:58 GMT
content-encoding: gzip
last-modified: Thu, 10 Nov 2016 20:41:55 GMT
server: ECAcc (lha/8D39)
etag: "1112944691+gzip"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 8960
expires: Wed, 20 Nov 2019 04:10:58 GMT

GET
H2 200 utag.277.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
948 B 35ms
35ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8C8C) /
Resource Hash: 0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:51 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:58 GMT
server: ECAcc (lha/8C8C)
etag: "461771432"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 863
expires: Wed, 20 Nov 2019 04:10:51 GMT

GET
H2 200 utag.1772.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 36ms
36ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8C8B) /
Resource Hash: e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:59 GMT
content-encoding: gzip
last-modified: Mon, 11 Jul 2016 20:43:58 GMT
server: ECAcc (lha/8C8B)
etag: "4198895974"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 959
expires: Wed, 20 Nov 2019 04:10:59 GMT

GET
H2 200 utag.1796.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 8 KB
3 KB 35ms
35ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8DB7) /
Resource Hash: 9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:44 GMT
content-encoding: gzip
last-modified: Mon, 28 Nov 2016 15:09:53 GMT
server: ECAcc (lha/8DB7)
etag: "931235332"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 2762
expires: Wed, 20 Nov 2019 04:10:44 GMT

GET
H2 200 utag.1810.js Show response
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 2 KB
1 KB 35ms
35ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (lha/8D07) /
Resource Hash: 07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
last-modified: Mon, 08 Jul 2019 17:22:10 GMT
server: ECAcc (lha/8D07)
etag: "4274102907"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 988
expires: Wed, 20 Nov 2019 04:10:53 GMT

GET
H/1.1

200
OK

pixel_details.html
www.everestjs.net/static/ Frame B740
Redirect Chain

https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23ecid%3D__EFIMSORGID__%26google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__E...
https://www.everestjs.net/static/pixel_details.html

0
0

26ms
26ms

Document
text/html

184.31.90.90
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/static/pixel_details.html
Requested by: Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-90.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: www.everestjs.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

Server: Apache
Last-Modified: Tue, 04 Oct 2011 16:14:21 GMT
ETag: "8623-a6-4ae7b62583140"
Accept-Ranges: bytes
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 146
Cache-Control: max-age=70195
Expires: Tue, 05 Nov 2019 23:40:48 GMT
Date: Tue, 05 Nov 2019 04:10:53 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Server: Apache
Set-Cookie: everest_session_v2=XcD2TQAAAPy5WSsL; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XcD2TQAAAPy5WSsL; path=/; domain=.everesttech.net; expires=Wed, 29-Sep-2021 14:50:53 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: https://www.everestjs.net/static/pixel_details.html#ecid=__EFIMSORGID__&google=XcD2TQAAAPy5WSsL&gsurfer=XcD2TQAAAPy5WSsL&optout=0&throttleCookie=&time=20191105041053
Content-Length: 369
Keep-Alive: timeout=15, max=990329
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Cookie set dest5.html
cbsi.demdex.net/ Frame 15C8 0
0 37ms
37ms Document
text/html 54.154.151.160
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cbsi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-154-151-160.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: cbsi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Accept-Encoding: gzip, deflate, br
Cookie: demdex=72674303528070863893467454340398013869; dextp=269-1-1572927053137
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 30 Oct 2019 17:32:17 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=72674303528070863893467454340398013869;Path=/;Domain=.demdex.net;Expires=Sun, 03-May-2020 04:10:53 GMT;Max-Age=15552000
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: bZUWfTOIRZg=
Content-Length: 2764
Connection: keep-alive

GET
H2 200 s12390597959527 Show response
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/ 2 KB
2 KB 59ms
59ms Script
application/x-javascript 15.188.105.205
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s12390597959527?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=5%2F10%2F2019%205%3A10%3A53%202%20-60&d.&nsid=0&jsonv=1&.d&mid=72453281799470152453479406370189777109&aid=2EE07B2685158000-4018A8E1223DCFE6&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&cc=USD&ch=editorial&server=www.zdnet.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&l1=symantec&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e%7C10cdea3b-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=85fd8691-f525-4ea2-a601-af296f629f7f&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=new%20%27unremovable%27%20xhelper%20malware%20has%20infected%2045%2C000%20android%20devices&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=fd535992-ecdd-4096-8d70-2d3ec6ec661d&c25=D%3Dv25&c26=D%3Dv26&c28=D%3Dv28&c30=D%3Dv30&v30=1472dbfa-b22c-4455-9cb9-152ad86c58bb&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=GksdB13A9kxxhdXg7PU&c44=D%3Dv44&v44=zdnet&c50=D%3Dv50&c51=D%3Dv51&c52=D%3Dv52&c53=D%3Dv53&c54=D%3Dv54&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=false&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

0b65e7d388db51ebfaba9cb824426205a7632e1fbd4a1221bb7cf301fce6d33d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-aam-tid: 7IiqqLiuS/E=
date: Tue, 05 Nov 2019 04:10:52 GMT
x-content-type-options: nosniff
x-c: master-1058.I94f02a.M0-309
p3p: CP="This is not a P3P policy"
status: 200
content-length: 1597
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-v050-087e1f065.edge-irl1.demdex.com 5.62.0.20191030104901 5ms (+1ms)
pragma: no-cache
last-modified: Wed, 06 Nov 2019 04:10:53 GMT
server: jag
xserver: anedge-d76fdf885-zglb4
etag: 3377835125899624448-4615741952040458294
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 04 Nov 2019 04:10:53 GMT

GET
H2 200 / Show response
www.zdnet.com/components/breaking-news/xhr/ 1 KB
1 KB 182ms
182ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

9e0d5a2e81afbcfbb2f34086f652889c3d827a7e839e4ef5fda38ddf01d466c4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 517
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 05 Nov 2019 03:50:20 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Tue, 05 Nov 2019 04:10:53 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: f9fd0c61-6aea-465c-aa4b-cfeb4a58e156
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Tue, 05 Nov 2019 05:20:20 GMT

GET
H2 200 disqus-count-5922ea1c53-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 406 B
401 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 305939
status: 200
vary: Accept-Encoding
content-length: 270
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5db9ef23-196"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Nov 2019 15:11:54 GMT

GET
H2 200 xhelper-spam.png
zdnet4.cbsistatic.com/hub/i/r/2019/10/29/dd4bec89-06f4-4f68-849e-60f8ab2e56e6/resize/370xauto/2ba8d77b0fbca20a70ee7501560bf460/ 37 KB
36 KB 7ms
6ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/10/29/dd4bec89-06f4-4f68-849e-60f8ab2e56e6/resize/370xauto/2ba8d77b0fbca20a70ee7501560bf460/xhelper-spam.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c7e200cc7a868fcda0eff820187cc801f54018e22743426e46666c10f868b592

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2884
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 36936
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"83089fa4c9d83650793886cba4edb300"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 xhelper-service.png
zdnet1.cbsistatic.com/hub/i/r/2019/10/29/acafce13-b6e7-4c99-9139-073c2bc51883/resize/370xauto/94cf64b33decdc50766c1438d76907a1/ 56 KB
53 KB 8ms
8ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/10/29/acafce13-b6e7-4c99-9139-073c2bc51883/resize/370xauto/94cf64b33decdc50766c1438d76907a1/xhelper-service.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9325919428c9f69388eb7a4ea4cb011fdc333fda350124403e3f5471367ac968

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 561318
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 54593
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"748350d6c0587e8591517220383a9945"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 xhelper-users.png
zdnet2.cbsistatic.com/hub/i/2019/10/29/9fba4b24-602e-4b30-b973-dd88c8e8b7dd/6499ee8636b5f2feb264fa9610f87444/ 14 KB
13 KB 12ms
12ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/2019/10/29/9fba4b24-602e-4b30-b973-dd88c8e8b7dd/6499ee8636b5f2feb264fa9610f87444/xhelper-users.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

110a5497d2c05a021331d74735f248fff5174323744407925f3060bd6709c69a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 561871
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 13649
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"3b5750171f62fd9c3cd91a41ddb1ac45"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 image-gallery-modal-e49526b449-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 7ms
7ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-e49526b449-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71827
status: 200
vary: Accept-Encoding
content-length: 1909
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:28 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef24-13d0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 08:13:43 GMT

GET
H2 200 screenshot-2019-07-02-at-12-11-21.png
zdnet1.cbsistatic.com/hub/i/r/2019/07/02/76b08992-f110-4f76-98fd-9e65e2327beb/thumbnail/170x128/f2ae0a6fc5793356c975177af8cdedc8/ 24 KB
24 KB 7ms
7ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/07/02/76b08992-f110-4f76-98fd-9e65e2327beb/thumbnail/170x128/f2ae0a6fc5793356c975177af8cdedc8/screenshot-2019-07-02-at-12-11-21.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f06b769609d7fb2a12cc6328f66a20b2c8bcb2337b6081665178ebdaeea7636f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3974139
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 24588
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "4b23f8dc9eb4ed500a662e396908d39b"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-12-07-39.png
zdnet1.cbsistatic.com/hub/i/r/2019/07/02/78b29873-4385-4342-8f4a-12cebf3fc6fd/thumbnail/170x128/ffa24ce1278a1be70924b33b500851ca/ 41 KB
41 KB 7ms
7ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/07/02/78b29873-4385-4342-8f4a-12cebf3fc6fd/thumbnail/170x128/ffa24ce1278a1be70924b33b500851ca/screenshot-2019-07-02-at-12-07-39.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

06fed629374c6d00b1b9869f50fc9a0dbb7c94c0ea5debba718b07520f81f770

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1146
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 42177
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"d0b9ad3d3ca9c79694e2ce99aee06382"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-07-02-at-12-08-42.png
zdnet2.cbsistatic.com/hub/i/r/2019/07/02/88c6cb2f-66da-4ca2-822c-83a575241aee/thumbnail/170x128/c0f1c36d7140d33fff2a32ab556cda92/ 23 KB
23 KB 6ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/07/02/88c6cb2f-66da-4ca2-822c-83a575241aee/thumbnail/170x128/c0f1c36d7140d33fff2a32ab556cda92/screenshot-2019-07-02-at-12-08-42.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d5cb68d30901ab4b59658ed85d15a89c4d8ef306f2f23d568eb94d9057f2cad6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6789877
status: 200
content-transfer-encoding: binary
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 23609
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "b678b443a0d40136143d792a9325d8af"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 disqus-loader-67d4cb8d1a-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
798 B 6ms
6ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-67d4cb8d1a-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d376263f7912434deb05ab9613cf6ea2a9f15f4b82dad68422eb0d5de195669e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 493693
status: 200
vary: Accept-Encoding
content-length: 643
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 10:21:20 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db96420-583"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Nov 2019 11:02:39 GMT

GET
H2 200 bitpaymer-everis.png
zdnet3.cbsistatic.com/hub/i/r/2019/11/04/5c49c707-8cd5-4a43-bc70-5e8d5ebe4598/thumbnail/70x53/00aa4a5811fe65a8b824fda83e5400e0/ 8 KB
8 KB 12ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/11/04/5c49c707-8cd5-4a43-bc70-5e8d5ebe4598/thumbnail/70x53/00aa4a5811fe65a8b824fda83e5400e0/bitpaymer-everis.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b5599f8e46599b39746d4ec039006f9f24d15aa5bfff6feb5c5a6ada2ac6a884

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36799
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7941
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5bd529d5b07b647a8863cf71e98d651a"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gitlab.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/11/04/e44d0c7f-dd15-40f4-ba8c-e3dd327d22fc/thumbnail/70x53/8f9c37a5d3ff4ff6a78f40228570a5b4/ 1 KB
1 KB 11ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/11/04/e44d0c7f-dd15-40f4-ba8c-e3dd327d22fc/thumbnail/70x53/8f9c37a5d3ff4ff6a78f40228570a5b4/gitlab.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d18981e996610cad069d83d05ed674db4978775ff80845c88044820c8821736f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51132
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 1061
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"db2b4182156b2f1f817860ac9f409ad7"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 wordpress.png
zdnet3.cbsistatic.com/hub/i/r/2019/08/08/8757f3e4-7316-4a63-a6fd-b5e2ac0d4933/thumbnail/70x53/e4f3bf12c5743611fba2d7423ac92b0e/ 6 KB
6 KB 12ms
6ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/08/08/8757f3e4-7316-4a63-a6fd-b5e2ac0d4933/thumbnail/70x53/e4f3bf12c5743611fba2d7423ac92b0e/wordpress.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8d7681c3d6b9aa0efb9812048b8dbec10ff143fd4a8cf9c17e256e5757b5a6c6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39185
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 6178
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"f7fbc4bafcc80cbf690acbef25f2ce1c"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 us-company-selling-weaponized-bluekeep-e-5d3f4e4709ac9100018ce3cf-1-aug-01-2019-14-06-31-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/08/01/bd49f6c2-afe8-4311-8e36-2b29d90d3508/thumbnail/70x53/e783e821b1a3f3dcfbb6e437ea2053cb/ 1 KB
1 KB 12ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/08/01/bd49f6c2-afe8-4311-8e36-2b29d90d3508/thumbnail/70x53/e783e821b1a3f3dcfbb6e437ea2053cb/us-company-selling-weaponized-bluekeep-e-5d3f4e4709ac9100018ce3cf-1-aug-01-2019-14-06-31-poster.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

875abf5b8c92fb002a753b14e06bf3ced893a844afc1925317536b29a161dcda

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 176149
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 1131
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "fe709c654eac84d5239d1a12a4f71877"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 / Show response
www.zdnet.com/newsletter/xhr/widget-login/ 2 KB
2 KB 413ms
410ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1a6fef62053331f63644123262d5af95850483144651dc15fc57e76dded3d4ef

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 728
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Tue, 05 Nov 2019 04:10:53 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 658f9d47-6217-4d23-9f77-3b1ece85683f
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Tue, 05 Nov 2019 04:10:53 GMT

POST
H2 200 / Show response
www.zdnet.com/m3d0s1/xhr/right-rail/ 11 KB
3 KB 397ms
396ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/m3d0s1/xhr/right-rail/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5022b5f1b7007908d8a4f4ca598ffe88ddbc46ac18dbaa17a030c910e9322ca2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: cors
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 1700
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: nginx
x-frame-options: SAMEORIGIN
date: Tue, 05 Nov 2019 04:10:53 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 8995c06c-085d-4d88-8e93-995d24d23078
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H2 200 front-door-carousel-56427878d9-rev.js Show response
zdnet1.cbsistatic.com/fly/js/components/ 5 KB
2 KB 7ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309073
status: 200
vary: Accept-Encoding
content-length: 1564
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef23-124a"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Nov 2019 14:19:39 GMT

GET
H2 200 asean.jpg
zdnet1.cbsistatic.com/hub/i/r/2014/09/18/f8c7cd4f-3efe-11e4-b6a0-d4ae52e95e57/thumbnail/170x128/b5579d139264a4e263dd7bde7fc8dcd0/ 7 KB
7 KB 7ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2014/09/18/f8c7cd4f-3efe-11e4-b6a0-d4ae52e95e57/thumbnail/170x128/b5579d139264a4e263dd7bde7fc8dcd0/asean.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1d41e31a056050195712db11c373d790360c6738fe6ad0e61e6f21726d619ba5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6587
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7298
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"fc2022c89b61c76bbef978f1370660bf"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 wind-solar-energy.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/10/31/8712b91c-2d7c-43e3-85bc-db551effb317/thumbnail/170x128/2134cf8e316059f0333551ff4b61c626/ 5 KB
5 KB 7ms
6ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/10/31/8712b91c-2d7c-43e3-85bc-db551effb317/thumbnail/170x128/2134cf8e316059f0333551ff4b61c626/wind-solar-energy.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1f11b99e5f22ed5ebe1df7fa2f6c839f7109dca2c8be9a00fd1fe92c9ac897e0

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 361792
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5008
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "b3848d61bbbc6207c6668a8a9e2730ed"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 snowden.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/11/04/6bb9b857-7a2d-4c0a-8ad2-7b9900fe3257/thumbnail/170x128/23f7223abc17ce74cfa96d6b3452486c/ 6 KB
6 KB 7ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/11/04/6bb9b857-7a2d-4c0a-8ad2-7b9900fe3257/thumbnail/170x128/23f7223abc17ce74cfa96d6b3452486c/snowden.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6c6710b5b8ee51aaf57906b681eb1a32ad6e6c9fd07dfa3b37d2479cb8434308

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 24310
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 6200
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "dd409260aea46a90e61b9a69fb9726ef"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bitpaymer-everis.png
zdnet2.cbsistatic.com/hub/i/r/2019/11/04/5c49c707-8cd5-4a43-bc70-5e8d5ebe4598/thumbnail/170x128/966cc9e3c202354e56b0c3a66c5fc25d/ 39 KB
39 KB 9ms
8ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/11/04/5c49c707-8cd5-4a43-bc70-5e8d5ebe4598/thumbnail/170x128/966cc9e3c202354e56b0c3a66c5fc25d/bitpaymer-everis.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d72ee05b24fd749d129b1c3ad062a2300fbfaa809fc7336fe981ce85e2377e82

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 36993
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 39627
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "07238496476853bbaf3d939a7aaaa468"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 wordpess-logo-splatter.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/11/04/d0a34cd7-f580-4db3-bddf-ace42cae0f14/thumbnail/170x128/b639553d2988fcca8f8b9e7753ab5ec5/ 5 KB
5 KB 6ms
5ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/11/04/d0a34cd7-f580-4db3-bddf-ace42cae0f14/thumbnail/170x128/b639553d2988fcca8f8b9e7753ab5ec5/wordpess-logo-splatter.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fde3fecb64b9bdab47a902d75ab27e6ea149dcfb779a317a8cebcf9ef93360e7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39091
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4920
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"001ab2fa029c064a45e41f8b2644a292"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 istock-polling-station.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/11/04/2f2d366f-0b53-4948-8f8f-d0f51560d087/thumbnail/170x128/b382427ec7f1c7cecb11bdfee7d0143a/ 10 KB
10 KB 7ms
6ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/11/04/2f2d366f-0b53-4948-8f8f-d0f51560d087/thumbnail/170x128/b382427ec7f1c7cecb11bdfee7d0143a/istock-polling-station.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f761c12f48e0463f151621e2a87ef98bcdab277ba662a9acdbc58303246a266c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 39877
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 10191
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "6b8027f8d0ccac45349d84a80667a0bc"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 computeradministock-808157830.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/11/04/d9dd0f4e-cf8b-4b14-9ddd-184b3deae66b/thumbnail/170x128/6d8ccc9e84b17a7dfb87af6f782b5c4b/ 10 KB
9 KB 8ms
7ms Image
image/jpeg 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/11/04/d9dd0f4e-cf8b-4b14-9ddd-184b3deae66b/thumbnail/170x128/6d8ccc9e84b17a7dfb87af6f782b5c4b/computeradministock-808157830.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7fb1673bbe848daf6c472455a6548de044a19e7129f02cdff58f9d0e9e191c65

