www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Submission: On December 03 via api (December 3rd 2019, 4:03:28 pm UTC) from CZ

Summary HTTP 278 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 68 IPs in 9 countries across 51 domains to perform 278 HTTP transactions. The main IP is 104.20.60.209, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.bleepingcomputer.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on May 12th 2018. Valid for: 2 years.

This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
42	104.20.60.209 104.20.60.209	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7	104.26.13.6 104.26.13.6	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:821::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1	151.101.112.193 151.101.112.193	54113 (FASTLY) (FASTLY - Fastly)
2	2606:4700:20:... 2606:4700:20::681a:8b	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	178.79.175.86 178.79.175.86	63949 (LINODE-AP...) (LINODE-AP Linode)
1	2600:9000:21f... 2600:9000:21f3:a600:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
5	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	2600:9000:215... 2600:9000:2156:6000:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1 4	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE - Google LLC)
2	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE - Google LLC)
3	35.188.71.214 35.188.71.214	15169 (GOOGLE) (GOOGLE - Google LLC)
10	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	143.204.101.16 143.204.101.16	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	35.190.40.172 35.190.40.172	15169 (GOOGLE) (GOOGLE - Google LLC)
10	172.217.22.34 172.217.22.34	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	2a00:1450:400... 2a00:1450:4001:819::200d	15169 (GOOGLE) (GOOGLE - Google LLC)
3 3	63.33.115.128 63.33.115.128	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	147.75.102.200 147.75.102.200	54825 (PACKET) (PACKET - Packet Host)
1	2600:9000:21f... 2600:9000:21f3:ce00:1:af78:4c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	13.225.86.250 13.225.86.250	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	151.101.113.194 151.101.113.194	54113 (FASTLY) (FASTLY - Fastly)
2	143.204.101.62 143.204.101.62	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	13.225.78.52 13.225.78.52	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	52.18.217.230 52.18.217.230	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	3.222.69.96 3.222.69.96	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	35.226.36.58 35.226.36.58	15169 (GOOGLE) (GOOGLE - Google LLC)
1	143.204.101.58 143.204.101.58	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	52.4.163.43 52.4.163.43	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3	35.156.206.192 35.156.206.192	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	185.33.223.202 185.33.223.202	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
3	2a02:fa8:8806... 2a02:fa8:8806:12::1430	41041 (VCLK-EU-) (VCLK-EU-)
13 37	152.199.21.89 152.199.21.89	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
13	3.120.201.254 3.120.201.254	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
9	104.16.68.69 104.16.68.69	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
8	52.214.34.242 52.214.34.242	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
6	2606:4700:10:... 2606:4700:10::6814:9174	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT - The Rubicon Project)
1 9	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE - Google LLC)
3	95.100.197.53 95.100.197.53	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
6	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
11	2a00:1450:400... 2a00:1450:4001:815::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
3	185.29.133.223 185.29.133.223	30419 (MEDIAMATH...) (MEDIAMATH-INC - MediaMath Inc)
1	3.123.66.234 3.123.66.234	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	116.202.48.214 116.202.48.214	24940 (HETZNER-AS) (HETZNER-AS)
1	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	138.201.63.116 138.201.63.116	24940 (HETZNER-AS) (HETZNER-AS)
1	2606:4700::68... 2606:4700::6810:a727	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 4	195.216.249.67 195.216.249.67	47268 (ZANOX) (ZANOX)
1 1	85.10.231.199 85.10.231.199	24940 (HETZNER-AS) (HETZNER-AS)
4	46.236.13.147 46.236.13.147	24931 (DEDIPOWER) (DEDIPOWER)
1	104.90.154.57 104.90.154.57	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2600:9000:21f... 2600:9000:21f3:600:9:352d:a240:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	81.29.72.47 81.29.72.47	24931 (DEDIPOWER) (DEDIPOWER)
4	2a00:1450:400... 2a00:1450:4001:820::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	216.58.205.230 216.58.205.230	15169 (GOOGLE) (GOOGLE - Google LLC)
1	185.29.133.58 185.29.133.58	30419 (MEDIAMATH...) (MEDIAMATH-INC - MediaMath Inc)
6	95.100.196.237 95.100.196.237	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
3	95.100.196.250 95.100.196.250	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
3 3	143.204.101.97 143.204.101.97	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 5	3.121.172.124 3.121.172.124	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a02:fa8:8806... 2a02:fa8:8806:12::1400	41041 (VCLK-EU-) (VCLK-EU-)
1 1	91.228.74.232 91.228.74.232	27281 (QUANTCAST) (QUANTCAST - Quantcast Corporation)
2	52.58.138.174 52.58.138.174	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.49.153.216 52.49.153.216	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
278	68

