urlscan.io logo urlscan.io
SecurityTrails logo

www.theregister.co.uk Open in urlscan Pro
104.18.235.86  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Submission: On March 26 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 4 countries across 14 domains to perform 98 HTTP transactions. The main IP is 104.18.235.86, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.theregister.co.uk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 4th 2019. Valid for: a year.
This is the only time www.theregister.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

38    104.18.235.86 (United States)

ASN13335 (CLOUDFLARENET, US)
www.theregister.co.uk
nir.theregister.co.uk
forms.theregister.co.uk
go.theregister.co.uk
8    172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net
securepubads.g.doubleclick.net
12    2606:4700::6810:5351 (United States)

ASN13335 (CLOUDFLARENET, US)
regmedia.co.uk
4    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.co.uk
adservice.google.com
www.googletagservices.com
3    23.210.250.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-44.deploy.static.akamaitechnologies.com
widgets.outbrain.com
2    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    13.224.194.18 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-18.fra2.r.cloudfront.net
pj.l.admedo.com
19    2a00:1450:4001:81b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
cdn.ampproject.org
1    2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    72.247.226.107 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-226-107.deploy.static.akamaitechnologies.com
tcheck.outbrainimg.com
1    2a02:6ea0:c710::2 (Germany)

ASN60068 (CDN77, GB)
ob.cheqzone.com
1    54.172.89.8 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-89-8.compute-1.amazonaws.com
obs.cheqzone.com
4    2a00:1450:4001:81e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
3    64.202.112.31 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
log.outbrainimg.com
1    151.101.114.2 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
odb.outbrain.com
Domain Requested by
26 www.theregister.co.uk www.theregister.co.uk
12 regmedia.co.uk www.theregister.co.uk
10 cdn.ampproject.org securepubads.g.doubleclick.net
9 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.theregister.co.uk
tpc.googlesyndication.com
cdn.ampproject.org
8 securepubads.g.doubleclick.net www.theregister.co.uk
securepubads.g.doubleclick.net
7 forms.theregister.co.uk securepubads.g.doubleclick.net
forms.theregister.co.uk
4 pagead2.googlesyndication.com securepubads.g.doubleclick.net
4 nir.theregister.co.uk www.theregister.co.uk
3 log.outbrainimg.com widgets.outbrain.com
3 widgets.outbrain.com www.theregister.co.uk
widgets.outbrain.com
2 www.googletagservices.com securepubads.g.doubleclick.net
2 www.google-analytics.com www.theregister.co.uk
1 odb.outbrain.com widgets.outbrain.com
1 go.theregister.co.uk 1 redirects
1 obs.cheqzone.com ob.cheqzone.com
1 ob.cheqzone.com widgets.outbrain.com
1 tcheck.outbrainimg.com widgets.outbrain.com
1 www.google.de www.theregister.co.uk
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 pj.l.admedo.com www.theregister.co.uk
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.co.uk securepubads.g.doubleclick.net
98 23
Subject Issuer Validity Valid
theregister.co.uk
CloudFlare Inc ECC CA-2		 2019-10-04 -
2020-10-03		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
ssl909866.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-10-31 -
2020-05-08		 6 months crt.sh
*.google.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.outbrain.com
DigiCert SHA2 Secure Server CA		 2020-03-09 -
2021-06-08		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
pj.l.admedo.com
Amazon		 2019-07-05 -
2020-08-05		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
*.outbrainimg.com
DigiCert SHA2 Secure Server CA		 2019-02-24 -
2020-05-25		 a year crt.sh
ob.cheqzone.com
Let's Encrypt Authority X3		 2020-03-16 -
2020-06-14		 3 months crt.sh
obs.cheqzone.com
Let's Encrypt Authority X3		 2020-02-22 -
2020-05-22		 3 months crt.sh
misc-sni.google.com
GTS CA 1O1		 2020-03-03 -
2020-05-26		 3 months crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-03-03 -
2020-07-25		 5 months crt.sh

This page contains 9 frames:

Primary Page: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Frame ID: D282D2FB40EB5F4A8645A15E914A10A1
Requests: 66 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Frame ID: 8B4256F92AD579E2A7D43E7AA2636E9E
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: 6BDE9F1938A599C97FED84D244914B61
Requests: 8 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: 614548AD98D218D4D80E6467B29BB095
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7Id1CuV1l6UpisjU1lHv1rWL5d-VHaj_nVprzX__xihAcep-Vj4z_kQKGbwgh-ZbHjWhrDdjOMFz2SJ4X2gXs-rYB_mx7msXuDCwnvp_wC5e-XA1Oiwj-ClRA2C-cNGyEamIXfCQkpJolxMWQoWigcYfUWm2pA1YMo9sEb655_EjgS03VW7bFrZ6ihb0_hA35TKFJWVNFgpOi6eVegzcfYmJiK01fzokJ5C9DMYxU5aUTQtxhjIfmmBcam1AvSIw3WFu-0TstDX242A2-jLjHs5FzoXcX2DxotFA&sai=AMfl-YSo1ZKb1GWhFiiG3ISy3jDVaKmS1TMh49n6wX-63DWk8oSOrmBzGkTJ6xh2hlEWsLpW-hR7ssiTTAq9uoWaJUntryGy2vXOAeOo-ab8QA&sig=Cg0ArKJSzBqu6cH_RxZ9EAE&urlfix=1&adurl=
Frame ID: D9CACFA735694B143900056324FB233F
Requests: 4 HTTP requests in this frame

Frame: https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
Frame ID: E5FA9CF2E2DD6A4E8924ADF4D58A855E
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Frame ID: C20F913BE2408F8B12583D805B14EA23
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: AEDCBF5E5B029AEB86528B4E6A144A70
Requests: 1 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: 3FCD33366AF0107DC71EED5BE8E34CDC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

98
Requests

100 %
HTTPS

53 %
IPv6

14
Domains

23
Subdomains

16
IPs

4
Countries

1509 kB
Transfer

3525 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&gjid=894412899&_gid=553672543.1585237528&_u=YChAiAABB~&z=221384743 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&_v=j81&z=221384743 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&_v=j81&z=221384743&slf_rd=1&random=3324758955
Request Chain 81
  • https://go.theregister.co.uk/k/abt_a HTTP 302
  • https://regmedia.co.uk/2007/09/13/tp.gif

98 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/ 		65 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19d890a822e276950aee8158df93f74033e713f89f9a4412e00a9c37b41ff561

Request headers

:method
GET
:authority
www.theregister.co.uk
:scheme
https
:path
/2020/03/04/microsoft_subdomain_takeover/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
date
Thu, 26 Mar 2020 15:45:27 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d0afcb6a9c98cc2330b3df222f58e77d21585237527; expires=Sat, 25-Apr-20 15:45:27 GMT; path=/; domain=.theregister.co.uk; HttpOnly; SameSite=Lax
cache-control
max-age=0
expires
Thu, 26 Mar 2020 15:45:27 GMT
vary
Accept-Encoding
x-reg-bofh
pfy01gb
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
57a1ffb52b24e610-LHR
content-encoding
br
scaffolding.css
www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/ 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/scaffolding.css
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11b10fdb2a5de2bc29f16503b2ee10492c9441b12e7d1d0248ff764f62a0206d

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 15:45:27 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Sat, 21 Mar 2020 00:31:04 GMT
server
cloudflare
age
8531
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb5ccf7e610-LHR
expires
Tue, 20 Apr 2021 15:45:27 GMT
design.css
www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/ 		52 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/design.css
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 15:45:27 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 05 Mar 2020 14:40:15 GMT
server
cloudflare
age
8531
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
x-reg-bofh
pfy02gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb5ccf9e610-LHR
expires
Tue, 20 Apr 2021 15:45:27 GMT
_.js
www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/ 		207 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95f0b8a588ddfbf5b37b38fcb1e50f745648419e25cc7ee2e503efc3ba93c990

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Mon, 16 Mar 2020 16:05:34 GMT
server
cloudflare
age
862778
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
x-reg-bofh
pfy02gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb5ccfbe610-LHR
expires
Tue, 20 Apr 2021 15:45:27 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		44 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
sffe /
Resource Hash
55620583eecd8f9a36a45072edeef72f395acdb8da34d22d9b1f8d599a43c25c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"467 / 599 of 1000 / last-modified: 1585081375"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
14669
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:27 GMT
reg_logo.svg
www.theregister.co.uk/design_picker/fa16d26efb42e6ba1052f1d387470f643c5aa18d/graphics/std/ 		15 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/fa16d26efb42e6ba1052f1d387470f643c5aa18d/graphics/std/reg_logo.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
363edeba1963685d08a885c613f43fd3c94fa0ba6cea87de6036f960c9d38717