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48096
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 9321
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"331609c975310d6486391e92a67c5492"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 gitlab.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/11/04/e44d0c7f-dd15-40f4-ba8c-e3dd327d22fc/thumbnail/170x128/e49f44176a0f0c970598d9217048dd4d/ 4 KB
4 KB 8ms
7ms Image
image/jpeg 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/11/04/e44d0c7f-dd15-40f4-ba8c-e3dd327d22fc/thumbnail/170x128/e49f44176a0f0c970598d9217048dd4d/gitlab.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b5c10eeeb699e3ec9d2241adca63455dc93eb0dca9df27628f8c4ef2e83ce45f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 51193
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3714
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e36286b94d3c219f414e0427e5f73aa5"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-11-04-at-11-57-17.png
zdnet2.cbsistatic.com/hub/i/r/2019/11/04/31721e25-df47-4567-9765-ec98fc4e2b8b/thumbnail/170x128/c5b5e930f4bc4310e006b6aa649d13d5/ 38 KB
39 KB 8ms
8ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/11/04/31721e25-df47-4567-9765-ec98fc4e2b8b/thumbnail/170x128/c5b5e930f4bc4310e006b6aa649d13d5/screenshot-2019-11-04-at-11-57-17.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5834c8c621e1b242cea4abe006b34a647a5f243b1e6bbeb0b5806f54cde9c5f8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 52475
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 39360
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e14062d430df9303453e4d25fadfe4ee"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 urban-airship-29ae327ed0-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 1 KB
999 B 5ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 547068
status: 200
vary: Accept-Encoding
content-length: 827
x-xss-protection: 1; mode=block
last-modified: Tue, 29 Oct 2019 14:50:46 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db851c6-514"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2019 20:13:05 GMT

GET
H2 200 advertisement-d41d8cd98f-rev.js Show response
zdnet2.cbsistatic.com/fly/js/utils/ 0
166 B 8ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 499704
status: 200
vary: Accept-Encoding
content-length: 0
x-xss-protection: 1; mode=block
last-modified: Tue, 29 Oct 2019 14:51:02 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5db851d6-0"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Nov 2019 09:22:28 GMT

GET
H2 200 loader.js Show response
cdn.taboola.com/libtrc/cbsinteractive-zdnet/ 84 KB
19 KB 84ms
27ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by: Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c34ca9b82d83676fb7a522f6fa73fcf2bea100c3ace203a2083762b62259dad6

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-amz-version-id: zVCn5jwUPSi38zoItTTFrj99boNIfpbJ
content-encoding: gzip
etag: "b91cd8ab580c69ae953e0b8bf2bb0085"
age: 143
x-cache: HIT
status: 200
content-length: 18806
x-amz-id-2: qrA2ljzS3iOMbEPmcfjsHD1cBSwyEKz9+tjZ4+P4uJf8iLy19cb9bJQHTkfOlr2Ya+tVLxXDyn8=
x-served-by: cache-hhn4031-HHN
last-modified: Mon, 04 Nov 2019 08:49:10 GMT
server: AmazonS3
x-timer: S1572927053.267049,VS0,VE1
date: Tue, 05 Nov 2019 04:10:53 GMT
vary: Accept-Encoding
x-amz-request-id: 429F4F5541962136
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 93
x-cache-hits: 1

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 278 KB
50 KB 578ms
578ms XHR
text/plain 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1670187285517808&correlator=1834766448984106&output=ldjh&impl=fifs&adsid=NT&eid=21062421%2C21062888%2C21064679%2C21065017&vrg=2019103101&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-36&ecs=20191105&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C320x50%7C11x11%2C300x250%2C300x250%2C641x321%2C728x90%7C970x66%7C970x250%2C371x771&fluid=0%2C0%2C0%2C0%2Cheight%2C0%2C0%2C0%2C0%2C0&ists=256&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dtop%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cmobile-os%252Candroid%26tag%3Dmalware%252Csymantec%252Ctarget%26mfr%3Dsymantec%26prodtype%3Dandroid%252Cantivirus%26pid%3Dsymantec-mobile-antivirus%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dnew-unremovable-xhelper-malware-has-infected-45000-android-devices%26env%3Dprod%26firstpg%3D1%26vguid%3Dfd535992-ecdd-4096-8d70-2d3ec6ec661d%26session%3Dh%26subses%3D1&cookie_enabled=1&bc=31&abxe=1&lmt=1572921988&dt=1572927053218&dlt=1572927051511&idt=530&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C0%2C-12245933%2C-12245933%2C208%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adys=-12245933%2C87%2C-12245933%2C-12245933%2C2160%2C-12245933%2C-12245933%2C-12245933%2C-12245933%2C-12245933&adks=3361930185%2C2753838333%2C373522494%2C622592031%2C939048689%2C3216667307%2C1184500331%2C2621597244%2C2317481455%2C2543594533&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&dssz=77&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x5343%7C1585x0%7C1585x0%7C370x0%7C770x11%7C370x0%7C370x250%7C770x4268%7C1210x0%7C370x0&msz=7x7%7C1585x0%7C688x105%7C300x280%7C770x11%7C300x280%7C300x280%7C641x361%7C728x130%7C371x771&ga_vid=684511435.1572927053&ga_sid=1572927053&ga_hid=669697915&fws=132%2C4%2C132%2C132%2C4%2C132%2C132%2C132%2C132%2C132&ohw=1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585%2C1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

10362415868ebbb631276e241ba43c7850d55465a9a3001d9b84a05d1ce4f872

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12274720635084041526/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12274720635084041526/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLG4l_KZ0uUCFYK43godiiMBNw&gqi=&layout=/sadbundle/%24csp%253Der3%24/12274720635084041526/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CK-4l_KZ0uUCFYK43godiiMBNw&gqi=&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12274720635084041526/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12274720635084041526/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLG4l_KZ0uUCFYK43godiiMBNw&gqi=&layout=/sadbundle/%24csp%253Der3%24/12274720635084041526/index.html,child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CK-4l_KZ0uUCFYK43godiiMBNw&gqi=&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2
google-creative-id: 138245072116,-2,-1,-1,138239344190,-1,-1,138239368367,-1,138247024569
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 49660
x-xss-protection: 0
google-lineitem-id: 4745699004,-2,-1,-1,4745189935,-1,-1,4745327422,-1,4825966980
pragma: no-cache
server: cafe
google-mediationtag-id: -2
date: Tue, 05 Nov 2019 04:10:53 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019103101.js Show response
securepubads.g.doubleclick.net/gpt/ 64 KB
25 KB 32ms
32ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

5075b0d31c00903c1a8f437e6e356da4ebf9fe7066ac6809427d184b55fc382c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 31 Oct 2019 13:10:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25134
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-36/html/ 0
0 18ms
6ms Other
text/html 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019103101.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

GET
H/1.1 200
OK cs.js Show response
sb.scorecardresearch.com/c2/3005086/ 0
400 B 79ms
27ms Script
application/x-javascript 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201909161811
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Apr 2011 23:11:26 GMT
ETag: "d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=259200
Connection: keep-alive
Content-Length: 20
Expires: Fri, 08 Nov 2019 04:10:53 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1572927053254&ns_c=UTF-8&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=htt...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1572927053254&ns_c=UTF-8&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=ht...

0
248 B

28ms
28ms

Image
text/plain

184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1572927053254&ns_c=UTF-8&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1572927053254&ns_c=UTF-8&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&c9=
Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 61 KB
15 KB 107ms
47ms Script
application/javascript 104.17.208.240
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201909161811

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

b59b2a1b8b73edc1c35d71f24bee56ad3008e4783182eac39be08da425b22d5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8365
cf-polished: origSize=63370
status: 200
edge-control: max-age=604800
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-bgj: minify
server: cloudflare
x-powered-by: Express
etag: W/"f78a-SobotlqMqFr4Xguui1fK4Vc00y8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=60, s-maxage=604800
cf-ray: 530bfb035e55d467-HAM
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 103 KB
22 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

b02eb6a63bca577aa26a3d54c450cd179dab7b63e08cb8830411bca8f853c002

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
content-length: 22456
x-xss-protection: 0
pragma: public
x-fb-debug: jwoNryeG+4q6QFTQyV7/rd5fo7ihRHgLtCjavOGM0Olopeg7T8EibZXOHkb3TiADTJgva+4CCjO1jML41u4T4g==
x-fb-trip-id: 975780461
x-frame-options: DENY
date: Tue, 05 Nov 2019 04:10:53 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 cbs_zQTp2H_zdnet.js Show response
cdn-magiclinks.trackonomics.net/client/static/v2/ 95 KB
18 KB 47ms
8ms Script
text/javascript 2600:9000:21f3:c800:1d:8c8c:47c0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-magiclinks.trackonomics.net/client/static/v2/cbs_zQTp2H_zdnet.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1810.js?utv=ut4.43.201909161811
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:c800:1d:8c8c:47c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8 /
Resource Hash: 6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 01:28:14 GMT
content-encoding: gzip
last-modified: Thu, 10 Oct 2019 06:53:39 GMT
server: Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/7.2.8
age: 9729
status: 200
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: trnpAthU5ayd774QhCLFHsaxMX7DsvqHZhloxN5iRShdiw7DvqTwpA==
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)

GET
H2

200

m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain

https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/&rp=&ts=compact&rnd=157292...
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/&rp=&ts=compact&rnd=157292...

44 B
332 B

36ms
36ms

Image
image/gif

52.18.184.106
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/&rp=&ts=compact&rnd=1572927053257&ja=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.184.106 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-18-184-106.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:53 GMT
server: nginx
status: 200
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:53 GMT
server: nginx
status: 302
location: https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/&rp=&ts=compact&rnd=1572927053257&ja=1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/10/29/dd4bec89-06f4-4f68-849e-60f8ab2e56e6/resize/370xauto/2ba8d77b0fbca20a70ee7501560bf460/xhelper-spam.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

c7e200cc7a868fcda0eff820187cc801f54018e22743426e46666c10f868b592

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2884
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 36936
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"83089fa4c9d83650793886cba4edb300"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/10/29/acafce13-b6e7-4c99-9139-073c2bc51883/resize/370xauto/94cf64b33decdc50766c1438d76907a1/xhelper-service.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

9325919428c9f69388eb7a4ea4cb011fdc333fda350124403e3f5471367ac968

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 561318
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 54593
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"748350d6c0587e8591517220383a9945"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
337 B 100ms
37ms XHR
text/plain 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Server: Apache
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H2 200 xhelper-users.png
zdnet2.cbsistatic.com/hub/i/2019/10/29/9fba4b24-602e-4b30-b973-dd88c8e8b7dd/6499ee8636b5f2feb264fa9610f87444/ 14 KB
13 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/2019/10/29/9fba4b24-602e-4b30-b973-dd88c8e8b7dd/6499ee8636b5f2feb264fa9610f87444/xhelper-users.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

110a5497d2c05a021331d74735f248fff5174323744407925f3060bd6709c69a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 561871
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 13649
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"3b5750171f62fd9c3cd91a41ddb1ac45"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/11/04/e44d0c7f-dd15-40f4-ba8c-e3dd327d22fc/thumbnail/70x53/8f9c37a5d3ff4ff6a78f40228570a5b4/gitlab.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d18981e996610cad069d83d05ed674db4978775ff80845c88044820c8821736f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51132
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 1061
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"db2b4182156b2f1f817860ac9f409ad7"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/11/04/5c49c707-8cd5-4a43-bc70-5e8d5ebe4598/thumbnail/70x53/00aa4a5811fe65a8b824fda83e5400e0/bitpaymer-everis.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b5599f8e46599b39746d4ec039006f9f24d15aa5bfff6feb5c5a6ada2ac6a884

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36799
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7941
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5bd529d5b07b647a8863cf71e98d651a"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/08/08/8757f3e4-7316-4a63-a6fd-b5e2ac0d4933/thumbnail/70x53/e4f3bf12c5743611fba2d7423ac92b0e/wordpress.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

8d7681c3d6b9aa0efb9812048b8dbec10ff143fd4a8cf9c17e256e5757b5a6c6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39185
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 6178
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"f7fbc4bafcc80cbf690acbef25f2ce1c"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

875abf5b8c92fb002a753b14e06bf3ced893a844afc1925317536b29a161dcda

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 176149
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 1131
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "fe709c654eac84d5239d1a12a4f71877"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 fly-disqus-count-1f604770a3-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 882 B
567 B 5ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78516
status: 200
vary: Accept-Encoding
content-length: 460
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:27 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5db9ef23-372"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 06:22:17 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/11/04/d0a34cd7-f580-4db3-bddf-ace42cae0f14/thumbnail/170x128/b639553d2988fcca8f8b9e7753ab5ec5/wordpess-logo-splatter.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

fde3fecb64b9bdab47a902d75ab27e6ea149dcfb779a317a8cebcf9ef93360e7

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39091
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 4920
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"001ab2fa029c064a45e41f8b2644a292"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet3.cbsistatic.com/hub/i/r/2019/10/31/8712b91c-2d7c-43e3-85bc-db551effb317/thumbnail/170x128/2134cf8e316059f0333551ff4b61c626/wind-solar-energy.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1f11b99e5f22ed5ebe1df7fa2f6c839f7109dca2c8be9a00fd1fe92c9ac897e0

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 361793
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 5008
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "b3848d61bbbc6207c6668a8a9e2730ed"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2014/09/18/f8c7cd4f-3efe-11e4-b6a0-d4ae52e95e57/thumbnail/170x128/b5579d139264a4e263dd7bde7fc8dcd0/asean.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

1d41e31a056050195712db11c373d790360c6738fe6ad0e61e6f21726d619ba5

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6587
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 7298
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"fc2022c89b61c76bbef978f1370660bf"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet1.cbsistatic.com/hub/i/r/2019/11/04/6bb9b857-7a2d-4c0a-8ad2-7b9900fe3257/thumbnail/170x128/23f7223abc17ce74cfa96d6b3452486c/snowden.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

6c6710b5b8ee51aaf57906b681eb1a32ad6e6c9fd07dfa3b37d2479cb8434308

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 24310
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 6200
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "dd409260aea46a90e61b9a69fb9726ef"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/11/04/2f2d366f-0b53-4948-8f8f-d0f51560d087/thumbnail/170x128/b382427ec7f1c7cecb11bdfee7d0143a/istock-polling-station.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f761c12f48e0463f151621e2a87ef98bcdab277ba662a9acdbc58303246a266c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 39877
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 10191
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "6b8027f8d0ccac45349d84a80667a0bc"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/hub/i/r/2019/11/04/d9dd0f4e-cf8b-4b14-9ddd-184b3deae66b/thumbnail/170x128/6d8ccc9e84b17a7dfb87af6f782b5c4b/computeradministock-808157830.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

7fb1673bbe848daf6c472455a6548de044a19e7129f02cdff58f9d0e9e191c65

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48096
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 9321
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"331609c975310d6486391e92a67c5492"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/11/04/e44d0c7f-dd15-40f4-ba8c-e3dd327d22fc/thumbnail/170x128/e49f44176a0f0c970598d9217048dd4d/gitlab.jpg

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

b5c10eeeb699e3ec9d2241adca63455dc93eb0dca9df27628f8c4ef2e83ce45f

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 51193
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 3714
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e36286b94d3c219f414e0427e5f73aa5"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/11/04/5c49c707-8cd5-4a43-bc70-5e8d5ebe4598/thumbnail/170x128/966cc9e3c202354e56b0c3a66c5fc25d/bitpaymer-everis.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d72ee05b24fd749d129b1c3ad062a2300fbfaa809fc7336fe981ce85e2377e82

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 36993
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 39627
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "07238496476853bbaf3d939a7aaaa468"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 screenshot-2019-11-04-at-11-57-17.png
zdnet2.cbsistatic.com/hub/i/r/2019/11/04/31721e25-df47-4567-9765-ec98fc4e2b8b/thumbnail/170x128/c5b5e930f4bc4310e006b6aa649d13d5/ 38 KB
38 KB 8ms
7ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/hub/i/r/2019/11/04/31721e25-df47-4567-9765-ec98fc4e2b8b/thumbnail/170x128/c5b5e930f4bc4310e006b6aa649d13d5/screenshot-2019-11-04-at-11-57-17.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

5834c8c621e1b242cea4abe006b34a647a5f243b1e6bbeb0b5806f54cde9c5f8

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
age: 52475
status: 200
content-transfer-encoding: binary
x-image-exists: 1
vary: Accept-Image-Webp,Accept-Image-Webv
content-length: 39360
x-xss-protection: 1; mode=block
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "e14062d430df9303453e4d25fadfe4ee"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK 4083-12969.js Show response
www.everestjs.net/dl/4083/ 484 B
664 B 27ms
25ms Script
application/x-javascript 184.31.90.90
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.everestjs.net/dl/4083/4083-12969.js
Requested by: Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.90.90 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-90-90.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Nov 2013 14:23:10 GMT
Server: Apache
ETag: "4a5a49-1e4-4ec011a776f80"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=70906
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 288
Expires: Tue, 05 Nov 2019 23:52:39 GMT

GET
H/1.1 200
OK v
pixel.everesttech.net/4083/ 128 B
716 B 21ms
19ms Image
image/png 66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&ev___ref=%2F%2F
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Last-Modified: Thu, 28 Mar 2019 09:07:56 GMT
Server: Apache
ETag: "9c3880-80-58523e3d09300"
Vary: Cookie
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=15, max=999399
Content-Length: 128

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/
Redirect Chain

https://cm.everesttech.net/cm
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WGNEMlRRQUFBUHk1V1NzTA
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEJczk6uF_NBabt4BMxNNuV8&google_cver=1
https://pixel.everesttech.net/1x1

128 B
407 B

19ms
18ms

Image
image/png

66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Last-Modified: Thu, 28 Mar 2019 09:07:56 GMT
Server: Apache
ETag: "9c3880-80-58523e3d09300"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=999396
Content-Length: 128

Redirect headers

Date: Tue, 05 Nov 2019 04:10:52 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://pixel.everesttech.net/1x1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 ua-sdk.min.js Show response
web-sdk.urbanairship.com/notify/v1/ 78 KB
17 KB 98ms
18ms Script
application/javascript 35.227.208.151
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by: Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 151.208.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:09 GMT
content-encoding: gzip
x-goog-meta-goog-reserved-file-mtime: 1556302399
age: 44
x-guploader-uploadid: AEnB2UpgTZPP5E43VR9OdYH7k_nLSH7Gi9SW-SQyoZ0xyqQ9YbyQvEEpk1SlpoWGOhLWlchpq2EozZDUY2VLK8gRJ7iMgScO_g
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 16960
last-modified: Fri, 26 Apr 2019 18:13:21 GMT
server: UploadServer
etag: "251defdc0ecc8a3bad8ae4cf9aab1923"
vary: Accept-Encoding
x-goog-hash: crc32c=A7yEjg==, md5=JR3v3A7MijutiuTPmqsZIw==
x-goog-generation: 1556302401249893
cache-control: public, max-age=300
x-goog-stored-content-length: 16960
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 05 Nov 2019 04:15:09 GMT