42 104.20.60.209 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.bleepingcomputer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.26.13.6 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.bleepstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:8b (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

a.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.79.175.86 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: nb-178-79-175-86.london.nodebalancer.linode.com

ecdn.analysis.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:a600:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2156:6000:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

static.quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
staticxx.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.59.101 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.67.47 (Ascension Island)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.188.71.214 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 214.71.188.35.bc.googleusercontent.com

d.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.16 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-16.fra50.r.cloudfront.net

freestar-io.videoplayerhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.40.172 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 172.40.190.35.bc.googleusercontent.com

api.skimlinks.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.217.22.34 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.33.115.128 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-33-115-128.eu-west-1.compute.amazonaws.com

x.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.102.200 (Central, Hong Kong) 2 redirects

ASN54825 (PACKET - Packet Host, Inc., US)

loadeu.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:ce00:1:af78:4c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

vendorlist.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.225.86.250 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-225-86-250.fra2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.113.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

confiant-integrations.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.101.62 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-62.fra50.r.cloudfront.net

ad-delivery.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.52 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-225-78-52.fra2.r.cloudfront.net

api.quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.18.217.230 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-18-217-230.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.222.69.96 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-222-69-96.compute-1.amazonaws.com

cluster-na.cdnjquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.226.36.58 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 58.36.226.35.bc.googleusercontent.com

c.pub.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.58 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-58.fra50.r.cloudfront.net

audit.quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.4.163.43 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-4-163-43.compute-1.amazonaws.com

mantodea.mantisadnetwork.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.156.206.192 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-156-206-192.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.33.223.202 (Netherlands)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:fa8:8806:12::1430 (Sweden)

ASN41041 (VCLK-EU-, SE)

web.hb.ad.cpe.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 152.199.21.89 (United States) 13 redirects

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 3.120.201.254 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com

btlr.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.16.68.69 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.214.34.242 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com

g2.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:10::6814:9174 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

i.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.connectad.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 34.95.120.147 (United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 147.120.95.34.bc.googleusercontent.com

freestar-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ox-delivery-prod-1-europe-west1.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.100.197.53 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-197-53.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:815::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.133.223 (United Kingdom)

ASN30419 (MEDIAMATH-INC - MediaMath Inc, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.123.66.234 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-123-66-234.eu-central-1.compute.amazonaws.com

protected-by.clarium.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 116.202.48.214 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.214.48.202.116.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.233.201 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 138.201.63.116 (Heppenheim an der Bergstrasse, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.116.63.201.138.clients.your-server.de

hal90004.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a727 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.11teamsports.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 195.216.249.67 (France) 2 redirects

ASN47268 (ZANOX, FR)

ad.zanox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.10.231.199 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: 85-10-231-199.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 46.236.13.147 (United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.90.154.57 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-90-154-57.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:600:9:352d:a240:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 81.29.72.47 (United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 81-29-72-47.servers.dedipower.net

diapi.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:820::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

w-it.m-t.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.205.230 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f230.1e100.net

8019191.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.133.58 (United Kingdom)

ASN30419 (MEDIAMATH-INC - MediaMath Inc, US)

mathid.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 95.100.196.237 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-196-237.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 95.100.196.250 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-196-250.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 143.204.101.97 (Seattle, United States) 3 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-97.fra50.r.cloudfront.net

ib.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.121.172.124 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-121-172-124.eu-central-1.compute.amazonaws.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:12::1400 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.232 (United Kingdom) 1 redirects