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:27 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 26 Sep 2019 14:47:16 GMT
server
cloudflare
age
12136573
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
57a1ffb5ccfce610-LHR
expires
Tue, 20 Apr 2021 15:45:27 GMT
search.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 		609 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/search.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
11615895
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
57a1ffb61dc7e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
vulture.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		2 KB
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
1764868
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb64e55e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
search.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/ 		609 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icons/search.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
15162641
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
57a1ffb66eb7e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
dl.gif
regmedia.co.uk/2016/04/14/ 		35 B
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2016/04/14/dl.gif
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
2004878
cf-polished
origSize=43, status=webp_bigger
cf-ray
57a1ffb68b80d6b5-FRA
status
200
cf-bgj
imgq:85
content-length
35
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 14 Apr 2016 13:41:38 GMT
server
cloudflare
etag
"2b-530720dc4f2ea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01
expires
Tue, 20 Apr 2021 15:45:28 GMT
rect_comment_bubble_white.svg
www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/ 		496 B
358 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/029b461aa66d73b1e8cb351f99212507d4da660c/graphics/icon/rect_comment_bubble_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
2110587
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb66eb8e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
reddit.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		1 KB
647 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/reddit.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
15150616
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
57a1ffb66ebae610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
twitter.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		745 B
468 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/twitter.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
15162641
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03
cache-control
public, max-age=33696000
cf-ray
57a1ffb66ebce610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
facebook.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		311 B
272 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/facebook.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
1493026
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb66ebde610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
linkedin_alt.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		363 B
288 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_alt.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
10402907
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
57a1ffb66ebfe610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
shutterstock_microsoft_disguise.jpg
regmedia.co.uk/2020/03/03/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2020/03/03/shutterstock_microsoft_disguise.jpg?x=442&y=293&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a63c034cf831b06a3fcb0f1fb46eb33eeb289ceec1c412b3707fe7efd7e729ce

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
516299
cf-polished
qual=85, origFmt=jpeg, origSize=26339
cf-ray
57a1ffb68b81d6b5-FRA
status
200
content-disposition
inline; filename="shutterstock_microsoft_disguise.webp"
cf-bgj
imgq:85
content-length
24498
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 04 Mar 2020 19:07:46 GMT
server
cloudflare
etag
"66e3-5a00c22bb16cd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
office_365_photo_by_dennizn_via_shutterstock.jpg
regmedia.co.uk/2016/09/07/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2016/09/07/office_365_photo_by_dennizn_via_shutterstock.jpg?x=174&y=115&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cf5fe2a8bea4ce55ac0a55261b35aa1a5a36c84f94cc936e964581c57a49499

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
255171
cf-polished
qual=85, origFmt=jpeg, origSize=14838
cf-ray
57a1ffb68b85d6b5-FRA
status
200
content-disposition
inline; filename="office_365_photo_by_dennizn_via_shutterstock.webp"
cf-bgj
imgq:85
content-length
7144
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 04 Mar 2020 19:07:24 GMT
server
cloudflare
etag
"39f6-5a00c217456c7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
vulture_16bits_half.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		7 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/vulture_16bits_half.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1bc9eeec7ba19c97ba1d50c10195c3f74302af5e712409e51e5b8d35b6f46eb8

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Tue, 01 Oct 2019 14:16:02 GMT
server
cloudflare
age
15150616
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
57a1ffb66ec0e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
blocked.jpg
regmedia.co.uk/2017/07/13/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2017/07/13/blocked.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c22e4ff7f866aaaf5ce118ba0b5d5cb9c01fd5283cbd684a0c1523088914b5f

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
99112
cf-polished
qual=85, origFmt=jpeg, origSize=6938
cf-ray
57a1ffb69b89d6b5-FRA
status
200
content-disposition
inline; filename="blocked.webp"
cf-bgj
imgq:85
content-length
6874
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Sat, 23 Sep 2017 10:24:24 GMT
server
cloudflare
etag
"1b1a-559d8bac40b38"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
hacker_shutterstock.jpg
regmedia.co.uk/2018/07/16/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2018/07/16/hacker_shutterstock.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00a90076624308d96229a561974d2d72398e2d48e4a8e9dbdcf178904014aac6

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
1874192
cf-polished
qual=85, origFmt=jpeg, origSize=5025
cf-ray
57a1ffb69b8bd6b5-FRA
status
200
content-disposition
inline; filename="hacker_shutterstock.webp"
cf-bgj
imgq:85
content-length
4962
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 06 Nov 2019 19:20:27 GMT
server
cloudflare
etag
"13a1-596b2710084e6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy02gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
shutterstock_net_neutrality.jpg
regmedia.co.uk/2020/02/21/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2020/02/21/shutterstock_net_neutrality.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f52391293222a60783b5bb19beb71b7aef0656996f615126f9e4273f6eb2930

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
2926414
cf-polished
status=not_needed
cf-ray
57a1ffb69b8cd6b5-FRA
status
200
cf-bgj
imgq:85
content-length
8789
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 21 Feb 2020 05:16:12 GMT
server
cloudflare
etag
"2255-59f0f1eb7111a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
shutterstock_five_fingers.jpg
regmedia.co.uk/2020/03/17/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2020/03/17/shutterstock_five_fingers.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38b1d39f58aeca1598f48686d80a1626878e85adc503d1c49224d029a956b022

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
MISS
status
200
content-length
7274
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 18 Mar 2020 07:48:41 GMT
server
cloudflare
etag
"1c6a-5a11c47f0142f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
x-reg-bofh
pfy02gb
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
57a1ffb69ba1d6b5-FRA
expires
Tue, 20 Apr 2021 15:45:28 GMT
microsoftvancouver_shutterstock.jpg
regmedia.co.uk/2017/12/19/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2017/12/19/microsoftvancouver_shutterstock.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2233f952a2c6ebbd1b9d6328cf8ec965e4502c126b9cb10473afdb0d2dae856

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
12730415
cf-polished
degrade=85, origSize=8512, status=webp_bigger
cf-ray
57a1ffb69ba5d6b5-FRA
status
200
cf-bgj
imgq:85
content-length
8100
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 19 Dec 2017 20:37:39 GMT
server
cloudflare
etag
"2140-560b77013387f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01
expires
Tue, 20 Apr 2021 15:45:28 GMT
vb6.png
regmedia.co.uk/2017/02/02/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2017/02/02/vb6.png?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
329d84bf3fb7768bd526571fd468b40d411a5049c6c524b995741205d8b8e74b

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
674357
cf-polished
origFmt=png, origSize=32921
cf-ray
57a1ffb69ba7d6b5-FRA
status
200
content-disposition
inline; filename="vb6.webp"
cf-bgj
imgq:85
content-length
20918
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Wed, 08 Mar 2017 10:25:52 GMT
server
cloudflare
etag
"8099-54a358d9a7bc4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
victory.jpg
regmedia.co.uk/2017/08/25/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2017/08/25/victory.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40f8e5fb07c0b433ef6e9a1932d0f84d747458d02c9b1931a5bb9a4c31dc23dd

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
255171
cf-polished
qual=85, origFmt=jpeg, origSize=5504
cf-ray
57a1ffb69ba9d6b5-FRA
status
200
content-disposition
inline; filename="victory.webp"
cf-bgj
imgq:85
content-length
4952
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 25 Aug 2017 18:05:34 GMT
server
cloudflare
etag
"1580-55797ca9cf1d6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
milhouse_vs_nelson_648.jpg
regmedia.co.uk/2015/07/23/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2015/07/23/milhouse_vs_nelson_648.jpg?x=198&y=131&crop=1
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1a95e37b3c4245aa77b33811f29f6a461905c8a388a40dd55183b72ceda0475

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
255171
cf-polished
degrade=85, origSize=28998, status=webp_bigger
cf-ray
57a1ffb69bacd6b5-FRA
status
200
cf-bgj
imgq:85
content-length
8970
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 19 Oct 2018 16:39:12 GMT
server
cloudflare
etag
"7146-578978b179f87"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01gb
expires
Tue, 20 Apr 2021 15:45:28 GMT
whitepaper_book.png
www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/4ee431b84ac2d23c13376f753522acd7ecbb9b47/graphics/icon/whitepaper_book.png
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
10747647
cf-ray
57a1ffb66ec1e610-LHR
status
200
content-length
1119
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Fri, 17 Feb 2017 15:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy01
expires
Tue, 20 Apr 2021 15:45:28 GMT
footer_mob_nav_arrow_black.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		331 B
291 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_black.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
15162641
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
57a1ffb66ec4e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
sitpub_footer.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		8 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/sitpub_footer.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
10990014
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02
cache-control
public, max-age=33696000
cf-ray
57a1ffb67f04e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
footer_mob_nav_arrow_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		328 B
290 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/footer_mob_nav_arrow_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
807178
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb67f05e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
linkedin_white.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		371 B
381 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/linkedin_white.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
2196762
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy02gb
cache-control
public, max-age=33696000
cf-ray
57a1ffb67f08e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
rss.svg
www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/ 		400 B
327 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/d2e337b97204af4aa34dda04c4e5d56d954b216f/graphics/icon/rss.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
23113874
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
57a1ffb67f09e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
/
nir.theregister.co.uk/ 		144 B
679 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.theregister.co.uk/?g=vk&g=c&g=sa&g=vvfc&s=c/sec.front&s=vk/microsoft&s=vk/malware&s=vk/phishing&s=vk/azure&s=vk/dns&s=vvfc/6b2938ed106729c71e35884fc3f9730d&s=vvfc/6b2938ed106729c71e35884fc3f9730d&s=vvfc/6b2938ed106729c71e35884fc3f9730d
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9133ed29cfbe32807472b8e62d611e5d68d4b30dab62bd495fe2e9c46457f182