GET
H2 200 309391486091569 Show response
connect.facebook.net/signals/config/ 280 KB
65 KB 64ms
64ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/309391486091569?v=2.9.5&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

51c7d8bf36278b44c83df1a711f1993125416929a7a5a9a0a7061c852ba92ce3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: f5S/baCHiv0+LL4X+7Zloim+mwfU/jCQz5x5hyH06F0RN0CRgG9M9wW9Ep5yd6OII12JRczHRqIXHl+90Tyc6A==
x-fb-trip-id: 975780461
x-frame-options: DENY
date: Tue, 05 Nov 2019 04:10:53 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 show-hide-1.0-7dc26ff326-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 2 KB
882 B 5ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410579
status: 200
vary: Accept-Encoding
content-length: 710
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:28 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db9ef24-7a5"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 07 Nov 2019 10:07:53 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 41ms
26ms Script
application/x-javascript 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Wed, 06 Nov 2019 04:10:53 GMT

GET
H2 200 load.js Show response
widget.perfectmarket.com/cbsinteractive-zdnet/ 13 KB
5 KB 218ms
167ms Script
application/javascript 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-amz-version-id: rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding: gzip
etag: "fc0de48a0976cde02ddee0bd49a81832"
age: 212
x-cache: HIT, HIT
status: 200
content-length: 4742
x-amz-id-2: LRY0GUPSWz5V428RMMTCdGJwSCAtZeQMdn3yoaCQJDvLF/meN4PjnGa1SKHr53a/U7xd0l35yzE=
x-served-by: cache-lax8645-LAX, cache-hhn4021-HHN
last-modified: Thu, 20 Oct 2016 17:48:07 GMT
server: AmazonS3
x-timer: S1572927053.384175,VS0,VE143
date: Tue, 05 Nov 2019 04:10:53 GMT
vary: Accept-Encoding,,
x-amz-request-id: 8B29CD92F5CA984C
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=300
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
x-cache-hits: 1, 1

GET
H2 200 impl.20191103-15-RELEASE.js Show response
cdn.taboola.com/libtrc/ 414 KB
117 KB 25ms
25ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20191103-15-RELEASE.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b43c55ecab4c039abdc362ed7985f685e57706c7db17b7a9960547a16ef617cb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-amz-version-id: Ia39ZJLyYzTg_yLOT8GawOs_XCEAtdPy
content-encoding: gzip
etag: "651a2b455c103ab88dad66e0d6fbb9c3"
age: 21
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 119411
x-amz-id-2: q8yDFZk9TVEplx4AINHNiO0lOFnC9TWEWAI5XM+pohPPGUdTT25zV7aFJB/zbVdM0Y6mf4uZVN8=
x-served-by: cache-hhn4031-HHN
last-modified: Sun, 03 Nov 2019 15:06:11 GMT
server: AmazonS3
x-timer: S1572927053.333749,VS0,VE0
date: Tue, 05 Nov 2019 04:10:53 GMT
vary: Accept-Encoding
x-amz-request-id: 0A3B61A1C833E12E
via: 1.1 varnish
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 75
x-cache-hits: 61

GET count.js
zdnet-1.disqus.com/ 0
0

GET
H2

200

/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&guid=ON&script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=TfbAXejHFauNmL...
https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=595070135&crd=&is_vtc=1&random=1539513216
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=595070135&crd=&is_vtc=1&random=1539513216&ipr=y

42 B
110 B

21ms
20ms

Image
image/gif

2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=595070135&crd=&is_vtc=1&random=1539513216&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=595070135&crd=&is_vtc=1&random=1539513216&ipr=y
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel
ad.yieldmanager.com/ 0
341 B 149ms
41ms Image
text/plain 2a00:1288:110:c305::9000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.yieldmanager.com/pixel?id=2447099&t=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::9000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK s
pixel.everesttech.net/4083/ 128 B
716 B 20ms
19ms Image
image/png 66.117.28.68
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/4083/s?s=12969
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 66.117.28.68 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Last-Modified: Thu, 28 Mar 2019 09:07:56 GMT
Server: Apache
ETag: "9c3880-80-58523e3d09300"
Vary: Cookie
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=15, max=999398
Content-Length: 128

POST
H/1.1 204
No Content /
684dd306.akstat.io/ 0
354 B 35ms
22ms Other
image/gif 2a02:26f0:6c00:19c::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://684dd306.akstat.io/

Requested by

Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19c::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-XSS-Protection: 0
Expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H/1.1 204
No Content b
sb.scorecardresearch.com/ 0
248 B 31ms
31ms Image
text/plain 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1572927053392&ns_c=UTF-8&cv=3.1e&c8=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&c9=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bcn
www.summerhamster.com/ 43 B
181 B 92ms
30ms Image
image/gif 52.28.51.75
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.summerhamster.com/bcn?fe=1572927053425&y=2.0.1105&elg=80966544&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fqhz-xquhprydeoh-akhoshu-pdozduh-kdv-lqihfwhg-45000-dqgurlg-ghylfhv%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Ftthfyivc%2Fcg%2F%3Brug%3D1572927051858%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.51.75 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-28-51-75.eu-central-1.compute.amazonaws.com
Software: Jetty(9.2.10.v20150310) /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

status: 200
date: Tue, 05 Nov 2019 04:10:53 GMT
server: Jetty(9.2.10.v20150310)
access-control-allow-origin: *
content-length: 43
access-control-allow-methods: *
content-type: image/gif

GET
H2 200 /
www.facebook.com/tr/ 44 B
258 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&rl=&if=false&ts=1572927053435&sw=1600&sh=1200&v=2.9.5&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1572927053434.335403715&it=1572927053300&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-23=":443"; ma=3600
content-length: 44
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H2 200 pmk-201618008.1.js Show response
widget.perfectmarket.com/cbsinteractive-zdnet/ 323 KB
89 KB 26ms
26ms Script
application/javascript 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-amz-version-id: bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding: gzip
etag: "da73fb2066df9f51d08b6688cfb35441"
age: 8290622
x-cache: HIT, HIT
status: 200
content-length: 91236
x-amz-id-2: T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by: cache-lax8632-LAX, cache-hhn4021-HHN
last-modified: Thu, 20 Oct 2016 17:47:53 GMT
server: AmazonS3
x-timer: S1572927054.553602,VS0,VE0
date: Tue, 05 Nov 2019 04:10:53 GMT
vary: Accept-Encoding,,
x-amz-request-id: 58FF20717A687DE4
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
x-cache-hits: 1694, 25

GET
H2 200 vglnk.js Show response
cdn.viglink.com/api/ 78 KB
27 KB 24ms
23ms Script
text/javascript 2606:4700::6810:a10d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.viglink.com/api/vglnk.js
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1238230
cf-ray: 530bfb051fed59e8-VIE
status: 200
content-length: 27746
x-amz-id-2: XaZZfksc5tY2QYKqWg2l9SF0g4tYYLB4/OoiMCVw8qhEZI1HOeFOpmyjOyB6h9h9/hQcx65+CBU=
last-modified: Mon, 21 Oct 2019 20:13:23 GMT
server: cloudflare
etag: "df893ab92782cedac4da4785df9ec68e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: CED68FA43CA7DB4B
cache-control: public, max-age=1800
accept-ranges: bytes
content-type: text/javascript
expires: Tue, 05 Nov 2019 04:40:53 GMT

GET
H2 200 0.34977184563096086
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 43 B
182 B 33ms
31ms Image
image/gif 15.188.105.205
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.34977184563096086?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=new+%27unremovable%27+xhelper+malware+has+infected+45%2C000+android+devices&v22=content_article&v23=&v24=fd535992-ecdd-4096-8d70-2d3ec6ec661d&v30=1472dbfa-b22c-4455-9cb9-152ad86c58bb&v60=33161585,33167141,33167534&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=20191150-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
x-c: master-1058.I94f02a.M0-309
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 06 Nov 2019 04:10:53 GMT
server: jag
xserver: anedge-d76fdf885-xq7km
etag: 3377835125899624448-4617040665325167978
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 04 Nov 2019 04:10:53 GMT

GET
H/1.1 200
OK e.gif
dw.cbsi.com/levt/ria/ 43 B
369 B 163ms
161ms Image
image/gif 64.30.230.22
CBS Interactive Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=1472dbfa-b22c-4455-9cb9-152ad86c58bb&assettitle=new%20%27unremovable%27%20xhelper%20malware%20has%20infected%2045%2C000%20android%20devices&assettype=content_article&pubdate=2019-10-29%2016%3A05%3A00&viewguid=fd535992-ecdd-4096-8d70-2d3ec6ec661d&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=1472dbfa-b22c-4455-9cb9-152ad86c58bb&v16=fd535992-ecdd-4096-8d70-2d3ec6ec661d&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1572927053626&tcset=utf8&im=dsjs&title=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.30.230.22 Fremont, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS: phx2-dw-cbsi-xw-ext-lb.cnet.com
Software: Apache/2.4.25 /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Server: Apache/2.4.25
Vary: *
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate, no-transform
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=80, max=141
Content-Length: 43
Expires: Fri, 23 Jan 1970 12:12:12 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 5835
date: Tue, 05 Nov 2019 02:33:38 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Tue, 05 Nov 2019 04:33:38 GMT

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 27ms
27ms Script
application/x-javascript 184.25.159.208
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.25.159.208 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-159-208.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Wed, 06 Nov 2019 04:10:53 GMT

GET
H2 404 tboptevent.html
widget.perfectmarket.com/opt/ Frame 3D22 0
0 24ms
24ms Document
text/plain 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

:method: GET
:authority: widget.perfectmarket.com
:scheme: https
:path: /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 404
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Tue, 05 Nov 2019 04:10:53 GMT
via: 1.1 varnish
x-served-by: cache-hhn4021-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1572927054.696310,VS0,VE0
content-length: 0

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 42 B
487 B 40ms
39ms XHR
text/javascript 34.246.252.247
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: a013bb45b7882135d057451e1a9e1af0b49ca1f1eb2d9fb1a1a3ae2adce2354b

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:53 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&aip=1&a=669697915&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&ul=en-us&de=UTF-8&dt=New%20%27unremovable%27%20xHelper%20malware%20has%20infected%2045%2C000%20Android%20devices%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=226340978&gjid=2049385336&cid=684511435.1572927053&tid=UA-33613588-22&_gid=1200113380.1572927054&_r=1&cd2=other&z=375965203

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame F682 0
75 B 35ms
34ms Fetch
image/gif 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstp0z4i9jPHaEJka4btT21l2cwmaz7FmNp4heUXS-GYWFBcV5Tzhor4LKWnkHDKVhUDg6sIidoVjdpcC2CBFzl4-f7XMYbTTjJ3O-7xCWYu3ZpTLyGYjC_920t28_s9UiEdD04gy1ZSVdElDQs_HEXdk-srYLmAXq_7VDwiu7bn7nzzr_JGML8Py1kTmfxQGpyEvKwRIhqrXHCRwJuP7TzzHzFAyaYde9bs8nsxg7ls42nUpHdixVtWmfxR1WMRGcnQEtcp7uMy&sig=Cg0ArKJSzAcvkAKoGzYdEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame F682 76 KB
29 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame F682 305 KB
101 KB 105ms
40ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43574
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 78 KB
29 KB 31ms
19ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a71cc134826b38085a6d63bca1e00de7ab8518ae02f7b5e2ae46cf11781e44e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29301
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/031911011734590/ 20 KB
7 KB 33ms
16ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b663fe01f1161255852a7ad82024bd1b9e217bbbd05c824d85e8d279cb808063

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7131
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bc50421414a9b410"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/031911011734590/ Frame 79C1 245 KB
66 KB 32ms
17ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b23897b49c6e2047f39d495d5e6b6691dad263fa42b3fe7079c123e8957f0278

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 67401
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "23b0b3713a3220ce"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 79C1 15 KB
6 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ea7490413386b84bf4d5c1fc162d5b0c16e14485e2eee9787968c8e1288e50c5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5589
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "014536d4b8dbd30e"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 79C1 151 KB
40 KB 27ms
12ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

145facc26f82ff4153d5cbc697c054ce3b2668fa643e1a7614a473a631f2f981

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41349
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5105fa670a8dcaf4"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 79C1 3 KB
1 KB 22ms
8ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a486bc7e2f639006b88a56adf9972eb44c7537e0e20b829f2eb0f3ce3a3e2071

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5d85dedd438ac1aa"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 79C1 44 KB
15 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

fe80c34f1c5630b2f2150e85cca2b15f6da1e29dab9067fddcc94fd43519d579

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14188
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "783b68e4c5ffe17f"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
DATA 200
OK truncated
/ Frame 79C1 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ea5cdf5bd0bcff0b7f84bf8c837398e05bf33b89543c645e77a5f7303f7183e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 5827809746409033881
tpc.googlesyndication.com/simgad/ Frame 79C1 7 KB
7 KB 7ms
7ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5827809746409033881?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qlgC8aSL_LYpYCQjmvgSJs7AFhxHw

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

1e96ccba056713805c4f3b409dd3b26c847df5e520b98576c1b1f4930fc33af6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Thu, 31 Oct 2019 14:15:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jul 2019 17:18:28 GMT
server: sffe
age: 395715
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7522
x-xss-protection: 0
expires: Fri, 30 Oct 2020 14:15:38 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 79C1 0
0 35ms
35ms Image
text/html 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CgpsdTfbAXevdFYLx-gaKx4S4A6b__qJYl97W3_0JltPLeRABIMyRriJgkYSfhYwYoAHhk83iA8gBAuACAKgDAcgDCKoEmQJP0BZtOsUIXG0szKa9AYvYqKXPLxvYPm_LqxEoN4JlUgnWcKuUGjb3mfZFZb3gu0y_MFaUV592fp5iqycDOmji4RTLbi4RczT0gNHcbyeyceLZnf0UE2nxdwp_ZZqoz-IYFbINbapNCuP9Zvb2MHw4-UeOO-8dNWhO7ZpJ3ut_DTzlVBx4JqM9083NOYlZqRNfU2Yi7B34Z8jVGkAClC_XWTS8rL3gHxRTc2Z_LWYq0worhy0cg9hNdkmZKgZo10yN0Q1VoYYOey_B4GLakWzOXbwBlk5UsV_1j3P92LFo-l04WYt8PbKWGbSE0m4WKSjddDLHEEulFdy6iZCsBaCGI6eSN3od2uUJ2N6wbblgZ3DyzKtU6ZdXCMAEqY6t7qIC4AQBkgUECAQYAZIFBAgFGASgBgKAB4fssh2oB47OG6gH1ckbqAeT2BuoB7oGqAfZyxuoB8_MG6gHpr4b2AcB8gcEEPG8TdIICQiA4YAQEAEYHYAKA9gTDA&sigh=iOO5ztlXDRo&tpd=AGWhJmsyoS5YIYwJ8unAs08Zn4OXLktGc5QzdnjMX3IJzSQzpA
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/031911011734590/ Frame EE71 245 KB
66 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b23897b49c6e2047f39d495d5e6b6691dad263fa42b3fe7079c123e8957f0278

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 67401
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "23b0b3713a3220ce"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame EE71 15 KB
6 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ea7490413386b84bf4d5c1fc162d5b0c16e14485e2eee9787968c8e1288e50c5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5589
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "014536d4b8dbd30e"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame EE71 151 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

145facc26f82ff4153d5cbc697c054ce3b2668fa643e1a7614a473a631f2f981

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41349
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5105fa670a8dcaf4"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame EE71 3 KB
1 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a486bc7e2f639006b88a56adf9972eb44c7537e0e20b829f2eb0f3ce3a3e2071

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5d85dedd438ac1aa"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame EE71 44 KB
14 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

fe80c34f1c5630b2f2150e85cca2b15f6da1e29dab9067fddcc94fd43519d579

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14188
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "783b68e4c5ffe17f"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
DATA 200
OK truncated
/ Frame EE71 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ced2e2a8ddd164afa596d94ab2bd8fb92eab9ac526cf9379eb70048e3c91c8a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 72EA 0
57 B 35ms
35ms Fetch
image/gif 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssEwxGdq2TQvr2p33TDAzBqXQxkKZRpxmiiqTbrJRPUydMoZkc1YYB8mm0Ax2oaPBFpI7k6MkPbRbzr4weC6CJQxCtc5PBcyuhM2W5QaioY9q_jV5BDk_mBhUxKdyxQhWEU23K21T1avFPjSmDnVzRYldL0DrV3ObIdTwV_BmRkjbRso8Jxky6gQEvyDgsm4fccu867l1C6byX1Trq1NTTSV2OionI-TdD3Jf83HXeMv4z55-JpJo5Ua0sfdAhRYPlLjz1QSw8c&sig=Cg0ArKJSzBQ3SHKGsSGTEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 72EA 76 KB
29 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 72EA 305 KB
101 KB 139ms
79ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43574
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/031911011734590/ Frame 5004 245 KB
66 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b23897b49c6e2047f39d495d5e6b6691dad263fa42b3fe7079c123e8957f0278

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 67401
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "23b0b3713a3220ce"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 5004 15 KB
6 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ea7490413386b84bf4d5c1fc162d5b0c16e14485e2eee9787968c8e1288e50c5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5589
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "014536d4b8dbd30e"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 5004 151 KB
40 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

145facc26f82ff4153d5cbc697c054ce3b2668fa643e1a7614a473a631f2f981

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41349
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5105fa670a8dcaf4"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 5004 3 KB
1 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a486bc7e2f639006b88a56adf9972eb44c7537e0e20b829f2eb0f3ce3a3e2071

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "5d85dedd438ac1aa"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/031911011734590/v0/ Frame 5004 44 KB
14 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:825::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031911011734590/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

fe80c34f1c5630b2f2150e85cca2b15f6da1e29dab9067fddcc94fd43519d579

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 277306
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14188
x-xss-protection: 0
server: sffe
date: Fri, 01 Nov 2019 23:09:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "783b68e4c5ffe17f"
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 31 Oct 2020 23:09:07 GMT

GET
DATA 200
OK truncated
/ Frame 5004 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4cc6bb9f4681b01f72eb36f2f5cf12d25b86b3a72d6a88a0a0d2ae7a94d14891

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-36/html/ Frame 1789 0
0 14ms
5ms Document
text/html 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-36/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 3516
date: Tue, 05 Nov 2019 00:53:23 GMT
expires: Wed, 04 Nov 2020 00:53:23 GMT
last-modified: Wed, 16 Oct 2019 15:42:04 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 11850
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame B984 0
57 B 37ms
34ms Fetch
image/gif 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvd8yhzZyGSV6OUV_awPRJf18mwzu6QOGs1rQAJ88NDTLCqjBGBJ-5Jn_kf5qUka8_0daBME2Po4COjutE_bC5y0LXEa8mHzN2dIjGBnQYmodqMdyzDwSZ5tVE17zuvocXD_Kmxhvj6MkUZ9WciDs-mvLbH4EyW79KY4SYeHezfzYne9ejNtQqWUF-r37X-TzJzi-d0OSVuMSVNm5hmiN3A5jjaLCEiCfjtcwgW50ZEtnWMI8XMjTu_nkBBkouKlbKpo9pbH_WX&sig=Cg0ArKJSzLNm5nEtGYDxEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame B984 76 KB
29 KB 17ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame B984 305 KB
101 KB 120ms
68ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43573
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-36/html/ Frame 7D81 0
0 6ms
6ms Document
text/html 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-36/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 3516
date: Tue, 05 Nov 2019 00:53:23 GMT
expires: Wed, 04 Nov 2020 00:53:23 GMT
last-modified: Wed, 16 Oct 2019 15:42:04 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 11850
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame BE9B 0
57 B 34ms
33ms Fetch
image/gif 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssYZcFwe9WwUPXW8zGDzMHRZYuV3Xo0Z7Kczdp-U83r0bx4DXLkipW7gRuEqXoZ0ey6uM1gLbA9brB3ZZaBJuLpDd2BAU3sitgMMVVHJ_t-ywno_n7giZ7RuJ3DnIpVwTtfUN0mPm2sqbdK4BNYTT-ssQcmLYQTKyoNRkepkOn2AzU790WOpkq1-yCMyZ5fY1UKJ_qFejxPnlG2gXM_YNIAHJALmicGp8aELbD0DeTC1DBIgAgXOfnJRUFxcD74tC74iS2wP31G&sig=Cg0ArKJSzJF3xLwGVZlAEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:53 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 adKit.min.js Show response
rev.cbsi.com/common/js/ Frame BE9B 6 KB
2 KB 171ms
29ms Script
application/x-javascript 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://rev.cbsi.com/common/js/adKit.min.js?2046884464
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-143.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
last-modified: Mon, 13 May 2019 18:29:20 GMT
server: Apache
etag: "e524dc608d5c7c30eef57b6ed95dc6a8:1557772160"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
accept-ranges: bytes
content-length: 2149

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame BE9B 76 KB
29 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:53 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame BE9B 305 KB
101 KB 157ms
43ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019103101.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43573
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 14728960760740109698
tpc.googlesyndication.com/simgad/ Frame EE71 50 KB
50 KB 7ms
6ms Image
image/gif 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14728960760740109698

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

721d25c769caf7382904ffa5894ab4666909142ee7632662bd8b56bdc288b2a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Wed, 30 Oct 2019 03:38:04 GMT
x-content-type-options: nosniff
age: 520369
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 50718
x-xss-protection: 0
last-modified: Fri, 27 Sep 2019 09:29:43 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Oct 2020 03:38:04 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame EE71 0
0 14ms
13ms Image
text/html 2a00:1450:4001:825::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQYhp8IcgZEVwhhZkVPN3kNbkHk7ZFTMF7eyVujpxF4KBdCF91BaMJ8YGOhtYPBFYwVvzRCDQ2Z_N3VNZLW4A8NwuX8_w
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame EE71 0
0 36ms
35ms Image
text/html 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CheuUTfbAXezdFYLx-gaKx4S4A5zBmP5ZufL_57gKv-EeEAEgzJGuImCRhJ-FjBigAe6R080DyAED4AIAqAMByAMIqgSZAk_Q1Cu8sfIqWz6W5BupsUfcLA5eMMo7_EGTur-Dr6V65PBEF45dmOkfJ-fOksRQzewdoXjf6CiCqjYUgAm6j3dCIBaVqkPYbKWmiJUy2Mu0mNl2VXO_2K-zu1Be87E6l-W0kEaDh0X5OUc-BZ6eBVPmQSjdPM6VjpOUDBwsEt-RMef9ONrH2KRTc63IMhfBQyXEaiiI3DpiZ_NBWPvoeWtWrStUaojpsFr0ZktwkCVW66w77XK7C9kRQ2wPsxVNLsw_I9B8tyHqyaJC5BrSbiZbS1o3c0X1upzBCq7G68MzPOzv1hWXhp8w6h2qhL_-lRuY2TXdk6WCnDAFMHZ776Wao4KZLSADRn5KR1lX7WJ1t8YOak8ZZxhdwASZjPT5rgLgBAGSBQQIBBgBkgUECAUYBKAGA4AH3_rpe6gHjs4bqAfVyRuoB5PYG6gHugaoB9nLG6gHz8wbqAemvhvYBwHyBwQQu9AY0ggJCIDhgBAQARgdgAoD2BMC&sigh=8fVSwijC35I&tpd=AGWhJmvOIrzgz2Irm0QkOsBjH3WO8av2eubqG_mQhpvO6sxqeg
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

GET
H2 200 9066156818058488628
tpc.googlesyndication.com/simgad/ Frame 5004 7 KB
7 KB 10ms
9ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9066156818058488628?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmWy7O8JSSL8ryePwZO1X7bDrn6Cg

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

36beec5ccc649b93c26715e74c3d79f637b199ee49f26688db9eb2d91cae9da5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Fri, 01 Nov 2019 08:59:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 06 Dec 2018 18:49:18 GMT
server: sffe
age: 328257
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7465
x-xss-protection: 0
expires: Sat, 31 Oct 2020 08:59:56 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 5004 0
0 13ms
13ms Image
text/html 2a00:1450:4001:825::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQmU7IU1yl5ic0Ibg65kVkFieGmfKIDVO6iVEpYl5efPBYBSWbmX_v__whJ7WbTgRe4OWDHKFVT0IwTi2V3bEQ7L-SGlg
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5004 0
0 36ms
35ms Image
text/html 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C3pPNTfbAXe7dFYLx-gaKx4S4A8yi_IpWgvX2gNMIs76H6JAOEAEgzJGuImCRhJ-FjBigAf_bisgDyAEC4AIAqAMByAMIqgSeAk_QdY3V8opnG6dcl9lZFgG7EuIHKJ9KBxP52AHmGnG6duovyEwHIejAtDdTwxtrOt9AGfpKvY0US_e8eGRZ3O31K1tOZMb8STJ96NYpUZ2Ijw9Lxg6-14wJ9AmQmrIpfBaPX6L5wuwAr6rciE1uojidioJ62PReOyKdzKEKeNfU7Aas39I99cfJOAqSdTZO9t99Y6Z-JwlP29osynofd8yolcUQYpwKE6KBTwFcJub_PF3dElPvxRy92EqjhAXmJDkDHpXQM-DssPm438idNshoOYWv7JAeNMUERlhqYUNHdU-ZRfFAaBLh8evg9tzk9a7b_Jr9fjuGYnzr3MrRbWF67WpJAtzyVc_Skvc5-OFOxgwgqMnHDp7PliRrFVvABMKVzOnuAeAEAZIFBAgEGAGSBQQIBRgEoAYCgAeG85wJqAeOzhuoB9XJG6gHk9gbqAe6BqgH2csbqAfPzBuoB6a-G9gHAfIHBBD-owjSCAkIgOGAEBABGB2ACgPYEwyYFgE&sigh=D_H1Rve4stQ&tpd=AGWhJmuc-LMqcWhLXqnOoxMiPp7M9z44ZU6uLNz1J1-vAKTBbw
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s22-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

POST
H2 200 /
www.facebook.com/tr/ Frame 36E4 0
0 7ms
6ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 4881
pragma: no-cache
cache-control: no-cache
origin: https://www.zdnet.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
cookie: fr=0TgNdptRrjjHn2aaY..BdwPZN...1.0.BdwPZN.
Origin: https://www.zdnet.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 200
content-type: text/plain
access-control-allow-origin: https://www.zdnet.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0
server: proxygen-bolt
alt-svc: h3-23=":443"; ma=3600
date: Tue, 05 Nov 2019 04:10:53 GMT

GET
H2 404 tboptevent.html
widget.perfectmarket.com/opt/ Frame 62E2 0
0 25ms
24ms Document
text/plain 151.101.113.181
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by: Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.181 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

:method: GET
:authority: widget.perfectmarket.com
:scheme: https
:path: /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 404
server: Varnish
retry-after: 0
accept-ranges: bytes
date: Tue, 05 Nov 2019 04:10:54 GMT
via: 1.1 varnish
x-served-by: cache-hhn4021-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1572927054.171023,VS0,VE0
content-length: 0

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 79C1
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
14ms

Image
text/html

2a00:1450:4001:816::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Redirect headers

date: Tue, 05 Nov 2019 04:10:54 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame EE71
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
13ms

Image
text/html

2a00:1450:4001:816::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Redirect headers

date: Tue, 05 Nov 2019 04:10:54 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 5004
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
14ms

Image
text/html

2a00:1450:4001:816::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Redirect headers

date: Tue, 05 Nov 2019 04:10:54 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 n.js Show response
geo.moatads.com/ Frame F682 107 B
281 B 86ms
31ms Script
text/html 35.176.192.147
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Du_b7jPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054290&de=23446496929&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=2&cb=0&ym=0&cu=1572927054290&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1237645789&cs=0&callback=MoatSuperV26.gna127778
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.192.147 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-176-192-147.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: d401c0d3ad09b95bd45b13050f037943715a937ff8ba40b1271eb3474cc892f8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
server: TornadoServer/4.5.3
etag: "66d4cbe2caf4329f639fdc1c7e3e9f7852b41547"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 107

GET
H2 200 n.js Show response
geo.moatads.com/ 104 B
279 B 85ms
31ms Script
text/html 35.176.192.147
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Du_b7jPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054290&de=23446496929&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=3&cb=0&ym=0&cu=1572927054290&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1182650174&cs=0&callback=MoatDataJsonpRequest
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.192.147 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-176-192-147.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 66d46082c36abed0adf1e5f8023f3d0886c6700fb1d36186782f52507274b5a8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
server: TornadoServer/4.5.3
etag: "55d1f331687581186a36e41db39e77ddf684337d"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 104

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 79ms
25ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054290&de=23446496929&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=4&cb=0&ym=0&cu=1572927054290&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745699004%3A138245072116&zMoatPS=nav&zMoatPT=article&zMoatW=5&zMoatH=5&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=5x5&zMoatSZPS=5x5%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1348418226&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ Frame B984 107 B
281 B 65ms
29ms Script
text/html 35.176.192.147
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Du_b7jPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054333&de=16166421131&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=7&cb=0&ym=0&cu=1572927054333&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatW=641&zMoatH=321&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1674000772&cs=0&callback=MoatSuperV26.gna545313
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.192.147 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-176-192-147.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 96a4628ab5b757263dc2f71d2e408d0b7e7dad82c524fa34bf3b37abca85e373

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
server: TornadoServer/4.5.3
etag: "9c71127a55cfeb96c7dcb7209a291508dc38679d"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 107

GET
H2 200 n.js Show response
geo.moatads.com/ Frame 72EA 106 B
280 B 63ms
35ms Script
text/html 35.176.192.147
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Du_b7jPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054341&de=4508196024&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=12&cb=0&ym=0&cu=1572927054341&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344190&zMoatPS=top&zMoatPT=article&zMoatW=11&zMoatH=11&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=769267837&cs=0&callback=MoatSuperV26.gna612903
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.192.147 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-176-192-147.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: bc60af98deb4942d71c77a362540c58f301d636336439671496d27935778770e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
server: TornadoServer/4.5.3
etag: "06a4c56b177216d91f76a4822c231533602b1cdf"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 106

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame BE9B 48 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?2046884464

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c669c3d0725ad3cc94bb45a1dc376703b71bf6882bf9dc6e0e53571c80c98460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "327 / 585 of 1000 / last-modified: 1572905343"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15239
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 79C1 0
56 B 99ms
98ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1572927054412&qqid=CKu4l_KZ0uUCFYK43godiiMBNw&rt=a4a.link.4.11.4.h.e.0.1g3l.1g09~cdn.script.5.r.4.8.0.0.4dk.4b9~aa.script.5.v.4.c.0.0.vzf.vwl~cdn.script.5.n.0.8.0.0.156.12v~cdn.script.5.m.1.7.0.0.bmt.ay4~simg.img.b.8.0.7.0.0.5wz.5sy~any.img.b.10.1b.0.0.0.0.0&met.a4a=dcl.0~ol.~nvs.1572927053875~ini.1572927054412
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/v0/amp-analytics-0.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame EE71 0
56 B 98ms
98ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1572927054418&qqid=CKy4l_KZ0uUCFYK43godiiMBNw&rt=a4a.link.2.g.4.b.0.0.1g31.1g09~cdn.script.2.b.0.a.0.0.4d1.4b9~aa.script.3.e.6.7.0.0.vyv.vwl~cdn.script.3.e.2.b.0.0.14n.12v~cdn.script.3.e.3.b.0.0.azw.ay4~simg.img.14.i.a.6.0.0.139o.134u~any.img.14.f.1i.0.0.0.0.0~any.img.14.10.24.0.0.0.0.0&met.a4a=dcl.0~ol.~nvs.1572927053905~ini.1572927054418
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/v0/amp-analytics-0.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 5004 0
56 B 99ms
99ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1572927054422&qqid=CK64l_KZ0uUCFYK43godiiMBNw&rt=a4a.link.2.i.9.7.0.0.1g31.1g09~cdn.script.2.9.1.6.0.0.4d1.4b9~aa.script.2.h.6.9.0.0.vyv.vwl~cdn.script.2.b.1.9.0.0.14n.12v~cdn.script.2.b.1.8.0.0.azw.ay4~simg.img.w.a.0.9.0.0.5ul.5rd~any.img.w.e.1a.0.0.0.0.0~any.img.w.11.1x.0.0.0.0.0&met.a4a=dcl.0~ol.~nvs.1572927053916~ini.1572927054423
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/v0/amp-analytics-0.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame BE9B 109 B
319 B 14ms
14ms Script
application/javascript 2a00:1450:4001:806::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame BE9B 109 B
171 B 15ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019102802.js Show response
securepubads.g.doubleclick.net/gpt/ Frame BE9B 156 KB
57 KB 32ms
31ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019102802.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

d337068541ae8b2f8c9585b458f43a411709aa557240d4c209a812e02d1c7bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 28 Oct 2019 19:34:12 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 58593
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ Frame BE9B 105 B
280 B 31ms
30ms Script
text/html 35.176.192.147
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%7DGM%3Dh%2CqkG%24%7Du_b7jPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBny6BsNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF6GfC6Jn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054459&de=774974516859&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=17&cb=0&ym=0&cu=1572927054459&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=506874115&cs=0&callback=MoatSuperV26.gna768319
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.192.147 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-35-176-192-147.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 4546debdd0aaae70a75c29b804e3968f1060456c3ca00396b349058a46b15f0a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
server: TornadoServer/4.5.3
etag: "0286ddd3da3553a2f95b06b7943624960bdd6bb9"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 105

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 25ms
25ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054333&de=16166421131&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=9&cb=0&ym=0&cu=1572927054333&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745327422%3A138239368367&zMoatPS=top&zMoatPT=article&zMoatW=641&zMoatH=321&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=641x321&zMoatSZPS=641x321%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=119563125&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame B984 49 KB
19 KB 25ms
24ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

24270887b28394cc0716af7ea1928f143c323120b1716ce547e31a77faa832c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 03:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2227
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19111
x-xss-protection: 0
server: cafe
etag: 5740004246786903836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Nov 2019 04:33:47 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame F682 49 KB
19 KB 26ms
25ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

24270887b28394cc0716af7ea1928f143c323120b1716ce547e31a77faa832c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 03:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2227
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19111
x-xss-protection: 0
server: cafe
etag: 5740004246786903836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Nov 2019 04:33:47 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 72EA 49 KB
19 KB 26ms
25ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

24270887b28394cc0716af7ea1928f143c323120b1716ce547e31a77faa832c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 03:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2227
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19111
x-xss-protection: 0
server: cafe
etag: 5740004246786903836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Nov 2019 04:33:47 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 25ms
25ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054341&de=4508196024&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=14&cb=0&ym=0&cu=1572927054341&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745189935%3A138239344190&zMoatPS=top&zMoatPT=article&zMoatW=11&zMoatH=11&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=11x11&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1846659886&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame BE9B 29 KB
7 KB 108ms
107ms XHR
text/plain 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3798155975270491&correlator=2620892970042842&output=ldjh&impl=fifs&adsid=NT&eid=21065050%2C21063204%2C21065018&vrg=2019102802&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=1&sfv=1-0-36&ecs=20191105&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Dh%26subses%3D1%26ptype%3Darticle%26vguid%3Dfd535992-ecdd-4096-8d70-2d3ec6ec661d%7Cenv%3Dprod%26session%3Dh%26subses%3D1%26ptype%3Darticle%26vguid%3Dfd535992-ecdd-4096-8d70-2d3ec6ec661d&cookie=ID%3D346a16b41ea6ce3a%3AT%3D1572927053%3AS%3DALNI_Mb_0-Cfs7WdDa6QmvIZZ3Sx0sxVMg&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1572927054&dt=1572927054516&dlt=1572927053939&idt=564&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=rhzdtayitbho%7Cmm16un56zumi&ifi=1&ifk=3744544631&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&dssz=21&icsg=43552&std=0&rumc=8835423987929548&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=684511435.1572927053&ga_sid=1572927055&ga_hid=2132128142&fws=384%2C384&ohw=0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019102802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

ec979c781c91981a9509f24978a570376befe9f94ef52602396d0831e6a6fe0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7059
x-xss-protection: 0
google-lineitem-id: 4746066197,4746066197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138239375180,138239479696
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019102802.js Show response
securepubads.g.doubleclick.net/gpt/ Frame BE9B 64 KB
24 KB 32ms
32ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019102802.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019102802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

sffe /

Resource Hash

e1efb959e459b99979a76dce8a977b55d4e4b82ccd85264d7644455789793b3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 28 Oct 2019 19:34:12 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25002
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-36/html/ Frame BE9B 0
0 6ms
6ms Other
text/html 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html?n=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019102802.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 35ms
35ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054459&de=774974516859&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=19&cb=0&ym=0&cu=1572927054459&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=2096341812&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 05 Nov 2019 04:10:54 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame B984 0
56 B 99ms
99ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k2lc5mtb&chm=1&ctx=2&qqid=CI3ZkvKZ0uUCFYK43godiiMBNw&met.4=fb.3~lb.6y~ol.f5~idt.-50~dt.-jq&met.3=197.6y~123.6x_1~118.78~118.co~118.co~118.co~118.cu~118.d3~118.ei~118.ei~118.f4~117.f5~118.f7~113.go_2~112.gn_3&met.1=1.k2lc5mco~14.0~15.0~16.0~17.0~18.0~19.0~20.f5~21.f5&met.7=CCIQBBgBIAQoBDAqOCZoCHApeDmwAQG4AQM~CCoQChgBIAQoBDAXOBM~CBsQCiAFOH8~CBsQCiCZAzhB~CCgQChgBIKQEKKQEML4EOBtopQRwvQR475UBgAGnlQGIAfmHA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame F682 0
56 B 99ms
98ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k2lc5mth&chm=1&ctx=2&qqid=CIbZkvKZ0uUCFYK43godiiMBNw&met.4=fb.e~lb.3s~ol.h9~idt.-2x~dt.-hn&met.3=197.3r~123.3p_3~118.98_1~118.9a~197.9s~118.eq~197.f1~118.f2~118.f6~118.f7~118.f7~118.gl~118.gl~118.gm~118.h7~117.h8~118.ha~113.iw_1~112.iw_1&met.1=1.k2lc5mal~14.1~15.1~16.1~17.1~18.1~19.1~20.h8~21.h8&met.7=CCIQBBgBIA8oDzAzOCRoEHAyeEuwAQG4AQM~CCoQChgBIBEoETA1OCQ~CBsQCiAROLoB~CBsQCiDRAzhW~CCgQChgBIO8EKO8EMIsFOBxo8ARwigV475UBgAGnlQGIAfmHA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 72EA 0
56 B 99ms
99ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k2lc5mti&chm=1&ctx=2&qqid=CIrZkvKZ0uUCFYK43godiiMBNw&met.4=fb.3~lb.4q~ol.fp~idt.-4i~dt.-j8&met.3=197.4q~123.4p_1~118.7p~118.7p~197.a6~118.c8~118.c8~118.d5~118.d5~118.db~118.dh~118.ek~118.f0~118.fm~117.fp~118.fr~113.hc~112.hc_1&met.1=1.k2lc5mc6~14.0~15.0~16.0~17.0~18.0~19.0~20.fo~21.fp&met.7=CCIQBBgBIAMoAzAnOCRoA3AmeDmwAQG4AQM~CCoQChgBIAMoAzAXOBM~CBsQCiAEOJIB~CBsQCiC0Azg_~CCgQChgBILkEKLkEMNQEOBtouQRw0gR475UBgAGnlQGIAfmHA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame BE9B 49 KB
19 KB 25ms
24ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019102802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