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
57a1ffb67f0be610-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy03gb
expires
Thu, 01 Jan 1970 00:00:00 GMT
integrator.js
adservice.google.co.uk/adsid/ 		109 B
839 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.co.uk/adsid/integrator.js?domain=www.theregister.co.uk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
839 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.theregister.co.uk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
104
x-xss-protection
0
pubads_impl_2020032301.js
securepubads.g.doubleclick.net/gpt/ 		167 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
sffe /
Resource Hash
f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 23 Mar 2020 17:22:27 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
62290
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:28 GMT
arimo-400.latin.woff2
www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-400.latin.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9

Request headers

Referer
https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/scaffolding.css
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
1505623
status
200
content-length
26144
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 04 Feb 2020 15:35:20 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
https://www.theregister.co.uk
x-reg-bofh
pfy03gb
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
57a1ffb67f0ce610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
arimo-700.latin.woff2
www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-700.latin.woff2
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a

Request headers

Referer
https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/scaffolding.css
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
4406146
status
200
content-length
25628
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Tue, 04 Feb 2020 15:35:20 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
https://www.theregister.co.uk
x-reg-bofh
pfy01gb
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
57a1ffb67f0ee610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
promo_unit_arrow.svg
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/ 		248 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/graphics/icons/promo_unit_arrow.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed

Request headers

Referer
https://www.theregister.co.uk/css_picker/webkit/59d8520414350f976af1393738a6ede150b34b00/design.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 24 Aug 2017 14:00:39 GMT
server
cloudflare
age
33547304
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy04
cache-control
public, max-age=33696000
cf-ray
57a1ffb68f41e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
envelope.svg
www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/ 		454 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.theregister.co.uk/design_picker/abc3c5e243ee56667184d6134cd9d346f5cd5b59/graphics/icons/envelope.svg
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
HIT
last-modified
Thu, 09 Aug 2018 12:44:14 GMT
server
cloudflare
age
10402907
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
x-reg-bofh
pfy01
cache-control
public, max-age=33696000
cf-ray
57a1ffb6cfe2e610-LHR
expires
Tue, 20 Apr 2021 15:45:28 GMT
outbrain.js
widgets.outbrain.com/ 		127 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.outbrain.com/outbrain.js?_=1585237528050
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-250-44.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Thu, 26 Mar 2020 15:45:28 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Mar 2020 08:30:47 GMT
ETag
W/"1fbb3-KoHnezOYyT0SUusJEB8aDSXQE/s"
Vary
Accept-Encoding
Edge-Cache-Tag
widget-cheetah
Content-Type
application/x-javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST
Connection
keep-alive, Transfer-Encoding
Access-Control-Allow-Credentials
false
Timing-Allow-Origin
*
analytics.js
www.google-analytics.com/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
4013
date
Thu, 26 Mar 2020 14:38:35 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
18174
expires
Thu, 26 Mar 2020 16:38:35 GMT
admtracker.lib.min.js
pj.l.admedo.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pj.l.admedo.com/admtracker.lib.min.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.194.18 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-194-18.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d8db699e718814dce4d71b8c7d981df5aed9df3d3b49eb5d8970c3f75c2547ad

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
gzip
last-modified
Tue, 04 Feb 2020 16:09:45 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public,max-age=900
x-amz-cf-id
ydUVna9yk_RYIwcXtp2xs177XhhG93TG9SlRVMxQas6wV9K0oY5w8w==
via
1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
ads.js
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ 		27 B
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
cf-cache-status
HIT
age
14719528
cf-ray
57a1ffb79a4ee610-LHR
status
200
content-length
27
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 05 Apr 2018 12:48:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy04
expires
Tue, 20 Apr 2021 15:45:28 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		55 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3510742177778329&correlator=2989758054849003&output=ldjh&impl=fifs&adsid=NT&eid=21065762%2C21065558&vrg=2020032301&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200326&iu_parts=6978%2Creg_security%2Cfront&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1x1%2C970x91%7C970x90%7C970x250%7C970x251%7C728x90%7C728x91%7C468x60%7C468x61%2C970x250%7C970x90%7C728x90%7C468x60%2C300x1050%7C300x600%7C300x250%7C300x252%2C300x601%7C300x250%7C300x251%7C300x100%7C300x50%2C300x250%7C300x1%7C300x50&ists=32&prev_scp=pos%3Dtop%26raptor%3Dkite%26unitnum%3D1%7Cpos%3Dtop%26raptor%3Dcondor%26unitnum%3D2%7Cpos%3Dbtm%26raptor%3Dhawk%26unitnum%3D3%7Cpos%3Dtop%26raptor%3Deagle%26unitnum%3D4%7Cpos%3Dmid%26raptor%3Dfalcon%26unitnum%3D5%7Cpos%3Dbtm%26raptor%3Dowl%26unitnum%3D6&cust_params=test%3D0%26protocol%3Dhttps%253A%26li%3Dnull%26uid%3Dnull%26sc%3D1%26bwidth%3D15%26bheight%3D12%26orientation%3Dlandscape%26mm_segments%3D%26pid%3D207308%26pt%3Da%26axc%3Dnull%26kw%3Dmicrosoft%252Cmalware%252Cphishing%252Cazure%252Cdns%26cat%3Dnews%26tag%3Dnull%26author%3DShaun%252520Nichols%26year%3D2020%26nsfw%3Dnull%26vid%3Dnull%26ct%3Ds-async&cookie_enabled=1&bc=31&abxe=1&lmt=1585237528&dt=1585237528271&dlt=1585237527960&idt=279&frm=20&biw=1585&bih=1200&oid=3&adxs=-12245933%2C308%2C293%2C978%2C978%2C331&adys=-12245933%2C129%2C3225%2C234%2C2019%2C4513&adks=1331772189%2C284626583%2C1390360203%2C2610646818%2C8582313%2C3059020159&ucis=1%7C2%7C3%7C4%7C5%7C6&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F04%2Fmicrosoft_subdomain_takeover%2F&dssz=27&icsg=15008&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x5108%7C1000x5108%7C1000x279%7C315x2923%7C315x2923%7C924x1274&msz=1x1%7C1000x105%7C1000x278%7C300x1050%7C300x601%7C924x250&ga_vid=1954156433.1585237528&ga_sid=1585237528&ga_hid=1740468099&fws=132%2C4%2C4%2C4%2C4%2C4&ohw=1000%2C1000%2C1000%2C1000%2C1000%2C1000
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
cafe /
Resource Hash
27001ef5418416bd62a72a2c4cd0b2889f88e469ceb63e063cc3e173bc006b9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
10054
x-xss-protection
0
google-lineitem-id
61995219,5321539816,5329618998,5335643672,5321539816,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
35665517499,138305595797,138307041493,138307569172,138305596220,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.theregister.co.uk
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_2020032301.js
securepubads.g.doubleclick.net/gpt/ 		67 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
sffe /
Resource Hash
859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 23 Mar 2020 17:22:27 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
25048
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:28 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers
collect
www.google-analytics.com/ 		35 B
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j81&aip=1&a=1740468099&t=pageview&_s=1&dl=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F04%2Fmicrosoft_subdomain_takeover%2F&ul=en-us&de=UTF-8&dt=Download%20this%20update%20from%20mybrowser.microsoft.com.%20Oh%2C%20sorry%2C%20that%20was%20malware%20on%20a%20hijacked%20sub-domain.%20Oops%20%E2%80%A2%20The%20Register&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&exp=A_aVnslITyK8U4soe88Piw.1&_u=YChAiAABB~&jid=722870982&gjid=894412899&cid=1954156433.1585237528&tid=UA-33330076-1&_gid=553672543.1585237528&cd2=Shaun%20Nichols&cd3=&cd4=www%20story&cd5=news&cd8=none&cd9=&cd10=&z=1297516304
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Mon, 24 Feb 2020 21:41:23 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
2657045
content-type
image/gif
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
access-control-allow-origin
*
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&gjid=894412899&_gid=553672543.1585237528&_u=YChAiAABB~&z=221384743
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&_v=j81&z=221384743
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&_v=j81&z=221384743&slf_rd=1&random=3324758955
42 B
499 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&_v=j81&z=221384743&slf_rd=1&random=3324758955
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:28 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-33330076-1&cid=1954156433.1585237528&jid=722870982&_v=j81&z=221384743&slf_rd=1&random=3324758955
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Cookie set put.html
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 8B42 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-250-44.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/