24270887b28394cc0716af7ea1928f143c323120b1716ce547e31a77faa832c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 03:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2227
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19111
x-xss-protection: 0
server: cafe
etag: 5740004246786903836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Nov 2019 04:33:47 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame BE9B 49 KB
19 KB 24ms
23ms Script
text/javascript 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

24270887b28394cc0716af7ea1928f143c323120b1716ce547e31a77faa832c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 03:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2227
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19111
x-xss-protection: 0
server: cafe
etag: 5740004246786903836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Nov 2019 04:33:47 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BE9B 0
606 B 26ms
14ms Image
image/gif 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=www.zdnet.com&pg_h=0&pg_w=371&c=0&aa_c=0&dt=d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 12 KB
5 KB 307ms
306ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=05%3A10%3A54.624&lti=deflated&data=%7B%22id%22%3A161%2C%22ii%22%3A%22%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1572927054622%2C%22cv%22%3A%2220191103-15-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1585%2C%22dh%22%3A5810%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A5090.078125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191103-15-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: 7291a55cb2f1698af604e1fea9a324c97c3af9cb1bdea5c7008f2a773d5f5997

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-vcl-time-ms: 282
date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
access-control-allow-origin: *
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 200
x-served-by: cache-hhn4031-HHN
server: nginx
x-timer: S1572927055.639877,VS0,VE282
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 csi
csi.gstatic.com/ Frame BE9B 0
56 B 99ms
98ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k2lc5mvw&c=8835423987929548&e=21065050%2C21063204%2C21065018&ctx=1&met.1=1.k2lc5mcz~14.0~15.0~16.0~17.0~18.0~19.0~20.i3~21.i4&met.3=113.ix~112.iw_1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 5775 0
143 B 34ms
33ms Fetch
image/gif 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7y2azNalAnWkcciKTY18pYmrxUakK5BHkH3qm-QbMT0rz4qHyyeMStKKRLOfs3uLS_WAh6y8T8TogH81JsR8AyZxjHe3GN2TU57_8xYqXLL8SfnIKULv2hcuDBxlU0Tqa3842e2W8ZlZx47JXQ9J95GkAt3O6S5fAWeUTPfKJtP7T5_5lJ2iba24h5ap7YwrMIVRKXv18az0rxasnWlt9o0MdJNwYfZhbqAzbyOqnU33fW16eeBHZxHJjW-GcujMgBjn5_eJ8&sig=Cg0ArKJSzIYdV2bnnWWDEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:54 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5775 76 KB
29 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 5775 305 KB
101 KB 29ms
29ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019102802.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43573
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame BE9B 78 KB
29 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019102802.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a71cc134826b38085a6d63bca1e00de7ab8518ae02f7b5e2ae46cf11781e44e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29301
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 708E 0
57 B 37ms
37ms Fetch
image/gif 172.217.23.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuR2aaJ93e4rxrKspd0Jrlk3AB2oUGPWsyvxJZuv0smU0WDjjy4_8Pdqko2H9QYHdzGjKVMFLEqp_UefXj3KW65A9TrQq7JW7hgzh61vt1DXOkdR1Hza1L3bpLp1BUPh7U2GBpNFNuuU42pEJ3W_f1w_5xuQrhn2arStF_iVtcvwm-QReLGSWDyfDiMOfEcX9I9CKWTF7iqjelJIb1d2656DtX1NcVJawPPZxxuI89GBBIebPajOquksu9036XfxlCfPhYoqhUB&sig=Cg0ArKJSzLW2k9846THnEAE&urlfix=1&adurl=

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 05 Nov 2019 04:10:54 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 708E 76 KB
29 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:817::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1572633785634088"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29108
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H/1.1 200
OK moatad.js Show response
z.moatads.com/cbsdfp5832910442/ Frame 708E 305 KB
101 KB 27ms
27ms Script
application/x-javascript 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019102802.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Tue, 05 Nov 2019 04:10:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 19:12:57 GMT
Server: AmazonS3
x-amz-request-id: 9073494F6B56554C
ETag: "90057ee6dd9ded5b49509cb6336f58d4"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43573
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103402
x-amz-id-2: JkWVyxWEgoGOT3jcfEr/fASs/xeXYB8BYjfHiyF4qOI6mkl+30Y/RcSg8ulIRLxqiBpf5VVLw3A=

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 26ms
25ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054686&de=388451063364&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=23&cb=0&ym=0&cu=1572927054686&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239375180&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=551424129&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H/1.1 200
OK pixel.gif
px.moatads.com/ 43 B
409 B 25ms
25ms Image
image/gif 2.18.235.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CBSDFPCW2&hp=1&wf=1&vb=10&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1572927054699&de=842375069745&m=0&ar=45a16fc5efb-clean&iw=c5a7985&q=27&cb=0&ym=0&cu=1572927054699&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4746066197%3A138239479696&zMoatPT=article&zMoatW=372&zMoatH=142&zMoatVGUID=fd535992-ecdd-4096-8d70-2d3ec6ec661d&zMoatSN=h&zMoatCURL=zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices&zMoatDev=Desktop&zMoatAType=content_article&zMoatTest=zdnet&zMoatMMV_MAX=na&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%2F&id=1&bo=23605329&bp=23619609&bd=-&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=372x142&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-zdnet&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&ti=0&ih=1&iq=na&tt=na&tu=&tp=&fs=171894&na=1545811961&cs=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: Apache
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 05 Nov 2019 04:10:54 GMT

GET
H2 200 userx.20191103-15-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ 22 KB
8 KB 24ms
24ms Script
application/javascript 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20191103-15-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bc54dbec1b5aa648f8a30cf7a98c3a75db9dcaca90f07b52cd29aac411b98e73

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-amz-version-id: e8SyQV8MkFOrrHb3D_zEQtsbzUNIu2Rr
content-encoding: gzip
etag: "f3cf9c15fe0f10d53acf72e2e2170552"
age: 114
x-cache: HIT
status: 200
x-amz-replication-status: PENDING
content-length: 7712
x-amz-id-2: 6xhAs3Rbex90vRnzVjvLovZCk1sXMfJBG2n4fKsZEk0nhBTzHxu5AUUwtJkv4Yy3EujPLOpawII=
x-served-by: cache-hhn4031-HHN
last-modified: Sun, 03 Nov 2019 15:06:20 GMT
server: AmazonS3
x-timer: S1572927055.962613,VS0,VE0
date: Tue, 05 Nov 2019 04:10:54 GMT
vary: Accept-Encoding
x-amz-request-id: 376409308B60D503
via: 1.1 varnish
cache-control: private,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 75
x-cache-hits: 69

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
272 B 109ms
108ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=8df5ec8f6f739692ccb86b1a73064d06&sd=v2_751caaff69086f36c11fa3e285cd57d7_d32634d9-d958-44e5-81e5-23789fb62166-tuct4ba7bce_1572927054_1572927054_CNawjgYQzro_GJ7GiM7jLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices&wi=8361332318917752809&pt=text&vi=1572927054622&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fnew-unremovable-xhelper-malware-has-infected-45000-android-devices%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=05%3A10%3A54.957&id=4315&llvl=1&cv=20191103-15-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-vcl-time-ms: 84
date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 204
x-served-by: cache-hhn4031-HHN
pragma: no-cache
server: nginx
x-timer: S1572927055.971625,VS0,VE84
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
61 B 110ms
110ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=deflated&ri=8df5ec8f6f739692ccb86b1a73064d06&sd=v2_751caaff69086f36c11fa3e285cd57d7_d32634d9-d958-44e5-81e5-23789fb62166-tuct4ba7bce_1572927054_1572927054_CNawjgYQzro_GJ7GiM7jLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices&wi=8361332318917752809&pt=text&vi=1572927054622&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A362%2C%22ly%22%3A518%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A670%2C%22ly%22%3A518%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=05%3A10%3A54.957&id=5217&llvl=1&cv=20191103-15-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-vcl-time-ms: 86
date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 204
x-served-by: cache-hhn4031-HHN
pragma: no-cache
server: nginx
x-timer: S1572927055.972072,VS0,VE86
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 available Show response
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
78 B 135ms
134ms XHR
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/available?route=AM%3AAM%3AV&lti=deflated
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191103-15-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-vcl-time-ms: 110
date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 204
x-served-by: cache-hhn4031-HHN
pragma: no-cache
server: nginx
x-timer: S1572927055.983541,VS0,VE110
content-type: image/gif
access-control-allow-origin: https://www.zdnet.com
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 f02d5297461542b08216faf492903ea2.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/f0/2d/ 11 KB
12 KB 29ms
28ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/f0/2d/f02d5297461542b08216faf492903ea2.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 0a5083fb94cc5b5234f2dc8c7c461085b1e19896386890b1e86890e1d0d38771

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
via: 1.1 varnish, 1.1 varnish
age: 860972
edge-cache-tag: 555221938228660630819934563179970428897,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 09 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/f0/2d/f02d5297461542b08216faf492903ea2.jpg
content-length: 11601
x-served-by: cache-hhn4063-HHN, cache-hhn4031-HHN
last-modified: Wed, 09 Oct 2019 11:32:46 GMT
server: cloudinary
x-timer: S1572927055.986095,VS0,VE0
etag: "a275a5be196298a86d3242a5ffc97984"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 006.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/moskinator/235/ 20 KB
21 KB 27ms
26ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/moskinator/235/006.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: dd610925573518954a1d1d96bbc63f67a0dcc8a6748a667d7a6b270dd5efabf9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
via: 1.1 varnish, 1.1 varnish
age: 1611322
edge-cache-tag: 495535640218843591745769390109835197496,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sun, 17 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/moskinator/235/006.jpg
content-length: 20498
x-served-by: cache-hhn4081-HHN, cache-hhn4031-HHN
last-modified: Thu, 17 Oct 2019 12:15:30 GMT
server: cloudinary
x-timer: S1572927055.985469,VS0,VE0
etag: "447f4ac4e6bee16e5d265487c6ad08a6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 25

GET
H2 200 913332084__dMbzD1uQ.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/ 9 KB
9 KB 27ms
26ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/913332084__dMbzD1uQ.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: d6ad9976b40a4c963721165b772c6e1b26ff43662cc057c1d04affe650c5cbf4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
via: 1.1 varnish, 1.1 varnish
age: 1547759
edge-cache-tag: 483249848154268923491408030784837389179,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Wed, 30 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/913332084__dMbzD1uQ.jpg
content-length: 8868
x-served-by: cache-hhn4054-HHN, cache-hhn4031-HHN
last-modified: Sun, 29 Sep 2019 02:12:42 GMT
server: cloudinary
x-timer: S1572927055.987420,VS0,VE0
etag: "35d12088f1244f953d562b759d0fa8d6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 tbp Show response
15.taboola.com/ 6 KB
7 KB 174ms
60ms Script
text/html 151.101.14.49
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://15.taboola.com/tbp?oid=15&pubid=166277&tagid=948107&pstn=[pstn]&cb=[cb]&callback=TRC.pVideoCallbacks.videoCallback1
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191103-15-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx/1.13.12 /
Resource Hash: 40f093ff956ad29b9f14daea1a447cf2225cb7ff52ed7f4d2c6b2d1acdc15390

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
server: nginx/1.13.12
x-timer: S1572927055.104046,VS0,VE14
machineid: 1415
x-cache: MISS
content-type: text/html;charset=ISO-8859-1
status: 200
expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
x-cache-hits: 0
accept-ranges: bytes
content-length: 6304
x-served-by: cache-fra19158-FRA

GET
H2 200 mcjiwsxqqeliiaxce6zh.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v15... 12 KB
13 KB 75ms
74ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v1572358097/mcjiwsxqqeliiaxce6zh.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e56c17581b625cf16e555e90ed3819088f230c36bf02930e46925a79bbff6b88

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:54 GMT
via: 1.1 varnish, 1.1 varnish
age: 550544
edge-cache-tag: 566810444655474971004264967369376706962,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 29 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v1572358097/mcjiwsxqqeliiaxce6zh.jpg
content-length: 12768
x-served-by: cache-hhn4055-HHN, cache-hhn4031-HHN
last-modified: Tue, 29 Oct 2019 16:07:44 GMT
server: cloudinary
x-timer: S1572927055.991179,VS0,VE1
etag: "488c188e9cf4e428ba15db5f2a05b80c"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 204 abtests
trc.taboola.com/cbsinteractive-zdnet/log/3/ 0
61 B 127ms
126ms Image
image/gif 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/3/abtests?route=AM:AM:V&lti=deflated&ri=8df5ec8f6f739692ccb86b1a73064d06&sd=v2_751caaff69086f36c11fa3e285cd57d7_d32634d9-d958-44e5-81e5-23789fb62166-tuct4ba7bce_1572927054_1572927054_CNawjgYQzro_GJ7GiM7jLSABKAEwoQE4l-oLQJmXEEiBzxtQ____________AVgBYAA&pi=/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices&wi=8361332318917752809&pt=text&vi=1572927054622&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22p-video-overlay__overlay-created-on-item%22%2C%22type%22%3A%22%7B%5C%22itemId%5C%22%3A%5C%22~~V1~~-4728123221873291972~~XBJBL65APk9TaOKjiJOsdTSLaHr7ktcoIzMaVinoFyzTxvAnL2wqac4MyzR7uD46gj3kUkbS3FhelBtnsiJV6MhkDZRZzzIqDobN6rWmCPCnheSYBfQjQl4W1hYHucoUugS2zB_UQVYvmRKJYxb2k-B4jvM8Bcxx-mGFaSRchQFHeC5Qhh6rdNaCpokrQ4nDTS8Maux2jWC1gRU3nx5A7kchcA-V62U9N99J9-T6Zbk%5C%22%2C%5C%22publisher%5C%22%3A%5C%22meetic-fr-sc%5C%22%7D%22%2C%22eventTime%22%3A1572927054976%7D&tim=05%3A10%3A54.976&id=1846&llvl=1&cv=20191103-15-RELEASE&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-vcl-time-ms: 102
date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status: 204
x-served-by: cache-hhn4031-HHN
pragma: no-cache
server: nginx
x-timer: S1572927055.991503,VS0,VE102
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H2 204 debug
trc.taboola.com/cbsinteractive-zdnet/log/2/ 0
137 B 76ms
76ms Image
text/plain 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/cbsinteractive-zdnet/log/2/debug?tim=05%3A10%3A54.977&type=warn&msg=p-video-overlay__overlay-created-on-item&id=3466&cv=20191103-15-RELEASE&lt=deflated&itemId=~~V1~~-4728123221873291972~~XBJBL65APk9TaOKjiJOsdTSLaHr7ktcoIzMaVinoFyzTxvAnL2wqac4MyzR7uD46gj3kUkbS3FhelBtnsiJV6MhkDZRZzzIqDobN6rWmCPCnheSYBfQjQl4W1hYHucoUugS2zB_UQVYvmRKJYxb2k-B4jvM8Bcxx-mGFaSRchQFHeC5Qhh6rdNaCpokrQ4nDTS8Maux2jWC1gRU3nx5A7kchcA-V62U9N99J9-T6Zbk&publisher=meetic-fr-sc&syndicatorId=undefined
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Tue, 05 Nov 2019 04:10:54 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1572927055.998944,VS0,VE0
x-served-by: cache-hhn4031-HHN
x-cache: HIT
content-type
status: 204
cache-control: no-store
accept-ranges: bytes
retry-after: 0
x-cache-hits: 0

GET
H2 200 39310_57-36.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//bg.search.etargetnet.com/frontend/logos/bg/39310/ 8 KB
9 KB 151ms
81ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//bg.search.etargetnet.com/frontend/logos/bg/39310/39310_57-36.jpeg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f5875bf6aa02ab43424f94a70b0224339d5451f32d2a4d26dec041a77ddc0512

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1191707
edge-cache-tag: 390909426062750942237347788620304514325,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 22 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//bg.search.etargetnet.com/frontend/logos/bg/39310/39310_57-36.jpeg
content-length: 8634
x-served-by: cache-hhn4022-HHN, cache-hhn4031-HHN
last-modified: Tue, 22 Oct 2019 08:32:45 GMT
server: cloudinary
x-timer: S1572927055.095362,VS0,VE0
etag: "4a6e9664ca5fa14cb8c0f77ad484b431"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 c71c4f9cec571938ad39872f23225347.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 13 KB
13 KB 150ms
80ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c71c4f9cec571938ad39872f23225347.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e6740b9e9fb50509eb4c156020598c7d642134a5c8fc06c7a17aaf142a22efbc