Response headers

Accept-Ranges
bytes
Content-Type
text/html
ETag
"c0311cf15c21ddda054005e92fad3f9e:1584444137.095532"
Last-Modified
Tue, 17 Mar 2020 10:55:21 GMT
Server
AkamaiNetStorage
Content-Length
416
Cache-Control
max-age=604800
Date
Thu, 26 Mar 2020 15:45:28 GMT
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
Set-Cookie
akacd_widgets_routing=1585237528~rv=34~id=4826072c9e69ff2e880ec8819303c986; path=/; Expires=Thu, 26 Mar 2020 15:45:28 GMT; Secure; SameSite=None
d3d3LnRoZXJlZ2lzdGVyLmNvLnVr
tcheck.outbrainimg.com/tcheck/check/ 		15 B
474 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tcheck.outbrainimg.com/tcheck/check/d3d3LnRoZXJlZ2lzdGVyLmNvLnVr
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.247.226.107 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-226-107.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security
max-age=0; includeSubDomains;
ETag
W/"f-ayLlCL3PuzXSThdu78iReSEjl6Y"
Access-Control-Max-Age
43200
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=7845
Date
Thu, 26 Mar 2020 15:45:28 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
false
Content-Length
15
Expires
Thu, 26 Mar 2020 17:56:13 GMT
placement_invocation
ob.cheqzone.com/ 		38 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c710::2 , Germany, ASN60068 (CDN77, GB),
Reverse DNS
Software
BunnyCDN-DE1-487 /
Resource Hash
f677040712955dc4fc8e9f792849a092501ffec68788837915d8ff8ff7b0d1e2

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:28 GMT
content-encoding
br
server
BunnyCDN-DE1-487
vary
Accept-Encoding
cdn-edgestorageid
487
content-type
text/javascript; charset=utf-8
status
200
cdn-uid
2642aeaf-0ebf-4c43-9f87-c153981605b2
cache-control
public, max-age=43200
cdn-pullzone
62714
cdn-cachedat
2020-02-26 15:49:38
cdn-requestid
8b38f54836452f5ed642d114b87b0da9
cdn-requestcountrycode
DE
cdn-cache
HIT
show_pla
obs.cheqzone.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://obs.cheqzone.com/show_pla?id=65349&url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F04%2Fmicrosoft_subdomain_takeover%2F&sf=0&k=&idx=0&ch=&ext=&np=linux%20x86_64&nv=google%20inc.&rand=136912199635881115120272405017292315682209970782&nc=0&tsf=0&tsfmi=&pv=0&cb=1585237529003&ref=&pit=1&hl=2&op=0&fs=1600x1200&ss=1600x1200&pre=0&jsonp=OBR.extern.onCheqResponse&mr=&ag=438074594&at=&bid=e30%3D&di=W1sxMiwie1wiZVwiOjAsXCJ3Z2xcIjoxfSJdLFstMSwiLSJdLFstMiwiOCxtMmhUczJoaGliM2d5%0D%0AaFkwcEk2TDBFQ0NVQkFvRWtKTWdmQ1QwSkJEQzloaFpxS0tFSFRNY0JiTnh0dVRmMWV0dnVUdjJm%0D%0AdVpMQUVGTC82MGRhYnBHTTUreVpjODQ3N3d5Qy8rIl0sWy0zLCJbXSJdLFstNCwiLSJdLFstNSwi%0D%0ALSJdLFstNiwie1wid1wiOltcIlJlZ1pvb3RcIixcIlJlZ0NDXCIsXCJSZWdQYWdlVHlwZVwiLFwi%0D%0AUmVnVHJ1ZVBhZ2VUeXBlXCIsXCJSZWdBcnRpY2xlXCIsXCJzcHJpbnRmXCIsXCJSZWdVdGlsc1wi%0D%0ALFwiUmVnQ0JXXCIsXCJfUmVnQ0JXVGVzdFwiLFwiUmVnQ0JXQVwiLFwiUmVnQ0JXVFwiLFwiaXNf%0D%0Acm93c19iYXNlZF9wYWdlXCIsXCJhZHNfc3RhdGVzX3RyYWNraW5nXCIsXCJSZWdBU1RcIixcInRy%0D%0AYWNrX2FidFwiLFwiZ3B0X2pzX2Vycm9yZWRcIixcImJpcmRfYWx0ZXJuYXRpdmVcIixcImluaXRf%0D%0AZ3B0XCIsXCJhZF9mcmVlXCIsXCJzaG93X2FydGljbGVfc2lnbnVwX21sXCIsXCJSZWdUTFJvdGF0%0D%0AZVwiLFwibG9hZF9tZWRpYV9wbGF5ZXJcIixcInBpdm90X3NodWZmbGVcIixcInBpdm90X2Fyb3Vu%0D%0AZFwiLFwiZGlzcGxheV9zb2NpYWxfcG9wdXBcIixcInJlZ3RsZFwiLFwiZ2V0RWxlbWVudENzc1wi%0D%0ALFwic2V0RWxlbWVudENzc1wiLFwiZ2V0RWxlbWVudEhlaWdodFwiLFwibW92ZUVsZW1lbnRcIixc%0D%0AImFjY291bnRfZm9ybV9jaGVja1wiLFwiZ2V0X2Vwb2NoXCIsXCJyb2xsaW5nX3RpbWVcIixcInRp%0D%0AbWVfY2FsY1wiLFwiZ2V0X3VybF9wYXJhbVwiLFwicmVnX25sX2Zvcm1cIixcInNjYWxlX2FydGlj%0D%0AbGVfaW5uZXJfZWxlbXNcIixcInRvZ2dsZV9hY2NvdW50X3RhYl9zdGF0ZVwiLFwicmVzaXplX2lt%0D%0AZ191cmxcIixcInNlbmRfdG9fYW5hbHl0aWNzXCIsXCJOT19ERVZfQ09PS0lFXCIsXCJpc1Njcm9s%0D%0AbGVkSW50b1ZpZXdcIixcImNoZWNrX3Joc19zdGlja3lfYWRzX2dlbmVyYWxfY29uZGl0aW9uc1wi%0D%0ALFwicmhzX3N0aWNreV9hZF9tdTFfc3BvdFwiLFwiaXNJRVwiLFwic3Bhd25fYW5kX2xvYWRfaW1n%0D%0AX2Zyb21fZGl2XCIsXCJzdGlja3lfYWRfUlRfMkZcIixcInJoc19zdGlja3lfYWRfYnRuX3Nwb3Rc%0D%0AIixcImF1Z21lbnRfcHJvbW9fdW5pdFwiLFwic29jaWFsX2J1dHRvbl9zaGFyZVwiXSxcIm5cIjpb%0D%0AXSxcImRcIjpbXX0iXSxbLTcsIi0iXSxbLTgsIi0iXSxbLTksIi0iXSxbLTEwLCItIl0sWy0xMSwi%0D%0Ae1widFwiOlwiXCIsXCJtXCI6W1wib2c6dGl0bGVcIixcIm9nOmRlc2NyaXB0aW9uXCIsXCJuZXdz%0D%0AX2tleXdvcmRzXCJdfSJdLFstMTIsIm51bGwiXSxbLTEzLCItIl0sWy0xNCwie1wib1wiOjAuMDA3%0D%0AMTQyODU3MTQyODU3MTQzfSJdLFstMTUsIi0iXSxbLTE2LCIwIl0sWy0xNywiMTYiXSxbLTE4LCJb%0D%0AMCwwLDAsMV0iXSxbLTE5LCJbMCwwLDAsMCwwLDAsMSwyNCwyNCxcIi1cIiwxNjAwLDEyMDAsMTYw%0D%0AMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyMDBdIl0sWy0yMCwiMTk1NDE1NjQzMy4xNTg1MjM3NTI4%0D%0AIl0sWy0yMSwidFRSUlR5bjgiXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy0yMywiKyJdLFstMjQs%0D%0AIltdIl0sWy0yNSwiLSJdLFstMjYsIntcInRqaHNcIjo2OTA5Mzk2LFwidWpoc1wiOjU1ODk5Njgs%0D%0AXCJqaHNsXCI6NDI5NDcwNTE1Mn0iXSxbLTI3LCJbMCwxMCwwLFwiNGdcIl0iXSxbLTI4LCJlbi1V%0D%0AUyJdLFstMjksIntcInZcIjpbMiwyLDIsMiwwLDAsMCwyLDAsMiwwLDIsMCwwLDIsMiwyLDJdfSJd%0D%0ALFstMzAsIltcInZcIiwwXSJdLFstMzEsInRydWUiXSxbLTMyLCIxIl0sWy0zMywiLSJdLFstMzQs%0D%0AIi0iXV0%3D&tsfu=&fst=1600x1200&dep=0&cpos=%5B%7B%22x%22%3A330%2C%22y%22%3A4504%2C%22w%22%3A924%2C%22h%22%3A0%7D%2C%7B%22w%22%3A1600%2C%22h%22%3A1200%7D%5D&ver=24&cri=xHlPlH5yMl&sdd=%7B%7D&pto=1187
Requested by
Host: ob.cheqzone.com
URL: https://ob.cheqzone.com/placement_invocation?id=65349&idx=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
54.172.89.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-89-8.compute-1.amazonaws.com
Software
/
Resource Hash
b7f7d166c762af007c4a4be814c5989b197cfc0e3f1c2198b94a4020da47f15d

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
gzip
content-type
text/javascript
status
200
cache-control
no-cache, no-store, must-revalidate
content-length
856
expires
Fri, 01 Jan 1990 00:00:00 GMT
osd.js
www.googletagservices.com/activeview/js/current/ 		74 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28015
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame 6BDE 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3541
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:28 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame 6BDE 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3541
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:28 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame 6BDE 		92 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3555
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28328
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f4788313c10056ed"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:14 GMT
truncated
/ Frame 6BDE 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a7dd47584c51e6769ab8b6e59b58fd837b296c8e0d575d676f721c58eb12bdd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
amp4ads-host-v0.js
cdn.ampproject.org/rtv/012003101714470/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-host-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3503
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
7178
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:47:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9d3d923337ef7e9b"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:47:06 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame 6145 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3541
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:28 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame 6145 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3541
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:28 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame 6145 		92 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3555
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28328
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f4788313c10056ed"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:14 GMT
truncated
/ Frame 6145 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1de0aa76d87c52126732d3b462adeab6f77a39ed39295f61c206228858076407

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame D9CA 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7Id1CuV1l6UpisjU1lHv1rWL5d-VHaj_nVprzX__xihAcep-Vj4z_kQKGbwgh-ZbHjWhrDdjOMFz2SJ4X2gXs-rYB_mx7msXuDCwnvp_wC5e-XA1Oiwj-ClRA2C-cNGyEamIXfCQkpJolxMWQoWigcYfUWm2pA1YMo9sEb655_EjgS03VW7bFrZ6ihb0_hA35TKFJWVNFgpOi6eVegzcfYmJiK01fzokJ5C9DMYxU5aUTQtxhjIfmmBcam1AvSIw3WFu-0TstDX242A2-jLjHs5FzoXcX2DxotFA&sai=AMfl-YSo1ZKb1GWhFiiG3ISy3jDVaKmS1TMh49n6wX-63DWk8oSOrmBzGkTJ6xh2hlEWsLpW-hR7ssiTTAq9uoWaJUntryGy2vXOAeOo-ab8QA&sig=Cg0ArKJSzBqu6cH_RxZ9EAE&urlfix=1&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
empty

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 15:45:29 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
/
forms.theregister.co.uk/studies/internal/state_or_it_dept/ Frame E5FA 		3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aeb1cb5a1fc9ff73fef24f06eac380b67bbe63862eeb40d92485bb2ab7aee94e

Request headers

:method
GET
:authority
forms.theregister.co.uk
:scheme
https
:path
/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/

Response headers

status
200
date
Thu, 26 Mar 2020 15:45:29 GMT
content-type
text/html
set-cookie
__cfduid=d47aaa588e2937f3d74a2785719d7f5561585237529; expires=Sat, 25-Apr-20 15:45:29 GMT; path=/; domain=.theregister.co.uk; HttpOnly; SameSite=Lax
vary
Host,Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
57a1ffbdac1de610-LHR
content-encoding
br
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame D9CA 		74 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1585165059237800"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28264
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame C20F 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3541
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:28 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012003101714470/ Frame C20F 		200 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3541
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
55811
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:28 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"789295de90cb321e"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:28 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012003101714470/v0/ Frame C20F 		92 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012003101714470/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
3555
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28328
x-xss-protection
0
server
sffe
date
Thu, 26 Mar 2020 14:46:14 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"f4788313c10056ed"
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 26 Mar 2021 14:46:14 GMT
truncated
/ Frame C20F 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7eb0bd9a91e03d07ef5c63f6f19a160ba4b2f0d0cbb694f13f681546dec89a59

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
/
nir.theregister.co.uk/ 		0
271 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.theregister.co.uk/?s=sa/oid.102962979
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:29 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
57a1ffbd8bade610-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy01gb
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
nir.theregister.co.uk/ 		0
129 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.theregister.co.uk/?s=sa/oid.2424853138
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:29 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
57a1ffbdac1fe610-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy01gb
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
nir.theregister.co.uk/ 		0
129 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nir.theregister.co.uk/?s=sa/oid.2608680229
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:29 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
57a1ffbdac21e610-LHR
content-type
application/x-javascript
status
200
cache-control
no-cache
x-reg-bofh
pfy02gb
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
1064404211158951621
tpc.googlesyndication.com/simgad/ Frame 6BDE 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1064404211158951621
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c8f75937a64cb180571def8a348d77c573b9ec9cc72fe4502860db0d54381ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 06 Mar 2020 17:47:28 GMT
x-content-type-options
nosniff
age
1720681
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
61806
x-xss-protection
0
last-modified
Fri, 06 Mar 2020 16:52:39 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Mar 2021 17:47:28 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 6BDE 		0
159 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv5fWYsn0dzCD4HW96boVyGcJawRYg5cDJ8jMqB_8v3RgEhVUgWlaWkIyVvR1mHHDpO-bWKsXWOOsKcTwIehBvH4iQTPV0Da3yjX9wt0SHk8g6jxSktMgbtzi51VeE1hVhrVFvoXAka2o_LJ8RMKzC6zqd5qNFZlXHL2Ltn-5mvC3CD6QhtIhpaEB7udKfvdjf8qbfXawsjDh2JKg96_g5gj_TIjsNq5LIvj_BPb2NFh6LmSSQpB1n4E5thMdHvp_gEqzCYZ7hDBOyB_ZHl&sai=AMfl-YSWCHdlL9B2oh-oqOavLjfpdCRNK6fASOB_oC_sfzLbWeEVcXBq_R7QuiCDCJTSfDU6_hH9GAp1Euo0aXq5iL3ohW7iRM0fT1ICJfuVXQ&sig=Cg0ArKJSzGesaJBfbGPQEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
1276104633831866114
tpc.googlesyndication.com/simgad/ Frame 6145 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1276104633831866114
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
120ce55883f26d68e2108231d7f0c6e772e186d2b9e6a4cf72cc6c75bc973e54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 19 Mar 2020 15:57:42 GMT
x-content-type-options
nosniff
age
604067
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
81508
x-xss-protection
0
last-modified
Thu, 19 Mar 2020 15:20:58 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 19 Mar 2021 15:57:42 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 6145 		0
159 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvYS1-uzKASDSnOItz6DsCULeqZIqHgP-tayw5NdpqMnv_kLa62UMJNR5fbGvnLu3XcT7IxUZNBvRdbqEbRAtWQwf7GBx4SAjLMo9Qx_y3kRqiguhfKjSsHJ50D20Dxkmq0UtykpA0mKBLkGdAttG_7xWm5LdgQNvehIlikse4awrjiqWNPdA7yaO5z2Y9KYRbJ2ZyHY-2377l1EkI73AiDWifOzGbLwEVGHz1xFJfMdg1dod6vZLb_4wMfv4dHO2sC5IpW_jg38Yf1q9SE&sai=AMfl-YR3WbwU97X6X_Ahk-VJCvTf2IAtNPCXxmK9FPSiwvDF5B0Mn4siI1dWRRQT4ETcgSPYc-3n7dYd9n3sffs4d9mxqUhSfrTv8FqfOL2j5A&sig=Cg0ArKJSzMguDsZyCilTEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
10196342649340698821
tpc.googlesyndication.com/simgad/ Frame C20F 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/10196342649340698821
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
615d3776c617108f0603964f782f5f0ef6ee0037a2be5a575066c337302b7e8c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 10 Mar 2020 22:42:58 GMT
x-content-type-options
nosniff
age
1357351
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
82993
x-xss-protection
0
last-modified
Fri, 06 Mar 2020 16:52:39 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Mar 2021 22:42:58 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame C20F 		0
159 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssscamPX3mRdJkccus-0QJOIS8g-1Lx8IfMaTQbiAnlUoMuTYev_fpqs6rlqUHoyIfrH4Zb-7gjNcsRG2tB0rZy42oHowpXZVRrMm6SGC3zKTa7rCN1gsZTd3XDjkrAJpeRBrTIJZBFKNDCVcv9-F9fBtqJr_fJH5Y9umu-VT_qk1LZ_8xK4IU0DwXYoon84Dti_oqIPO0iLVQTVSl0OP6lgBcjnL_xe2zK6hhRFNM-gYoJVcd7RBc9t-tdNPBUuIzmVW54kMFoUKJTefwA&sai=AMfl-YQSc1KeInOyH1GSRmfIvJglCrfHFm4F_wwNknC8zNTvDh9CcpLze2BZXHRAfnI0Gvvm3fOxSgyG4BKZL_G_b6WVQ7AYWg9Ov6dX0WvDtQ&sig=Cg0ArKJSzHZIxQxpiYrLEAE&adurl=
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.22.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s14-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		7 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020032301&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bfb005ce46fe9fb257c6149a546d29868258a301bc745363dab6742e49587e42
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5167
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2020032301.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1582746470043195"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
5456
x-xss-protection
0
expires
Thu, 26 Mar 2020 15:45:29 GMT
truncated
/ Frame D9CA 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
65962c8c51214771f2bbadf505adae523cbb6ac4f5a7a9037d771cdbf0d94f89