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 2305352
edge-cache-tag: 525769444326912909846847412409788498676,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Thu, 07 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c71c4f9cec571938ad39872f23225347.jpg
content-length: 13054
x-served-by: cache-hhn4035-HHN, cache-hhn4031-HHN
last-modified: Mon, 07 Oct 2019 09:16:12 GMT
server: cloudinary
x-timer: S1572927055.094908,VS0,VE0
etag: "68f2a39029391b96fda548288ba8dda5"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 7

GET
H2 200 1485d0ac-d77a-4afb-a623-a44c7df37815.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/ 11 KB
11 KB 96ms
80ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/1485d0ac-d77a-4afb-a623-a44c7df37815.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 0b5c5144fdbf7f80b7ab3dc8c7112f5bb45452038b6e454fbaab9d630720feda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1037687
edge-cache-tag: 430749908300593934141868141051169879563,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 23 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/1485d0ac-d77a-4afb-a623-a44c7df37815.jpg
content-length: 11215
x-served-by: cache-hhn4040-HHN, cache-hhn4031-HHN
last-modified: Wed, 23 Oct 2019 16:57:32 GMT
server: cloudinary
x-timer: S1572927055.095361,VS0,VE1
etag: "4d3b572a16c6b6a6e2407779c12ec19c"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 2ea246b39e972af4967fecf5e5c736b0.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/ 23 KB
24 KB 94ms
77ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/2ea246b39e972af4967fecf5e5c736b0.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 961702e2f40297f38533f95eb21b5cab63eaa796f7d1c5310e3af6147c7a4b4d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 105495
edge-cache-tag: 487621542778181763354932746247231261534,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 08 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/2ea246b39e972af4967fecf5e5c736b0.jpg
content-length: 23880
x-served-by: cache-hhn4044-HHN, cache-hhn4031-HHN
last-modified: Tue, 08 Oct 2019 07:53:09 GMT
server: cloudinary
x-timer: S1572927055.095254,VS0,VE1
etag: "cb97a999bb1c4a6b73d5e3fc1a92b86b"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 1

GET
H2 200 f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 254 B
734 B 91ms
75ms Image
image/png 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191103-15-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via: 1.1 varnish
etag: "dfa7b52c86e56bd67fa4002f6ed19854"
age: 16940
x-cache: HIT
status: 200
x-amz-replication-status: COMPLETED
content-length: 254
x-amz-id-2: grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by: cache-hhn4031-HHN
last-modified: Wed, 24 Jun 2015 07:14:11 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer: S1572927055.094661,VS0,VE0
date: Tue, 05 Nov 2019 04:10:55 GMT
x-amz-request-id: 29D722C296265892
cache-control: private,max-age=31536000
accept-ranges: bytes
content-type: image/png
abp: 75
x-cache-hits: 5404

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/f0/2d/f02d5297461542b08216faf492903ea2.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 0a5083fb94cc5b5234f2dc8c7c461085b1e19896386890b1e86890e1d0d38771

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 860972
edge-cache-tag: 555221938228660630819934563179970428897,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 09 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//media.workandmoney.com/f0/2d/f02d5297461542b08216faf492903ea2.jpg
content-length: 11601
x-served-by: cache-hhn4063-HHN, cache-hhn4031-HHN
last-modified: Wed, 09 Oct 2019 11:32:46 GMT
server: cloudinary
x-timer: S1572927055.101490,VS0,VE0
etag: "a275a5be196298a86d3242a5ffc97984"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 006.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/moskinator/235/ 20 KB
20 KB 84ms
65ms Image
image/jpeg 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/moskinator/235/006.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: dd610925573518954a1d1d96bbc63f67a0dcc8a6748a667d7a6b270dd5efabf9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1611322
edge-cache-tag: 495535640218843591745769390109835197496,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sun, 17 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//blogs.dailylifetech.com/b/moskinator/235/006.jpg
content-length: 20498
x-served-by: cache-hhn4081-HHN, cache-hhn4031-HHN
last-modified: Thu, 17 Oct 2019 12:15:30 GMT
server: cloudinary
x-timer: S1572927055.101485,VS0,VE0
etag: "447f4ac4e6bee16e5d265487c6ad08a6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 26

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/913332084__dMbzD1uQ.jpg
Requested by: Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: d6ad9976b40a4c963721165b772c6e1b26ff43662cc057c1d04affe650c5cbf4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1547759
edge-cache-tag: 483249848154268923491408030784837389179,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Wed, 30 Oct 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/913332084__dMbzD1uQ.jpg
content-length: 8868
x-served-by: cache-hhn4054-HHN, cache-hhn4031-HHN
last-modified: Sun, 29 Sep 2019 02:12:42 GMT
server: cloudinary
x-timer: S1572927055.171650,VS0,VE0
etag: "35d12088f1244f953d562b759d0fa8d6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v1572358097/mcjiwsxqqeliiaxce6zh.jpg
Requested by: Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e56c17581b625cf16e555e90ed3819088f230c36bf02930e46925a79bbff6b88

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 550544
edge-cache-tag: 566810444655474971004264967369376706962,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 29 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v1572358097/mcjiwsxqqeliiaxce6zh.jpg
content-length: 12768
x-served-by: cache-hhn4055-HHN, cache-hhn4031-HHN
last-modified: Tue, 29 Oct 2019 16:07:44 GMT
server: cloudinary
x-timer: S1572927055.171803,VS0,VE0
etag: "488c188e9cf4e428ba15db5f2a05b80c"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

GET
H2 200 creative_js.js Show response
vidstat.taboola.com/vpaid/units/14_12_0/creatives/ 4 KB
2 KB 80ms
25ms Script
application/javascript 151.101.14.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20191103-15-RELEASE.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 10eba73b3641332bde05fa8d6223e7017ac5207673602247c35f358ea89e3092

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront), 1.1 varnish
age: 1808076
x-amz-meta-mtime: 1499351521
x-cache: Hit from cloudfront, HIT
status: 200
x-amz-meta-mode: 33188
content-encoding: gzip
content-length: 1827
x-served-by: cache-fra19132-FRA
last-modified: Wed, 06 Sep 2017 08:46:00 GMT
server: AmazonS3
x-timer: S1572927055.232224,VS0,VE0
etag: "0df6cb700db4e2c8b3b7dcb734e91cb0"
x-amz-meta-uid: 0
vary: Accept-Encoding
x-amz-meta-gid: 0
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Bz1oMGf3im0GdaDR1lpP366TMdyCBt5NXOq1IlamWrJqJW2zqe6XsA==
x-cache-hits: 292467

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//bg.search.etargetnet.com/frontend/logos/bg/39310/39310_57-36.jpeg
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: f5875bf6aa02ab43424f94a70b0224339d5451f32d2a4d26dec041a77ddc0512

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1191707
edge-cache-tag: 390909426062750942237347788620304514325,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 22 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//bg.search.etargetnet.com/frontend/logos/bg/39310/39310_57-36.jpeg
content-length: 8634
x-served-by: cache-hhn4022-HHN, cache-hhn4031-HHN
last-modified: Tue, 22 Oct 2019 08:32:45 GMT
server: cloudinary
x-timer: S1572927055.177343,VS0,VE0
etag: "4a6e9664ca5fa14cb8c0f77ad484b431"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c71c4f9cec571938ad39872f23225347.jpg
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e6740b9e9fb50509eb4c156020598c7d642134a5c8fc06c7a17aaf142a22efbc

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 2305352
edge-cache-tag: 525769444326912909846847412409788498676,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Thu, 07 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c71c4f9cec571938ad39872f23225347.jpg
content-length: 13054
x-served-by: cache-hhn4035-HHN, cache-hhn4031-HHN
last-modified: Mon, 07 Oct 2019 09:16:12 GMT
server: cloudinary
x-timer: S1572927055.177420,VS0,VE0
etag: "68f2a39029391b96fda548288ba8dda5"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/1485d0ac-d77a-4afb-a623-a44c7df37815.jpg
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 0b5c5144fdbf7f80b7ab3dc8c7112f5bb45452038b6e454fbaab9d630720feda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 1037687
edge-cache-tag: 430749908300593934141868141051169879563,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Sat, 23 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//s3.eu-central-1.amazonaws.com/ad-uploads-long/1/1485d0ac-d77a-4afb-a623-a44c7df37815.jpg
content-length: 11215
x-served-by: cache-hhn4040-HHN, cache-hhn4031-HHN
last-modified: Wed, 23 Oct 2019 16:57:32 GMT
server: cloudinary
x-timer: S1572927055.177925,VS0,VE0
etag: "4d3b572a16c6b6a6e2407779c12ec19c"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/2ea246b39e972af4967fecf5e5c736b0.jpg
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: 961702e2f40297f38533f95eb21b5cab63eaa796f7d1c5310e3af6147c7a4b4d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 105495
edge-cache-tag: 487621542778181763354932746247231261534,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 08 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboolasyndication.com/libtrc/static/thumbnails/2ea246b39e972af4967fecf5e5c736b0.jpg
content-length: 23880
x-served-by: cache-hhn4044-HHN, cache-hhn4031-HHN
last-modified: Tue, 08 Oct 2019 07:53:09 GMT
server: cloudinary
x-timer: S1572927055.177930,VS0,VE0
etag: "cb97a999bb1c4a6b73d5e3fc1a92b86b"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 2

POST
H/1.1 200
OK domains Show response
api.viglink.com/api/ 73 B
752 B 40ms
39ms XHR
text/javascript 34.246.252.247
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.viglink.com/api/domains
Requested by: Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.252.247 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-246-252-247.eu-west-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: 7914ca038051d86c5a7e17c3f6a2582b4469398f902dc7668b5809faa4b3aa5f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Tue, 05 Nov 2019 04:10:54 GMT
Server: Apache-Coyote/1.1
P3P: CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin: https://www.zdnet.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Content-Length: 73
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 st
imprammp.taboola.com/ Frame B2B5 0
0 35ms
33ms Document
text/plain 151.101.14.49
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://imprammp.taboola.com/st?cipid=7991117&ttype=0&cirid=5F537084B744803193954497308&cicmp=1337627&cijs=1&dast=V7fTYCFgOx980rMCEZ1gSx980rMCEZ1gUAAAAGBugHGzVjbXaD4WjCG42Gg81iOVkuBqPRbjcYTMFgC5_T3d2GMDSdDp_rXq_7_e7Sk91lumv8br_Ccnp6zC6_3OV7q-6Wl9tve1jMLrfw6DIbXpa32mH2PSwvt9DheSvtNpfH9DK5RavBYLBW2E2Wv9PkFrlsT4_L85cDAAAAwAMAUUs0xI5vQ3sEAAAAgATPyLUCRUDFv4XABQAAAAAGAIFYuAYAJUdCuD2nl-XkcPsDAOAhAAQAYECBBEAgsbAEwOFu8QQAAOCgTuZpm-X___8_BiDvvUkGgCJt48agB-DBB-BBCAAAIGtIBgKF0E9njJyo4LCIEQAAAEAbu1fF0aROqCyq_v___60ArgAAAtxyhEsIsm5OilnDAAAABMYW6GHx-80Ou8bvdtn_________v9n_GQCaUNQcdBqQZvaFGs_ItcLaLyAAANu7AQC8BcDFHIAdAAAAwN3___9_HgAAAMEeJdtrNZ49ynqfwRY-p7u7fhO2GK0mk81yOFsuJoPhaDga7U_ghgOcoOFwsNgNFrvFYjhZTEaD5WCBAjGY4IQMR5vJarRb7SbL4WQ0mm0mG6Ro1Wo22gyGq9lkttuthoPhcjRCitYsZpPJYjZa7jaD5WQ0GE6GQ4SB5Wyx8g13a43LtFmLZjOXWzla2NYyh2Njcc4WHodltRa9PqbTxOGbeGx-bIjBci7ZzObK0VyyWCUAAAAAAAAAgCVMmTcBAAAAOA1iNpvsdituHA!&excid=22&tst=1&docw=0&cs=false
Requested by: Host: www.zdnet.com
URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx/1.13.12 /
Resource Hash

Request headers

:method: GET
:authority: imprammp.taboola.com
:scheme: https
:path: /st?cipid=7991117&ttype=0&cirid=5F537084B744803193954497308&cicmp=1337627&cijs=1&dast=V7fTYCFgOx980rMCEZ1gSx980rMCEZ1gUAAAAGBugHGzVjbXaD4WjCG42Gg81iOVkuBqPRbjcYTMFgC5_T3d2GMDSdDp_rXq_7_e7Sk91lumv8br_Ccnp6zC6_3OV7q-6Wl9tve1jMLrfw6DIbXpa32mH2PSwvt9DheSvtNpfH9DK5RavBYLBW2E2Wv9PkFrlsT4_L85cDAAAAwAMAUUs0xI5vQ3sEAAAAgATPyLUCRUDFv4XABQAAAAAGAIFYuAYAJUdCuD2nl-XkcPsDAOAhAAQAYECBBEAgsbAEwOFu8QQAAOCgTuZpm-X___8_BiDvvUkGgCJt48agB-DBB-BBCAAAIGtIBgKF0E9njJyo4LCIEQAAAEAbu1fF0aROqCyq_v___60ArgAAAtxyhEsIsm5OilnDAAAABMYW6GHx-80Ou8bvdtn_________v9n_GQCaUNQcdBqQZvaFGs_ItcLaLyAAANu7AQC8BcDFHIAdAAAAwN3___9_HgAAAMEeJdtrNZ49ynqfwRY-p7u7fhO2GK0mk81yOFsuJoPhaDga7U_ghgOcoOFwsNgNFrvFYjhZTEaD5WCBAjGY4IQMR5vJarRb7SbL4WQ0mm0mG6Ro1Wo22gyGq9lkttuthoPhcjRCitYsZpPJYjZa7jaD5WQ0GE6GQ4SB5Wyx8g13a43LtFmLZjOXWzla2NYyh2Njcc4WHodltRa9PqbTxOGbeGx-bIjBci7ZzObK0VyyWCUAAAAAAAAAgCVMmTcBAAAAOA1iNpvsdituHA!&excid=22&tst=1&docw=0&cs=false
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
accept-encoding: gzip, deflate, br
cookie: t_gid=0961e787-ce43-46fe-94a6-fa1cb96aca25-tuct4ba7bcf
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/

Response headers

status: 200
server: nginx/1.13.12
accept-ranges: bytes
date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
x-served-by: cache-fra19158-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1572927055.329589,VS0,VE9
content-length: 0

GET
H2 200 cmTagCUSTOM.js Show response
www.cmbestsrv.com/vpaid/units/20_5_6/infra/ 507 KB
508 KB 145ms
57ms Script
application/javascript 13.224.197.94
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cmbestsrv.com/vpaid/units/20_5_6/infra/cmTagCUSTOM.js
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.197.94 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-197-94.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 70c780125a081891ea00fd13663fcd6849e55a900518c6a86add417dd009bfed

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Thu, 24 Oct 2019 22:01:12 GMT
via: 1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront)
age: 972584
x-cache: Hit from cloudfront
status: 200
x-amz-meta-mode: 33188
content-length: 519169
last-modified: Sun, 11 Nov 2018 13:55:02 GMT
server: AmazonS3
etag: "9e7e76d2d8e8d20baf67cb4dba3e5a9c"
x-amz-meta-uid: 0
x-amz-meta-gid: 0
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: zWbOLBB6T-kc3k2Zg4V6BX_i3hB6FhOyAEJrYyutHSOR2fL0BZNCcw==
x-amz-meta-mtime: 1541944486

GET
H2 200 cmOsUnit.css
www.cmbestsrv.com/vpaid/units/20_5_6/assets/css/ 24 KB
24 KB 136ms
48ms Stylesheet
text/css 13.224.197.94
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cmbestsrv.com/vpaid/units/20_5_6/assets/css/cmOsUnit.css
Requested by: Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.197.94 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-197-94.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3300cfbc16f77f4936d0401a03b27e681ae5e3d208bd5318692ca982b835de1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Thu, 24 Oct 2019 22:01:12 GMT
via: 1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront)
age: 972584
x-cache: Hit from cloudfront
status: 200
x-amz-meta-mode: 33188
content-length: 24336
last-modified: Sun, 11 Nov 2018 13:55:00 GMT
server: AmazonS3
etag: "9b22eb5717a1d0ec3d3f76b514217297"
x-amz-meta-uid: 0
x-amz-meta-gid: 0
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: text/css
x-amz-cf-id: DBNLSQLgpHPcdIHK6Ye-X6rOSDWYORPDs_fTwLbFwK4nnPdeVFulWg==
x-amz-meta-mtime: 1541944482

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 79C1 42 B
110 B 35ms
35ms Image
image/gif 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvHdjg2I7o07NjP6LiKYl_EqbQZwaa7L1WVIl404hD4Sms5BEN-o4fXrFauDQ8Y04FaoEG8fPOFvpcocUhMZ4Uq7N7yXIWSH76meb3EhFwZX5_UxI4b3cVAhnteZ8qty-eeyOhhnldA4r3uYkEe_OgJ&sai=AMfl-YRNzK5VK0doXrduPp5RxM_jOHLROk6NyRzXAizER93R2LHiVfEHvLRbH3tj3m0pqhhjApwkkn4Wtmp1JphM_99brxuK73Y4I2YHBmB9LUqMxjRGUHIpkVik4ps&sig=Cg0ArKJSzC0DZ1fDH6aGEAE&cid=CAASF-RoarsWza1NphylDjD6f3fdzGe2_S9Q&id=ampim&o=429,393&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=357&tls=1358&g=100&h=100&pt=574&tt=1358&rpt=574&rst=1572927053875&r=v&adk=373522494&avms=ampa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame EE71 42 B
115 B 31ms
31ms Image
image/gif 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuPmFCckrc_yQ3yuf7RpMGgQVWvRRBi6rs8wVtujbibTdYqHhImUmfq3qNbQdb6nZ_O9j4KOM0Bu-zCIRquh9dCcmE3jQm3hT2_kzAvBDDyyrxlEIKeljTdQSjk0w&sai=AMfl-YRW5EdNypZBYhGR9365hyn36lY5qTaK5rSbILgkesSgkz_zVTvG2rDQZS9RhJvkqhqVJvKUIAii3yRTdKJZO1TTG7t8zhOWYGToOiRfxaHP0v8bNwH9QrgzwuI&sig=Cg0ArKJSzOTx1mG5W1rOEAE&cid=CAASF-RobIDcaEoNFLoysNIVwkfm0zNecIeQ&id=ampim&o=1043,513&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1003&mtos=0,0,1003,1003,1003&tos=0,0,1003,0,0&tfs=337&tls=1340&g=100&h=100&pt=546&tt=1340&rpt=546&rst=1572927053905&r=v&adk=622592031&avms=ampa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v1572358097/mcjiwsxqqeliiaxce6zh.jpg
Requested by: Host: www.cmbestsrv.com
URL: https://www.cmbestsrv.com/vpaid/units/20_5_6/infra/cmTagCUSTOM.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cloudinary /
Resource Hash: e56c17581b625cf16e555e90ed3819088f230c36bf02930e46925a79bbff6b88

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish, 1.1 varnish
age: 550545
edge-cache-tag: 566810444655474971004264967369376706962,553231981581714319628150088830979202071,29ecf9b93bbf306179626feeda1fab70
status: 200
expiration: expiry-date="Fri, 29 Nov 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache: MISS, HIT
x-debug: /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//c3.taboola.com/libtrc/static/thumbnails/t_PERFORMANCE_VIDEO_DEFAULT/so_0/f_jpg/v1572358097/mcjiwsxqqeliiaxce6zh.jpg
content-length: 12768
x-served-by: cache-hhn4055-HHN, cache-hhn4031-HHN
last-modified: Tue, 29 Oct 2019 16:07:44 GMT
server: cloudinary
x-timer: S1572927056.593806,VS0,VE0
etag: "488c188e9cf4e428ba15db5f2a05b80c"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 0, 3

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 st
convammp.basebanner.com/ 0
295 B 61ms
34ms Image
text/plain 151.101.14.49
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://convammp.basebanner.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=7991117&crid=4468177&dast=V7CMoCFgOx980rMCEZ1gSx980rMCEZ1gUAAAAGBugHGzVjbXaD4WjCG42Gg81iuVmuRqPlbjMYDmGjZqzNbjAcTXij0XCwWSwny8VgNNrtBoMpGGzhc7q72xCGptPhc93rdb_fXXqyu0x3jd_tV1hOT4_Z5Ze7fG_V3fJy-20Pi9nlFh5dZsPL8lY7zL6H5eUWOjxvpd3m8pheJrdoNRgM1gq7yfJ3mtwil-3pcXn-cgAAAAB4ACBqiYbY8W1ojwAAAACQ4Bm5VqAIqPi3ELgAAAAAwAAgEAvXAKDkSAi35_SynBxufwAAPASAAAAMKJAACCQWlgA43C2eAAAAHNTJPG2z_P___8cA5L03yQBQpG30ADz4ADwQFRwWMQIAAABoY_eqOJrUCZVF1f___78VwBUAQIBbjnBJQRgAAIDA2AI9LH6_2WHX-N0u-_________83-z8DQBOKmoNOA9LMvlDjGblWWPsFBABgezcAgLcAuJgDsAMAAAC4-____88DAAAg2KNke63Gs0dZ7zPYwud0d9dvwhaj1WSyWQ5ny8VkMBwNR6P9CdxwgBM0HA4Wu8Fit1gMJ4vJaLAcLFAgBhOckOFoM1mNdqvdZDmcjEazzWSDFK1azUabwXA1m8x2u9VwMFyORkjRmsVsMlnMRsvdZrCcjAbDyXCIMLCcLVa-4W6tcZk2a9Fs5nIrRwvbWuZwbCzO2cLjsKzWotfHdJo4fBOPzY8NMVjOJZvZXDmaSxarBAAAAAAAAACwhCnzJgAAAACnQcxmk91uxY0D!&cmcv=&pix=31589837&cb=1572927055571&uv=2056&abt=pvideo_test10_vA&unm=CUSTOM
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx/1.13.12 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:10:55 GMT
via: 1.1 varnish
server: nginx/1.13.12
x-timer: S1572927056.627826,VS0,VE9
x-served-by: cache-fra19158-FRA
x-cache: MISS
p3p: policyref="/w3c/p3p.xml", CP="NOI IDC DSP COR CURa ADMa OUR IND COM STA NOR UNI"
status: 200
accept-ranges: bytes
access-control-allow-headers: X-Requested-With, X-Prototype-Version, Content-Type, Origin, Allow
content-length: 0
x-cache-hits: 0

POST
H2 204 csi
csi.gstatic.com/ Frame BE9B 0
56 B 100ms
100ms Other
image/gif 2607:f8b0:4006:802::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~k2lc5mv1&c=8835423987929548&e=21065050%2C21063204%2C21065018&ctx=1&met.4=fb.3~lb.dl~ol.i3~idt.-5b~dt.-k1&met.3=197.dk~123.dk_1~118.e8~118.er~118.er~118.gn~118.gn~112.i2~117.i3~118.i4~118.i4~113.i5_1&met.9=1.ed~2.fp~3_1.g7~7_1.1~7_2.1&met.1=1.k2lc5mcz~14.0~15.0~16.0~17.0~18.0~19.0~20.i3~21.i4&qqid.1=CPqa4PKZ0uUCFclA4AodkWwHHA&qqid.2=CPua4PKZ0uUCFclA4AodkWwHHA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:802::2003 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 05 Nov 2019 04:10:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
status: 204
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/ 7 KB
5 KB 22ms
21ms Script
application/javascript 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/variation/var-8bfb225b-f103-49ab-955c-32d3183cf24c/settings.js?cb=637082285918091960
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Nov 2019 04:10:56 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 2VqL9ACwktkYsY/Ec2Z++Q==
age: 295011
cf-polished: origSize=7074
status: 200
last-modified: Fri, 01 Nov 2019 18:09:42 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: 2260c60c-901e-00a0-63e0-909aa7000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 530bfb1448f759ee-VIE
expires: Wed, 04 Nov 2020 04:10:56 GMT

GET
H2 200 lightbox_builder.js Show response
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 0797 202 KB
28 KB 19ms
18ms Script
application/javascript 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637082285918091960
Requested by: Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99baf84f76d3a9cc29bed4906739b0bcc7f65756e9085de1c7bbc046738fea59

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Nov 2019 04:10:56 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 3A0FVb5o/F+XoEOgjWZYJQ==
age: 295235
cf-polished: origSize=331202
status: 200
last-modified: Fri, 01 Nov 2019 18:09:51 GMT
x-ms-lease-status: unlocked
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-ms-request-id: e380b6f1-a01e-00ec-40df-905db8000000
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
cf-ray: 530bfb1468ff59ee-VIE
expires: Wed, 04 Nov 2020 04:10:56 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0797 783 B
451 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:824::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=637082285918091960

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 05 Nov 2019 04:10:56 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Tue, 05 Nov 2019 04:10:56 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Tue, 05 Nov 2019 04:10:56 GMT

GET
H2 200 fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/ 1 KB
1 KB 6ms
5ms Image
image/png 2a04:4e42:1b::621
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
status: 200
etag: W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
vary: Accept-Encoding
x-cache: HIT, HIT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
date: Tue, 05 Nov 2019 04:10:56 GMT
accept-ranges: bytes
timing-allow-origin: *
content-length: 1362
x-served-by: cache-ams21020-AMS, cache-hhn4032-HHN

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ Frame 0797 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=637082285924695242

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Raleway
Origin: https://www.zdnet.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Fri, 01 Nov 2019 14:23:05 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:04 GMT
server: sffe
age: 308871
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13428
x-xss-protection: 0
expires: Sat, 31 Oct 2020 14:23:05 GMT

GET
H2 200 t.gif
www.lightboxcdn.com/z9g/ 35 B
202 B 15ms
15ms Image
image/gif 2606:4700::6810:4da5
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lightboxcdn.com/z9g/t.gif?c=1572927056686&h=www.zdnet.com&e=i&u=40913&b=193988&v=2544&s=empty
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:4da5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 05 Nov 2019 04:10:56 GMT
cf-cache-status: HIT
content-md5: KNaBTzCeoon4R8ac+RGUxg==
age: 335379
cf-polished: status=not_needed
x-ms-meta-cbmodifiedtime: Tue, 26 Feb 2019 00:59:40 GMT
status: 200
content-length: 35
x-ms-lease-status: unlocked
last-modified: Tue, 26 Feb 2019 01:15:02 GMT
server: cloudflare
etag: 0x8D69B87D5A1B25F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
x-ms-request-id: 48b7eafb-401e-010c-457d-f6fd65000000
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 530bfb1859ad59ee-VIE
cf-bgj: imgq:85

GET
H2 200 / Show response
www.zdnet.com/homepage/xhr/ 249 KB
27 KB 172ms
172ms XHR
application/json 2.18.233.143
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://www.zdnet.com/homepage/xhr/

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.18.233.143 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-233-143.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

4850c713fef8102d6c8b764671100e474d226368b71c78bb952f27f51cd3f9fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-security-policy: frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding, User-Agent
content-length: 26712
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 05 Nov 2019 02:41:43 GMT
server: nginx
x-frame-options: SAMEORIGIN
date: Tue, 05 Nov 2019 04:11:03 GMT
expect-ct: max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-tx-id: 7d9a4946-d8e8-4366-8038-8b85c808d137
content-type: application/json
access-control-allow-origin: https://www.zdnet.com
cache-control: max-age=5400, private
accept-ranges: bytes
expires: Tue, 05 Nov 2019 04:11:43 GMT

GET
H2 200 ring.gif
zdnet4.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/logos/ 16 KB
9 KB 6ms
6ms Image
image/gif 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/logos/ring.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29214
status: 200
vary: Accept-Encoding
content-length: 9039
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:20:35 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07a03-3f75"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:04:04 GMT

GET
H2 200 ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/logos/ 2 KB
2 KB 6ms
5ms Image
image/png 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet2.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29214
status: 200
vary: Accept-Encoding
content-length: 1513
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:20:35 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07a03-6fa"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:04:04 GMT

GET
H2 200 ZDLogoMicroWhite-x2.png
zdnet4.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/logos/ 2 KB
1 KB 6ms
5ms Image
image/png 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zdnet4.cbsistatic.com/fly/1572895235-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png

Requested by

Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1839-fly/js/main.default.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://zdnet2.cbsistatic.com/fly/1839-fly/css/core/main-b1848352da-rev.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29213
status: 200
vary: Accept-Encoding
content-length: 1398
x-xss-protection: 1; mode=block
last-modified: Mon, 04 Nov 2019 19:20:35 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5dc07a03-691"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 11 Nov 2019 20:04:01 GMT

GET
H2 200 river-time-ago-f2210a157b-rev.js Show response
zdnet4.cbsistatic.com/fly/js/components/ 753 B
700 B 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 339144
status: 200
vary: Accept-Encoding
content-length: 426
x-xss-protection: 1; mode=block
last-modified: Wed, 30 Oct 2019 20:14:28 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5db9ef24-2f1"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Nov 2019 05:58:38 GMT

GET
H2 200 tr-premium-promo-49ebdaab89-rev.js Show response
zdnet2.cbsistatic.com/fly/js/components/ 461 B
394 B 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet2.cbsistatic.com/fly/js/components/tr-premium-promo-49ebdaab89-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 577748
status: 200
vary: Accept-Encoding
content-length: 287
x-xss-protection: 1; mode=block
last-modified: Mon, 28 Oct 2019 16:46:04 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: "5db71b4c-1cd"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2019 11:41:53 GMT

GET
H2 200 load-more-34f6119ea4-rev.js Show response
zdnet3.cbsistatic.com/fly/js/components/ 5 KB
2 KB 6ms
5ms Script
application/javascript 2a04:4e42:1b::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet3.cbsistatic.com/fly/js/components/load-more-34f6119ea4-rev.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 602875
status: 200
vary: Accept-Encoding
content-length: 1803
x-xss-protection: 1; mode=block
last-modified: Thu, 24 Oct 2019 19:09:55 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db1f703-12a2"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2019 04:43:08 GMT

GET /
www.zdnet.com/newsletter/xhr/widget-login/ 0
0

POST /
www.zdnet.com/m3d0s1/xhr/horizontal/ 0
0

GET /
www.zdnet.com/components/tr-promo-asset/xhr/ 0
0

GET
H2 200 load-more-1.0.js Show response
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 8 KB
3 KB 6ms
6ms Script
application/javascript 2a04:4e42:3::444
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js

Requested by

Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1839-fly/js/libs/require-2.1.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

ContentServer /

Resource Hash

da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016

Security Headers

Name	Value
Content-Security-Policy	default-src https://.zdnet.com:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Tue, 05 Nov 2019 04:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 554618
status: 200
vary: Accept-Encoding
content-length: 2472
x-xss-protection: 1; mode=block
last-modified: Tue, 29 Oct 2019 14:49:16 GMT
server: ContentServer
x-frame-options: SAMEORIGIN
etag: W/"5db8516c-1f51"
strict-transport-security: max-age=31536000
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
content-security-policy: default-src https://*.zdnet.com:*
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2019 18:07:25 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js

Domain: www.zdnet.com
URL: https://www.zdnet.com/newsletter/xhr/widget-login/?topic=

Domain: www.zdnet.com
URL: https://www.zdnet.com/m3d0s1/xhr/horizontal/

Domain: www.zdnet.com
URL: https://www.zdnet.com/components/tr-promo-asset/xhr/?topic=0

Verdicts & Comments Add Verdict or Comment

311 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 09:14:39	Name: demdex Value: 72674303528070863893467454340398013869
.lightboxcdn.com/	1970-01-22 20:31:27	Name: a1583f50-579b-41d0-8c4e-1cd1790d945c Value: N4Ig-mBGAeDGCuAnRIBcoAOGAuBnNAjAKwDsATAJxkkAMRAzDQWQDQgYBusAdtoW7nypi5KrQZNW7Drh59hbREgA2aECDbKVagPQBDRNgCWsZQFMd3MwHcAtPG6IzAWwD2HPZHO3oACzPKGGaIts56ytYGZra-eri2RtwAZmaw2GYAJrYALEQ0-bZ63BmIrkZZGWYcJma4OhogyniEpJTUdIzMbBjaqADaIPqGJuaWNvaOLu6e3n4BQSFhEVExcQnJqelZufk0hcWl5baV1bC19QC6AL5sEDAYThxooBl6AJ5CfSJt4oxk2ddblBoFUzLwhMAbuBgbBympYJAkgAOChESBZABslFgOX-ZFsFAo9CIBOySQISUJ5BoZAxtm-YjoeOyICuQA__
.lightboxcdn.com/	1970-01-19 13:41:03	Name: __cfduid Value: d910c070045790d91e5d3de858aa4dabf1572927052
.zdnet.com/	1970-01-19 05:05:31	Name: RT Value: "sl=1&ss=1572927051283&tt=1824&obo=0&bcn=%2F%2F684dd306.akstat.io%2F&sh=1572927053110%3D1%3A0%3A1824&dm=zdnet.com&si=5a217b40-a452-453e-8a4a-aacca2ec4f9a&ld=1572927053110"
.zdnet.com/	1970-01-19 13:41:03	Name: utag_main Value: v_id:016e39c219350021fe6bf356597400078006107000b08$_sn:1$_ss:0$_st:1572928853097$ses_id:1572927052086%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/	1969-12-31 23:59:59	Name: fly_default_edition Value: eu
www.zdnet.com/	1970-01-19 14:24:15	Name: _cb Value: C70jSDB7BNcNr9L5y
.zdnet.com/	1970-01-19 22:28:05	Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg Value: -894706358%7CMCMID%7C72453281799470152453479406370189777109%7CMCAAMLH-1573531852%7C6%7CMCAAMB-1572927052%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1572934252s%7CNONE%7CMCAID%7C2EE07B2685158000-4018A8E1223DCFE6%7CvVersion%7C2.3.0
.zdnet.com/	1969-12-31 23:59:59	Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg Value: 1
www.zdnet.com/	1969-12-31 23:59:59	Name: viewGuid Value: fd535992-ecdd-4096-8d70-2d3ec6ec661d
.zdnet.com/	1970-01-19 04:55:28	Name: s_invisit Value: true
.zdnet.com/	1970-01-19 04:55:28	Name: s_lv_zdnet_s Value: First%20Visit
www.zdnet.com/	1970-01-19 04:55:28	Name: _cb_svref Value: null
www.zdnet.com/	1970-01-22 20:31:27	Name: LDCLGFbrowser Value: ac895b87-0cc2-4f90-b121-d05306619792
.zdnet.com/	1970-01-19 05:38:39	Name: s_vnum Value: 1575519052811%26vn%3D1
.zdnet.com/	1970-01-19 04:55:30	Name: first_page_today Value: false
www.zdnet.com/	1970-01-19 14:24:15	Name: _chartbeat2 Value: .1572927052249.1572927052249.1.DyqQ1uDBDVLz41i9MDscATfDC7wuR.1
www.zdnet.com/	1970-01-19 14:24:15	Name: _cb_ls Value: 1
.zdnet.com/	1970-01-19 05:05:31	Name: fly_geo Value: {"countryCode": "nl"}
www.zdnet.com/	1970-01-22 20:31:27	Name: _ccmaid Value: 3605829230968963095
.zdnet.com/	1969-12-31 23:59:59	Name: zdnet_ad Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22h%22%2C%22subSession%22%3A%221%22%7D
.zdnet.com/	1970-01-19 05:38:39	Name: s_getNewRepeat Value: 1572927052812-New
.zdnet.com/	1970-01-19 05:05:31	Name: fly_device Value: desktop
.zdnet.com/	1970-01-20 07:12:15	Name: s_lv_zdnet Value: 1572927052813
.lightboxcdn.com/	1970-01-22 20:31:27	Name: __bxtest Value: IYIwxgHgngXkA___
.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices	1970-01-19 09:14:39	Name: CBS_INTERNAL Value: 0
www.zdnet.com/	1970-01-22 20:31:27	Name: _ccmsi Value: 1572927052181_a60lq7h01\|1572927052181
www.zdnet.com/	1970-01-22 20:31:27	Name: XCLGFbrowser Value: GksdB13A9kxxhdXg7PU
.zdnet.com/	1969-12-31 23:59:59	Name: fly_preferred_edition Value: eu