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
tp.gif
regmedia.co.uk/2007/09/13/
Redirect Chain
  • https://go.theregister.co.uk/k/abt_a
  • https://regmedia.co.uk/2007/09/13/tp.gif
34 B
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://regmedia.co.uk/2007/09/13/tp.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5351 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
cf-cache-status
HIT
age
678450
cf-polished
origFmt=gif, origSize=49
cf-ray
57a1ffbf1db2d6b5-FRA
status
200
content-disposition
inline; filename="tp.webp"
cf-bgj
imgq:85
content-length
34
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 13 Sep 2007 11:17:03 GMT
server
cloudflare
etag
"31-43a027a4c29c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy03gb
expires
Tue, 20 Apr 2021 15:45:29 GMT

Redirect headers

cf-ray
57a1ffbebfa1e610-LHR
date
Thu, 26 Mar 2020 15:45:29 GMT
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://regmedia.co.uk/2007/09/13/tp.gif
content-type
text/html; charset=iso-8859-1
status
302
x-reg-bofh
pfy01gb
content-length
310
runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame AEDC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/209/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
5727
date
Thu, 26 Mar 2020 15:29:21 GMT
expires
Fri, 26 Mar 2021 15:29:21 GMT
last-modified
Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
968
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
1064404211158951621
tpc.googlesyndication.com/simgad/ Frame 6BDE 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1064404211158951621
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5c8f75937a64cb180571def8a348d77c573b9ec9cc72fe4502860db0d54381ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Fri, 06 Mar 2020 17:47:28 GMT
x-content-type-options
nosniff
age
1720681
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
61806
x-xss-protection
0
last-modified
Fri, 06 Mar 2020 16:52:39 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 06 Mar 2021 17:47:28 GMT
dwce_cheq_events
log.outbrainimg.com/loggerServices/ 		4 B
325 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585237529425&sessionId=82c9af27-9293-9402-2410-134cb6289074&url=www.theregister.co.uk&cheqSource=1&cheqEvent=0&exitReason=3
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 15:45:29 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
X-TraceId
1e03cc536bbed1f9905f52c252f32020
Content-Length
4
Expires
0
get
odb.outbrain.com/utils/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F04%2Fmicrosoft_subdomain_takeover%2F&srcUrl=https%3A%2F%2Fwww.theregister.co.uk%2Fheadlines.atom&settings=true&recs=true&widgetJSId=GS_1&key=NANOWDGT01&idx=0&version=1050170&apv=false&sig=tTRRTyn8&format=html&va=true&rand=80903&pdobuid=-1&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&adblck=false&clid=82c9af27-9293-9402-2410-134cb6289074&fdu=www.theregister.co.uk&secured=true&cmpStat=0&ccpaStat=0&ref=&px=330&py=4343&vpd=3143
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
90d703cb665884f61fb47d2aea9178ff1094bb228160a602c7e9896953e6f850
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains;

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=0; includeSubDomains;
content-encoding
gzip
traffic-path
NYDC1, JFK, HHN, Europe1
x-cache
MISS, MISS
p3p
policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status
200
x-traceid
2a3b5827c49de77b0aa451c2c309e9ae
content-length
1476
x-served-by
cache-jfk8150-JFK, cache-hhn4055-HHN
pragma
no-cache
x-timer
S1585237530.508016,VS0,VE105
date
Thu, 26 Mar 2020 15:45:29 GMT
vary
Accept-Encoding, User-Agent
content-type
text/x-json; charset=UTF-8
via
1.1 varnish, 1.1 varnish
expires
Thu, 01 Jan 1970 00:00:00 GMT
cache-control
no-cache
backend-ip
104.156.90.50
accept-ranges
bytes, bytes
x-cache-hits
0, 0
dwce_cheq_events
log.outbrainimg.com/loggerServices/ 		4 B
325 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1585237529447&sessionId=82c9af27-9293-9402-2410-134cb6289074&url=www.theregister.co.uk&cheqSource=1&cheqEvent=2&responseTime=544
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 15:45:29 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
X-TraceId
346eb275511d22868ad71326ed417012
Content-Length
4
Expires
0
scaffolding.css
forms.theregister.co.uk/css_picker/webkit/7e2d9ae78d1dff0458083abe03eb3071fccf1e1a/ Frame E5FA 		19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/css_picker/webkit/7e2d9ae78d1dff0458083abe03eb3071fccf1e1a/scaffolding.css
Requested by
Host: forms.theregister.co.uk
URL: https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11b10fdb2a5de2bc29f16503b2ee10492c9441b12e7d1d0248ff764f62a0206d

Request headers

Referer
https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 21 Mar 2020 00:31:04 GMT
server
cloudflare
age
17443
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host,Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=33696000
cf-ray
57a1ffbf18bce610-LHR
expires
Tue, 20 Apr 2021 15:45:29 GMT
design.css
forms.theregister.co.uk/css_picker/webkit/7e2d9ae78d1dff0458083abe03eb3071fccf1e1a/ Frame E5FA 		52 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/css_picker/webkit/7e2d9ae78d1dff0458083abe03eb3071fccf1e1a/design.css
Requested by
Host: forms.theregister.co.uk
URL: https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785

Request headers

Referer
https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 05 Mar 2020 14:40:15 GMT
server
cloudflare
age
17443
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host,Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=33696000
cf-ray
57a1ffbf18bee610-LHR
expires
Tue, 20 Apr 2021 15:45:29 GMT
_.js
forms.theregister.co.uk/design_picker/8125be5b011a6297a0c2c7ac01c6b66381c35418/javascript/ Frame E5FA 		207 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/design_picker/8125be5b011a6297a0c2c7ac01c6b66381c35418/javascript/_.js
Requested by
Host: forms.theregister.co.uk
URL: https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2fec464c8133d8aa0d6cf4f140ae33ac83f5420d56f94cc47e8eb848817783f5

Request headers

Referer
https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Mar 2020 16:05:34 GMT
server
cloudflare
age
17443
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host,Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=33696000
cf-ray
57a1ffbf18c1e610-LHR
expires
Tue, 20 Apr 2021 15:45:29 GMT
1276104633831866114
tpc.googlesyndication.com/simgad/ Frame 6145 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1276104633831866114
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
120ce55883f26d68e2108231d7f0c6e772e186d2b9e6a4cf72cc6c75bc973e54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 19 Mar 2020 15:57:42 GMT
x-content-type-options
nosniff
age
604067
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
81508
x-xss-protection
0
last-modified
Thu, 19 Mar 2020 15:20:58 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 19 Mar 2021 15:57:42 GMT
10196342649340698821
tpc.googlesyndication.com/simgad/ Frame C20F 		81 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/10196342649340698821
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
615d3776c617108f0603964f782f5f0ef6ee0037a2be5a575066c337302b7e8c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Tue, 10 Mar 2020 22:42:58 GMT
x-content-type-options
nosniff
age
1357351
x-dns-prefetch-control
off
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
82993
x-xss-protection
0
last-modified
Fri, 06 Mar 2020 16:52:39 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 10 Mar 2021 22:42:58 GMT
arimo-700.latin.woff2
forms.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/ Frame E5FA 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-700.latin.woff2
Requested by
Host: forms.theregister.co.uk
URL: https://forms.theregister.co.uk/design_picker/8125be5b011a6297a0c2c7ac01c6b66381c35418/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a

Request headers

Referer
https://forms.theregister.co.uk/css_picker/webkit/7e2d9ae78d1dff0458083abe03eb3071fccf1e1a/scaffolding.css
Origin
https://forms.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
cf-cache-status
HIT
last-modified
Tue, 04 Feb 2020 15:35:20 GMT
server
cloudflare
age
17443
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
status
200
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
57a1ffbf8a07e610-LHR
content-length
25628
expires
Tue, 20 Apr 2021 15:45:29 GMT
arimo-400.latin.woff2
forms.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/ Frame E5FA 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/design_picker/5e49edbd1875f214e0decae1e24b200066780fa8/style/fonts/arimo/arimo-400.latin.woff2
Requested by
Host: forms.theregister.co.uk
URL: https://forms.theregister.co.uk/design_picker/8125be5b011a6297a0c2c7ac01c6b66381c35418/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9

Request headers

Referer
https://forms.theregister.co.uk/css_picker/webkit/7e2d9ae78d1dff0458083abe03eb3071fccf1e1a/scaffolding.css
Origin
https://forms.theregister.co.uk
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:29 GMT
cf-cache-status
HIT
last-modified
Tue, 04 Feb 2020 15:35:20 GMT
server
cloudflare
age
17443
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
status
200
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
57a1ffbf8a0ce610-LHR
content-length
26144
expires
Tue, 20 Apr 2021 15:45:29 GMT
gen_204
pagead2.googlesyndication.com/pagead/ 		0
58 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gpt_2020032301&jk=3510742177778329&bg=!QkGlQVlYxNDduvhthZwCAAAASFIAAAAfmQFhabr8kRgFuQVWdt7S_fpDBjXJvbiw9H2eLH902Un4Dzhmn18tBlAsulxPtogWos8uVYJ705bHEgwCESxObXiQNihM-g0Yzjqb7AAR-fz_xYPSmeev8w9e7f0jtFSq1ISZPswVQpA3GI-QnkZUNwLGKVOy4GxtU--SGPyZ3-6PPdcb2mH4T80qPtUUBPJGTfDZpEwGMTbzASwATBeD-5gaHhhmrc_N1Hmt5Zja902bJEoU8TXDDdhtlaLwd1aPOmCMSWM9Qiwc2GGsNY-hKkaQTXo3Eg0BiL_ijNWN5nkyxYutj5J6TZ7LGW0WS4Z-2ZrJz47BOeQOn5EtQdPi4uIHNaEW_bXZeghJwK-e9uCNRxMowHkwJoTuHerGS9mQb7mg5pmJTGsUptwQwtxiaxvz3nFe7zj6WJCTj8mgE12AncKcV2OxjEcOtaJ1O49dnK83xRH21WQGh1E6veJsvxW8ozU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:29 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
widgetGlobalEvent
log.outbrainimg.com/loggerServices/ 		4 B
325 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://log.outbrainimg.com/loggerServices/widgetGlobalEvent?rId=1faab61cdc3cd7e18eb46e3625d26054&pvId=1faab61cdc3cd7e18eb46e3625d26054&sid=7989&pid=28775&idx=0&wId=829&pad=0&org=0&tm=842&eT=0&widgetWidth=924&widgetHeight=0&widgetX=331&widgetY=4343&tpcs=0&wRV=1050170&pVis=0&lsd=0755d8ae-a130-4fa3-b914-4301a73569be&eIdx=&cheq=2&ab=0&wl=0
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.202.112.31 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Origin
https://www.theregister.co.uk
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 26 Mar 2020 15:45:29 GMT
Access-Control-Allow-Methods
GET,POST
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
X-TraceId
c5faee33e61111bca4dbf8d88e1f4850
Content-Length
4
Expires
0
Cookie set obUserSync.html
widgets.outbrain.com/widgetOBUserSync/ Frame 3FCD 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by
Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1585237528050
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.250.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-250-44.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash

Request headers

Host
widgets.outbrain.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
obuid=0755d8ae-a130-4fa3-b914-4301a73569be
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/

Response headers

Accept-Ranges
bytes
Content-Type
text/html
ETag
"938505833703786e7ccfce1fecf1cd66:1582216491.628225"
Last-Modified
Thu, 20 Feb 2020 16:34:45 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=604800
Date
Thu, 26 Mar 2020 15:45:29 GMT
Content-Length
3518
Connection
keep-alive
Timing-Allow-Origin
*
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET,POST
Access-Control-Allow-Origin
*
Set-Cookie
akacd_widgets_routing=1585237529~rv=49~id=d7550d58f87498b27b56513d38ee6ca0; path=/; Expires=Thu, 26 Mar 2020 15:45:29 GMT; Secure; SameSite=None
activeview
pagead2.googlesyndication.com/pcs/ Frame 6BDE 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuiUf7jDLC4quzr-ELP_h_FBG_BwmAE1fKgUArCpyF6P8AztoTcUqyNPbJxf-Pz-0fs_eWzx4Ur1QCQN3dljOLIe_sfF-WX_R3zanSIQx8&sig=Cg0ArKJSzNWxJp9YUlBGEAE&id=ampim&o=429,129&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=185&tls=1186&g=100&h=100&tt=1186&r=v&adk=284626583&avms=ampa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:30 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame D9CA 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst9BWyoahkdcCmnP_FzuFlrlsgnSDJF0cIhTxRz7n00lucWaH0vjyZ0jd-P6PNzicq4IVyiwZJxduiZZb7auTg9Y1FDeYGOKF9RVs8zIeQ&sig=Cg0ArKJSzEKrNOsMmGr-EAE&adk=2610646818&tt=-1&bs=1585%2C1200&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&p=233,978,563,1278&mcvt=1008&rs=0&ht=0&tfs=119&tls=1127&mc=1&lte=0&bas=0&bac=0&met=ie&avms=nio&exg=1&md=2&btr=0&lm=2&rst=1585237529185&dlt&rpt=192&isd=0&msd=0&ext&xdi=0&ps=1585%2C4701&ss=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-4-11-11-0-0-0&tvt=1124&is=300%2C600&iframe_loc=https%3A%2F%2Fwww.theregister.co.uk%2F2020%2F03%2F04%2Fmicrosoft_subdomain_takeover%2F&r=v&id=osdim&vs=4&uc=12&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200325
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Thu, 26 Mar 2020 15:45:30 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads.js
www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ 		27 B
198 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by
Host: www.theregister.co.uk
URL: https://www.theregister.co.uk/design_picker/9031d9d0c0ab83a2efbb659b23896eb021891f70/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:33 GMT
cf-cache-status
HIT
age
14719533
cf-ray
57a1ffd689a3e610-LHR
status
200
content-length
27
x-clacks-overhead
GNU Terry Pratchett, Lester Haines
last-modified
Thu, 05 Apr 2018 12:48:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=33696000
accept-ranges
bytes
x-reg-bofh
pfy04
expires
Tue, 20 Apr 2021 15:45:33 GMT
ads.js
forms.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ Frame E5FA 		27 B
299 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://forms.theregister.co.uk/design_picker/c00f80f04b0eaf0123d821f6c9488fc1cb55fd0a/javascript/ads.js
Requested by
Host: forms.theregister.co.uk
URL: https://forms.theregister.co.uk/design_picker/8125be5b011a6297a0c2c7ac01c6b66381c35418/javascript/_.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.235.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://forms.theregister.co.uk/studies/internal/state_or_it_dept/?version=emea&td=5335643672&r=675783567
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 26 Mar 2020 15:45:34 GMT
cf-cache-status
HIT
last-modified
Fri, 10 Jan 2020 15:10:58 GMT
server
cloudflare
age
17443
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=33696000
accept-ranges
bytes
cf-ray
57a1ffded9eee610-LHR
content-length
27
expires
Tue, 20 Apr 2021 15:45:34 GMT

Verdicts & Comments Add Verdict or Comment

170 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| RegZoot object| RegCC string| RegPageType string| RegTruePageType object| RegArticle function| sprintf object| RegUtils object| RegCBW string| _RegCBWTest function| RegCBWA function| RegCBWT boolean| is_rows_based_page function| ads_states_tracking boolean| RegAST function| track_abt function| gpt_js_errored function| bird_alternative function| init_gpt function| ad_free function| show_article_signup_ml function| RegTLRotate function| load_media_player function| pivot_shuffle function| pivot_around function| display_social_popup function| regtld function| getElementCss function| setElementCss function| getElementHeight function| moveElement function| account_form_check function| get_epoch function| rolling_time function| time_calc function| get_url_param function| reg_nl_form function| scale_article_inner_elems function| toggle_account_tab_state function| resize_img_url function| send_to_analytics function| NO_DEV_COOKIE function| isScrolledIntoView function| check_rhs_sticky_ads_general_conditions function| rhs_sticky_ad_mu1_spot function| isIE function| spawn_and_load_img_from_div undefined| sticky_ad_RT_2F function| rhs_sticky_ad_btn_spot function| augment_promo_unit function| social_button_share function| sticky_nav_bar function| add_search_terminal function| nav_bar_search function| nav_popup function| article_body_safe_spots_for_ads function| is_article2article function| RegSendGA object| rat_ function| track_bucket_user function| performance_stats function| send_performance_stats number| RegPerformanceStatsPerMille function| setup_forum_votes function| RegSponsorship function| RegSponsorshipChan function| RegParallax function| RegMobParallax function| HideRegBotBanner function| RegBottomBanner function| polling function| polling_setup function| poll_view_results function| render_thanks function| equalize_poll_vote_count_width function| render_poll function| append_view_btns function| poll_view_btn function| render_poll_question function| render_poll_result function| get_poll_votes function| update_poll_votes function| move_poll_question function| submit_poll_votes number| vplayer_count function| slideshow function| slideshow_setup function| load_slide_rail function| load_slide_img function| load_slide_image function| slide_img_v_alignment function| load_slide_video function| slideshow_user_events function| get_slideshow_id function| get_slide_index function| slide_change_request function| change_slide function| change_rail_images function| rail_size function| slideshow_pos function| set_slideshow_video_size function| slide_arrow function| full_youtube_url function| youtube_thumb_img function| $ function| jQuery object| nir object| s object| googletag string| Reg__adct object| ggeac object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| RegWpTl string| RegABTest object| outB string| GoogleAnalyticsObject function| ga object| adm object| sticky_nav object| jQuery111205399269744544921 number| google_srt undefined| google_measure_js_timing string| RegSection object| admCustomData string| sc string| axc number| __google_ad_urls_id number| google_unique_id object| gaGlobal object| google_tag_data object| gaplugins object| gaData object| VKs object| SAs object| VCs object| VVCCs boolean| RegAdBlocking function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| OBR string| OB_releaseVer function| OBR$ object| OB_PROXY object| outbrain object| outbrain_rater object| __ctcg_65349_0_exec object| ampInaboxIframes object| ampInaboxPendingMessages object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| RegAdsRendered object| __AMP_LOG object| __AMP_ERRORS boolean| ampInaboxInitialized object| __AMP_MODE function| __AMP_REPORT_ERROR object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| AMP function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms object| google_image_requests