61 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service pending (GDPR consent not granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service pending (GDPR consent not granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service pending (GDPR consent not granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service pending (GDPR consent not granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 320) Message: Found registered service worker: [object ServiceWorkerRegistration]
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 767) Message: ADS: queuing nav-ad-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1239) Message: ADS: queuing intromercial-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1308) Message: ADS: queuing leader-plus-top-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1419) Message: ADS: queuing inpage-video-top-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1429) Message: ADS: queuing sharethrough-top-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1649) Message: ADS: queuing mpu-plus-top-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1753) Message: ADS: queuing dynamic-showcase-top-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 1760) Message: ADS: queuing mpu-middle-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 2034) Message: ADS: queuing mpu-bottom-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 2051) Message: ADS: queuing leader-plus-bottom-5dc0e708a59aa for display
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service pending (GDPR consent not granted): script_sharethrough
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: GDPR consent granted
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent finally granted): script_indexexchange
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent finally granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent finally granted): script_sourcepoint
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent finally granted): script_gpt
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent finally granted): script_sharethrough
console-api	info	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 305) Message: Registration of service worker /service-worker.js successful with scope:https://www.zdnet.com/
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9) Message: Missing adCookieData!
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_mpulse
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_chartbeat
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_ad
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201909041804(Line 177) Message: Service: sitecatalyst
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_sharebar
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_sharebar
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_taboola
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_async_load
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_urban_airship
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_disqus_count
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_disqus_count
console-api	log	URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92) Message: zdnet
console-api	log	(Line 61) Message: blank creative loaded: 138245072116 (5 x 5, pos=nav)
console-api	log	(Line 61) Message: blank creative loaded: 138239344190 (11 x 11, pos=top)
console-api	log	(Line 61) Message: blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api	info	URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js(Line 513) Message: Powered by AMP ⚡ HTML – Version 1911011734590 https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
console-api	info	URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js(Line 513) Message: Powered by AMP ⚡ HTML – Version 1911011734590 https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
console-api	info	URL: https://cdn.ampproject.org/rtv/031911011734590/amp4ads-v0.js(Line 513) Message: Powered by AMP ⚡ HTML – Version 1911011734590 https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 164) Message: Dynamic Showcase Center container ::: creative id = 138247024569
console-api	log	(Line 61) Message: blank creative loaded: 138239375180 (372 x 142, pos=)
console-api	log	(Line 61) Message: blank creative loaded: 138239479696 (372 x 142, pos=)
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_taboola
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_async_load
console-api	log	URL: https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/(Line 92) Message: Service loading (GDPR consent already granted): script_medusa_recommendation

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' .zdnet.com .ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

15.taboola.com
684dd306.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
adservice.google.com
adservice.google.de
adservice.google.nl
api.viglink.com
api1.lightboxcdn.com
as-sec.casalemedia.com
beacon.tru.am
c.evidon.com
c.go-mpulse.net
cbsi.demdex.net
cdn-magiclinks.trackonomics.net
cdn.ampproject.org
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
convammp.basebanner.com
csi.gstatic.com
dpm.demdex.net
dw.cbsi.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imprammp.taboola.com
in.ml314.com
js-sec.indexww.com
l.betrad.com
lightboxapi1.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.everesttech.net
pixel.mathtag.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
static.chartbeat.com
sync.crwdcntrl.net
tags.bluekai.com
tags.tiqcdn.com
tpc.googlesyndication.com
trc.taboola.com
tru.am
urs.zdnet.com
vidstat.taboola.com
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.cmbestsrv.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
www.zdnet.com
zdnet-1.disqus.com
104.111.241.32
104.17.208.240
13.224.196.129
13.224.197.94
15.188.105.205
151.101.113.181
151.101.114.2
151.101.14.133
151.101.14.2
151.101.14.49
152.199.23.241
172.217.21.230
172.217.23.162
172.217.23.98
18.197.145.83
184.25.159.208
184.31.90.90
185.33.223.215
2.18.233.143
2.18.233.201
2.18.234.21
2.18.235.40
216.58.206.2
23.0.46.190
23.99.128.52
2600:9000:2156:fc00:18:1fcd:349:ca21
2600:9000:21f3:c800:1d:8c8c:47c0:93a1
2606:4700:20::6819:a222
2606:4700:20::6819:a322
2606:4700::6810:4da5
2606:4700::6810:4ea5
2606:4700::6810:a10d
2607:f8b0:4006:802::2003
2a00:1288:110:c305::9000
2a00:1450:4001:800::2002
2a00:1450:4001:806::2002
2a00:1450:4001:808::200e
2a00:1450:4001:815::2003
2a00:1450:4001:816::2002
2a00:1450:4001:817::2002
2a00:1450:4001:81d::2002
2a00:1450:4001:820::2001
2a00:1450:4001:824::200a
2a00:1450:4001:825::2001
2a00:1450:4001:825::2003
2a00:1450:4001:825::2004
2a01:4a0:1338:28::c38a:ff18
2a02:26f0:6c00:19c::11a6
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:1b::444
2a04:4e42:1b::621
2a04:4e42:3::444
3.220.21.104
3.226.5.56
34.246.252.247
35.176.192.147
35.190.38.167
35.190.72.21
35.227.208.151
52.18.181.107
52.18.184.106
52.215.211.56
52.28.51.75
52.31.106.135
52.49.153.216
54.154.151.160
54.87.95.71
64.30.230.22
66.117.28.68
66.117.28.86
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1
06fed629374c6d00b1b9869f50fc9a0dbb7c94c0ea5debba718b07520f81f770
07178558c596bc2fe33d99750a349d5413fa4571fc778cefbe4f4f367404f6d6
07aa330f5c10904e0bc406c5be65525f91ce2a206aeba9b897d1f51de18ef00d
085d7156ad033537ba51a23a501d431af91f34721bbcd419ce7a314b2fdaafc6
0a5083fb94cc5b5234f2dc8c7c461085b1e19896386890b1e86890e1d0d38771
0adb41e12db27b18dbc4cd98dc3d219f64627810ffa357e4ebae1e71557b2afd
0b5c5144fdbf7f80b7ab3dc8c7112f5bb45452038b6e454fbaab9d630720feda
0b65e7d388db51ebfaba9cb824426205a7632e1fbd4a1221bb7cf301fce6d33d
0b9028c7ecccf4f31fafcfca176cd6ed38197d7b3d6ea4c107b98af8eecc525b
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10362415868ebbb631276e241ba43c7850d55465a9a3001d9b84a05d1ce4f872
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
10eba73b3641332bde05fa8d6223e7017ac5207673602247c35f358ea89e3092
110a5497d2c05a021331d74735f248fff5174323744407925f3060bd6709c69a
145facc26f82ff4153d5cbc697c054ce3b2668fa643e1a7614a473a631f2f981
15e0a9542e3b37b78841846f6d6bf8ed15e35683cb596d8ed4913e912f8362bb
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
1a6fef62053331f63644123262d5af95850483144651dc15fc57e76dded3d4ef
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d41e31a056050195712db11c373d790360c6738fe6ad0e61e6f21726d619ba5
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b
1e96ccba056713805c4f3b409dd3b26c847df5e520b98576c1b1f4930fc33af6
1f11b99e5f22ed5ebe1df7fa2f6c839f7109dca2c8be9a00fd1fe92c9ac897e0
24270887b28394cc0716af7ea1928f143c323120b1716ce547e31a77faa832c4
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2e1484790717d965e7b6618ef9d72cc6061e637393d04fd78969314a42d033e5
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
3147026ff99804131affcb3cadbdfd49c0a07583682aefcc1198f57e2614d5b0
364efc68e57240e144c1334b7b4e77dcac0dc65d71777b38992f6cd8ffc67b73
36beec5ccc649b93c26715e74c3d79f637b199ee49f26688db9eb2d91cae9da5
3900fe84624daa61bf04b4758e1cf6fc7192359f15782747e05631181e0514ad
39f0e13a96fd029965b5b5fd3504853b6fe6ded07b4dd8862a0e033be626e655
3e8aea095e2ff8138df7d80ad638bfd1f8ccb0e1337dd14da442f10c57216dbf
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
400ad64ef234d255a1c9ddd567bfe202d42bb7bd85a8efe6f366c2acc35ee470
40f093ff956ad29b9f14daea1a447cf2225cb7ff52ed7f4d2c6b2d1acdc15390
421efdd0c793078b4e6e63fdea8d184db42032cea9959a2db26bf2bef2422b1f
4546debdd0aaae70a75c29b804e3968f1060456c3ca00396b349058a46b15f0a
4850c713fef8102d6c8b764671100e474d226368b71c78bb952f27f51cd3f9fd
4cc6bb9f4681b01f72eb36f2f5cf12d25b86b3a72d6a88a0a0d2ae7a94d14891
4d565f67641c732365c3180ec1e37c7a987825faad3e8632de8a07a9101feedd
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
5022b5f1b7007908d8a4f4ca598ffe88ddbc46ac18dbaa17a030c910e9322ca2
5075b0d31c00903c1a8f437e6e356da4ebf9fe7066ac6809427d184b55fc382c
51c7d8bf36278b44c83df1a711f1993125416929a7a5a9a0a7061c852ba92ce3
5834c8c621e1b242cea4abe006b34a647a5f243b1e6bbeb0b5806f54cde9c5f8
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5c00c44eb252280eab2fe99bd3ba0bc33a133659b07a1dbc9c30011bfbf54724
5ced2e2a8ddd164afa596d94ab2bd8fb92eab9ac526cf9379eb70048e3c91c8a
5d0219878301d5c9146fb6edf607c2280f4f1c35911fa39d02dfa6819e2e9cc6
5ea5cdf5bd0bcff0b7f84bf8c837398e05bf33b89543c645e77a5f7303f7183e
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
64cfd2a647408273e2609b638b29d1f10370824f0169ee4db637edac660dfb66
66d46082c36abed0adf1e5f8023f3d0886c6700fb1d36186782f52507274b5a8
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
674d00d92cf08fa16978688fefab65a323e15aa4e075bba6584393a0d49ba1f1
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
6a8b69c61bdc6255b01f894c4e0a51538f60b9bb42818a0ca11ca03853fb1203
6b58782f772eaeb73d36b47159ed802f146182cf5d8fe4cfd838e6e629e6bd1a
6c6710b5b8ee51aaf57906b681eb1a32ad6e6c9fd07dfa3b37d2479cb8434308
6ca9514d24bc9ec9dbaa3388d9343c33edd1e23a50f2398ef0da0ad840ddba4d
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
70c780125a081891ea00fd13663fcd6849e55a900518c6a86add417dd009bfed
721d25c769caf7382904ffa5894ab4666909142ee7632662bd8b56bdc288b2a4
7291a55cb2f1698af604e1fea9a324c97c3af9cb1bdea5c7008f2a773d5f5997
72b5122d64e7b20a4a3c065686243a9a222f9c20bdb8eff347931b02172dd590
72d17955a9639827785e752152d5641881e5c9781a5ed2069e871af0f0b5a619
73438a77c4b5ef6bdfdb761e8d4e86ac508540b890d01cc5bc556bd381c44f4b
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
7914ca038051d86c5a7e17c3f6a2582b4469398f902dc7668b5809faa4b3aa5f
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7b2cbf83bc5a9e6f3bd77976605dad88ef15387ff83d5850da1df2e611af6936
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
7fb1673bbe848daf6c472455a6548de044a19e7129f02cdff58f9d0e9e191c65
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
851db61c6e463cb49c776e1c5817454d56edfa53a5fb354c3c499189939abc1c
86c1e3a3815c655210d29f99125ec6713834bb81959193dd7126c60466c029d7
875abf5b8c92fb002a753b14e06bf3ced893a844afc1925317536b29a161dcda
885fb8b9c3d2738bd627def3899f26d4d42641bbb868cc99d1fbc16f0ed9f4c6
8998e68f9bb1686ca1e03fcf3f0d6ea669c32d1f3554aeea809f1b1824ff6625
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8d7681c3d6b9aa0efb9812048b8dbec10ff143fd4a8cf9c17e256e5757b5a6c6
9325919428c9f69388eb7a4ea4cb011fdc333fda350124403e3f5471367ac968
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
95ec4dea002be118a633dc5070c23358d10e179ad3de44f23ac97578c6971df7
961702e2f40297f38533f95eb21b5cab63eaa796f7d1c5310e3af6147c7a4b4d
96a4628ab5b757263dc2f71d2e408d0b7e7dad82c524fa34bf3b37abca85e373
99baf84f76d3a9cc29bed4906739b0bcc7f65756e9085de1c7bbc046738fea59
9a5637d760ace9a9700f1c5bc5c476e4d603dc7a9d68724f816d30814a376172
9b728c06afa13ff6065ff54b31d3346ee4cfac00b8caca260c8051a302699157
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
9e0d5a2e81afbcfbb2f34086f652889c3d827a7e839e4ef5fda38ddf01d466c4
a013bb45b7882135d057451e1a9e1af0b49ca1f1eb2d9fb1a1a3ae2adce2354b
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a15e125b5fca0c237c1cc2ae74a65a0b1a6e00c62f72e875cfe71a9a0aa86d77
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a486bc7e2f639006b88a56adf9972eb44c7537e0e20b829f2eb0f3ce3a3e2071
a71cc134826b38085a6d63bca1e00de7ab8518ae02f7b5e2ae46cf11781e44e5
ad7ed17bf4c8d9dd2511e7254670822d0f90c8fb89187f860cfbcb91821abc84
b02eb6a63bca577aa26a3d54c450cd179dab7b63e08cb8830411bca8f853c002
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b23897b49c6e2047f39d495d5e6b6691dad263fa42b3fe7079c123e8957f0278
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b43c55ecab4c039abdc362ed7985f685e57706c7db17b7a9960547a16ef617cb
b5599f8e46599b39746d4ec039006f9f24d15aa5bfff6feb5c5a6ada2ac6a884
b57ee8f5b83ee0d2418749b371907a745258bafb6a40e8e121f41f7b1828abe0
b59b2a1b8b73edc1c35d71f24bee56ad3008e4783182eac39be08da425b22d5c
b5c10eeeb699e3ec9d2241adca63455dc93eb0dca9df27628f8c4ef2e83ce45f
b663fe01f1161255852a7ad82024bd1b9e217bbbd05c824d85e8d279cb808063
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
bc54dbec1b5aa648f8a30cf7a98c3a75db9dcaca90f07b52cd29aac411b98e73
bc60af98deb4942d71c77a362540c58f301d636336439671496d27935778770e
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c014ecce43faaf9ff5d5f6d08944fc14ea434f5bbc423151d3bd158790daa91b
c293a28e23c66b27bd04bc1742f3aab0ebf6c382961c1e83140f035a08ea5e5d
c34ca9b82d83676fb7a522f6fa73fcf2bea100c3ace203a2083762b62259dad6
c649aaa88ce29f86caa50dc08e1745c9783e049656ff2d5a93ef813b7f0c662a
c669c3d0725ad3cc94bb45a1dc376703b71bf6882bf9dc6e0e53571c80c98460
c7e200cc7a868fcda0eff820187cc801f54018e22743426e46666c10f868b592
caab9bbec165591d5214448b624dae44a3cbc575721ba71da2f7130bbbcbc6dc
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d18981e996610cad069d83d05ed674db4978775ff80845c88044820c8821736f
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d337068541ae8b2f8c9585b458f43a411709aa557240d4c209a812e02d1c7bee
d376263f7912434deb05ab9613cf6ea2a9f15f4b82dad68422eb0d5de195669e
d401c0d3ad09b95bd45b13050f037943715a937ff8ba40b1271eb3474cc892f8
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d5cb68d30901ab4b59658ed85d15a89c4d8ef306f2f23d568eb94d9057f2cad6
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6ad9976b40a4c963721165b772c6e1b26ff43662cc057c1d04affe650c5cbf4
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d72ee05b24fd749d129b1c3ad062a2300fbfaa809fc7336fe981ce85e2377e82
d88f11d103fbc604d33c9256841bfe44efd57dc9d162d3389d0c4408a5beb813
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dcf3f2a13f83e47224020dd0090285204819f22ad0bc72432d53d37411e90542
dd610925573518954a1d1d96bbc63f67a0dcc8a6748a667d7a6b270dd5efabf9
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
deb156323ff45dd4d2fd6d7a7a869191648188c38cc84287a1d2cf35b8f71e47
ded8511664e1caedb3aca8750aa6ed4dda5d0e82e4a96ff9bb80716132a45afb
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e1efb959e459b99979a76dce8a977b55d4e4b82ccd85264d7644455789793b3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e4ab34b8a905b1076f36fddd2dc1e2dacd9c1bbca6614ab260e9b40aa0dced41
e56c17581b625cf16e555e90ed3819088f230c36bf02930e46925a79bbff6b88
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e59c8c655db8c097ed0067789aeb44ed58f25f8c68a5772bbb3f1fdc18e5e336
e6740b9e9fb50509eb4c156020598c7d642134a5c8fc06c7a17aaf142a22efbc
ea7490413386b84bf4d5c1fc162d5b0c16e14485e2eee9787968c8e1288e50c5
eabd13452c89bab44124b6608b8dc1c663fbe1ca26ee5f3a30a428a0d61f0e03
eb07b53d262575cef96004e2be725ac235db39262e9bb8466a2a9b85cf532aa8
ec979c781c91981a9509f24978a570376befe9f94ef52602396d0831e6a6fe0f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f06b769609d7fb2a12cc6328f66a20b2c8bcb2337b6081665178ebdaeea7636f
f0c8ad030a90f1ee3cdcd5910587eab25da7bb0ec6f942d979bba4d506b38380
f1f493f2418d851d9c9d5a6522417b0faa8e54fc93255abe5939b309a6e1465e
f3300cfbc16f77f4936d0401a03b27e681ae5e3d208bd5318692ca982b835de1
f55a9877ce7f6c4513f552c7e01fb4dbd98d3e7ef2513a479a9b91933b7dbe7e
f5875bf6aa02ab43424f94a70b0224339d5451f32d2a4d26dec041a77ddc0512
f5b52ad70c5d645388b52d2fadaf8a5311aee9a01436866ab9b3e2c5f02e1c22
f61ef6a6d7b1cb3221909bd196c8cdbb0694cfcb6fedb8ccd40a0a2f959e811a
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f761c12f48e0463f151621e2a87ef98bcdab277ba662a9acdbc58303246a266c
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fde3fecb64b9bdab47a902d75ab27e6ea149dcfb779a317a8cebcf9ef93360e7
fe074214a9c301f8c3ba319d4bab7cba8d65164dcc2077272a9cacedf8941ae2
fe80c34f1c5630b2f2150e85cca2b15f6da1e29dab9067fddcc94fd43519d579
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097
ffaeeea8b8a09eda9e1eb2f2dc2c9ae055afb7fdbd4d88f57f324f8cad1d4ac5
ffe2ef5ce19169f51b69f0dfdac122f402043b13afd7c65b2dab551ebf3b7629

www.zdnet.com Open in urlscan Pro 2.18.233.143 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

318 Requests

98 %HTTPS

39 %IPv6

57 Domains

83 Subdomains

65 IPs

7 Countries

5138 kBTransfer

13886 kBSize

29 Cookies

47 Outgoing links

Redirected requests

318 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.zdnet.com Open in urlscan Pro
2.18.233.143 Public Scan

Screenshot
Live screenshot

Full Image

318
Requests

98 %
HTTPS

39 %
IPv6

57
Domains

83
Subdomains

65
IPs

7
Countries

5138 kB
Transfer

13886 kB
Size

29
Cookies

318 HTTP transactions
10 data transactions