6 Cookies

Domain/Path Name / Value
.theregister.co.uk/ Name: sc
Value: 1
.theregister.co.uk/ Name: _gat
Value: 1
.theregister.co.uk/ Name: _ga
Value: GA1.3.1954156433.1585237528
.theregister.co.uk/ Name: bucket
Value: 414
.theregister.co.uk/ Name: _gid
Value: GA1.3.553672543.1585237528
.theregister.co.uk/ Name: __cfduid
Value: d0afcb6a9c98cc2330b3df222f58e77d21585237527

3 Console Messages

Source Level URL
Text
console-api info URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
console-api info URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/
console-api info URL: https://cdn.ampproject.org/rtv/012003101714470/amp4ads-v0.js(Line 407)
Message:
Powered by AMP ⚡ HTML – Version 2003101714470 https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.co.uk
adservice.google.com
cdn.ampproject.org
forms.theregister.co.uk
go.theregister.co.uk
log.outbrainimg.com
nir.theregister.co.uk
ob.cheqzone.com
obs.cheqzone.com
odb.outbrain.com
pagead2.googlesyndication.com
pj.l.admedo.com
regmedia.co.uk
securepubads.g.doubleclick.net
stats.g.doubleclick.net
tcheck.outbrainimg.com
tpc.googlesyndication.com
widgets.outbrain.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.theregister.co.uk
104.18.235.86
13.224.194.18
151.101.114.2
172.217.22.2
23.210.250.44
2606:4700::6810:5351
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:806::2002
2a00:1450:4001:806::2004
2a00:1450:4001:81b::2001
2a00:1450:4001:81e::2002
2a00:1450:400c:c07::9c
2a02:6ea0:c710::2
54.172.89.8
64.202.112.31
72.247.226.107
00a90076624308d96229a561974d2d72398e2d48e4a8e9dbdcf178904014aac6
01b11642a8412e8a9818456c26a2f355a437a2b3d87e8fca40d716cd1fec0785
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
11b10fdb2a5de2bc29f16503b2ee10492c9441b12e7d1d0248ff764f62a0206d
120ce55883f26d68e2108231d7f0c6e772e186d2b9e6a4cf72cc6c75bc973e54
19d890a822e276950aee8158df93f74033e713f89f9a4412e00a9c37b41ff561
1bc9eeec7ba19c97ba1d50c10195c3f74302af5e712409e51e5b8d35b6f46eb8
1d12f905bb706cb8acf0335b6a160a16f345f07202ea4130402aea6e26f6c211
1de0aa76d87c52126732d3b462adeab6f77a39ed39295f61c206228858076407
27001ef5418416bd62a72a2c4cd0b2889f88e469ceb63e063cc3e173bc006b9c
2cf5fe2a8bea4ce55ac0a55261b35aa1a5a36c84f94cc936e964581c57a49499
2cf635372dffcbc9a23d1cb895e5f038a4c573e863044b8525e17f011c6dea15
2fec464c8133d8aa0d6cf4f140ae33ac83f5420d56f94cc47e8eb848817783f5
329d84bf3fb7768bd526571fd468b40d411a5049c6c524b995741205d8b8e74b
363edeba1963685d08a885c613f43fd3c94fa0ba6cea87de6036f960c9d38717
38b1d39f58aeca1598f48686d80a1626878e85adc503d1c49224d029a956b022
39d160e97e2bea07b0cf1c647259ffa4f0bd07069dba4e6c19a22d38b408510f
3a7dd47584c51e6769ab8b6e59b58fd837b296c8e0d575d676f721c58eb12bdd
3f52391293222a60783b5bb19beb71b7aef0656996f615126f9e4273f6eb2930
40f8e5fb07c0b433ef6e9a1932d0f84d747458d02c9b1931a5bb9a4c31dc23dd
4486f4e70d7321e8f64da51c38b50767e846bdaf4ef3441d628f27a4f8952c10
458860ce8b256b66b223ed10f813b32a012b91698bd98867374cfb24da8ce172
4db16433a1f26ff7f90e3525190e9debe2ac5545309ab47e5a06133e06f9f128
4e6c82e4f1117b4e2adb58f15170c07257e6203719ed24e4ef6525ed9b346151
4ecf4699152194c23f91bb5d0ab9be888c79f202ddb91b71c72fbe069ad10892
55620583eecd8f9a36a45072edeef72f395acdb8da34d22d9b1f8d599a43c25c
5c8f75937a64cb180571def8a348d77c573b9ec9cc72fe4502860db0d54381ec
615d3776c617108f0603964f782f5f0ef6ee0037a2be5a575066c337302b7e8c
62b658bca472f4eb438c6384ed624f42a08b19472b29f34cedaad0e2a6372ace
65962c8c51214771f2bbadf505adae523cbb6ac4f5a7a9037d771cdbf0d94f89
67d98d5c33034b7a0b5f829b1c833eb2ea440a63a631a37694778ef4af996b33
6b4f41c53446bee5ce03284672b4607e4a6ff941cae00ec006411b05a62fbe7a
7c6500b5aab10820ef921c16a696a612a905098ebdbcc71b056502e86e591093
7eb0bd9a91e03d07ef5c63f6f19a160ba4b2f0d0cbb694f13f681546dec89a59
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83de4b8fb218ece4dc1c59006f00e44aaee17e78923c65ba66acf0ad41a7a5cc
859679bdc7b137976deaab7f1078757e1578ebd4fbab0abe1da639bb84b9d92f
86be52bdb7547413cafb3ed175a806a798c65de98b40849e0b974c47d187de65
90d703cb665884f61fb47d2aea9178ff1094bb228160a602c7e9896953e6f850
9133ed29cfbe32807472b8e62d611e5d68d4b30dab62bd495fe2e9c46457f182
94edbc0ddc240376874a7449e6ba2c0e0429c26777b20d9a6a8a93b43846b824
95f0b8a588ddfbf5b37b38fcb1e50f745648419e25cc7ee2e503efc3ba93c990
96a19aca5f40d0503e2d7ff108531054c2b5bc5f28ae40d5e1859601065c7b1d
9c22e4ff7f866aaaf5ce118ba0b5d5cb9c01fd5283cbd684a0c1523088914b5f
a1a95e37b3c4245aa77b33811f29f6a461905c8a388a40dd55183b72ceda0475
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a63c034cf831b06a3fcb0f1fb46eb33eeb289ceec1c412b3707fe7efd7e729ce
aeb1cb5a1fc9ff73fef24f06eac380b67bbe63862eeb40d92485bb2ab7aee94e
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b7f7d166c762af007c4a4be814c5989b197cfc0e3f1c2198b94a4020da47f15d
bfb005ce46fe9fb257c6149a546d29868258a301bc745363dab6742e49587e42
c10a16cf4d75e02b52aad0f7f1fa8a6acda819768a3d4ea9ed9c0d5e846762ed
c2b0d171a4179bf00898c430c1c15464e528aff5762fc70a5d02184834c82eff
ce30d5aea49ad6115164a99e5638a387c606885ed02bbbdfab77d3ffbe17aff7
d8db699e718814dce4d71b8c7d981df5aed9df3d3b49eb5d8970c3f75c2547ad
da0f3b621d72a405022d2d693d4e357133538d8dd7bda42e710fe6afb6f63a08
e17e03dc3ff1767a8d185975a2bf392068a0b2f2848503c38ceaa3f10fb0ea84
e1a0f94ae5b6f452bde76f436981f11c6a667c4ab2452713a44c56a6114ffaae
e2233f952a2c6ebbd1b9d6328cf8ec965e4502c126b9cb10473afdb0d2dae856
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e889bf6150aeb787b33b725434356ffbd348744af5089a5084a126015370029a
ea8c1cbf9732fae6a42b6261c238014eab34943fac5a34711081a62b7cc2eba9
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f037cac46f9c6390fcb0485eff85213ffb9b5207dd66d227e41ad0c1ebe40e55
f2e60d0a77f1d63a9fd3b21fbb9d21345a61dc43d6c9b749e45753c5d993a6e8
f33bf25e603b71f1bad657b2b4411f98dfb16dd6e426c3891c2dcf5d798ab31c
f677040712955dc4fc8e9f792849a092501ffec68788837915d8ff8ff7b0d1e2
f72263862a57ea2620bb3f68688f9a283ae02af459f55ecc4e266b93e1a45d27