ASN27281 (QUANTCAST - Quantcast Corporation, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.58.138.174 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-58-138-174.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.153.216 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	bleepingcomputer.com www.bleepingcomputer.com	163 KB
39	advertising.com 13 redirects adserver-us.adtech.advertising.com pixel.advertising.com	15 KB
14	doubleclick.net 1 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net 8019191.fls.doubleclick.net	107 KB
14	skimresources.com 4 redirects s.skimresources.com r.skimresources.com t.skimresources.com p.skimresources.com x.skimresources.com	20 KB
13	sharethrough.com btlr.sharethrough.com	2 KB
12	adnxs.com ib.adnxs.com acdn.adnxs.com	7 KB
11	ampproject.org cdn.ampproject.org	239 KB
11	3lift.com 5 redirects tlx.3lift.com ib.3lift.com eb2.3lift.com	4 KB
9	openx.net 1 redirects freestar-d.openx.net ox-delivery-prod-1-europe-west1.openx.net eu-u.openx.net	8 KB
9	districtm.io dmx.districtm.io cdn.districtm.io	1 KB
8	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	50 KB
8	gumgum.com g2.gumgum.com	4 KB
8	google.com 2 redirects apis.google.com adservice.google.com accounts.google.com www.google.com	101 KB
7	consensu.org quantcast.mgr.consensu.org static.quantcast.mgr.consensu.org api.skimlinks.mgr.consensu.org vendorlist.consensu.org api.quantcast.mgr.consensu.org audit.quantcast.mgr.consensu.org	137 KB
7	pub.network a.pub.network d.pub.network c.pub.network	235 KB
7	bleepstatic.com www.bleepstatic.com	22 KB
6	webgains.com track.webgains.com diapi.webgains.com	32 KB
6	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	9 KB
6	connectad.io i.connectad.io cdn.connectad.io	1 KB
6	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	254 B
6	mantisadnetwork.com mantodea.mantisadnetwork.com	954 B
5	mathtag.com tags.mathtag.com pixel.mathtag.com mathid.mathtag.com	23 KB
5	amazon-adsystem.com c.amazon-adsystem.com	30 KB
4	m-t.io w-it.m-t.io	571 B
4	zanox.com 2 redirects ad.zanox.com	2 KB
4	redintelligence.net 1 redirects hal9000.redintelligence.net hal90004.redintelligence.net	7 KB
4	dotomi.com web.hb.ad.cpe.dotomi.com aol-match.dotomi.com	3 KB
4	googletagservices.com www.googletagservices.com	101 KB
3	casalemedia.com as-sec.casalemedia.com	4 KB
3	facebook.com staticxx.facebook.com www.facebook.com
2	gstatic.com fonts.gstatic.com	22 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	ad-delivery.net ad-delivery.net	1 KB
2	fastly.net confiant-integrations.global.ssl.fastly.net	73 KB
2	exelator.com 2 redirects loadeu.exelator.com	2 KB
2	facebook.net connect.facebook.net	58 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	adsrvr.org match.adsrvr.org	264 B
1	quantserve.com 1 redirects pixel.quantserve.com	685 B
1	webgains.io analytics.webgains.io	13 KB
1	awin1.com www.awin1.com	621 B
1	media01.eu 1 redirects pb.media01.eu	1 KB
1	11teamsports.com www.11teamsports.com
1	googleapis.com fonts.googleapis.com	688 B
1	clarium.io protected-by.clarium.io	345 B
1	cdnjquery.com cluster-na.cdnjquery.com	356 B
1	google.de adservice.google.de	171 B
1	videoplayerhub.com freestar-io.videoplayerhub.com	130 KB
1	analysis.fi ecdn.analysis.fi	1 KB
1	imgur.com i.imgur.com	5 KB
1	googletagmanager.com www.googletagmanager.com	27 KB
278	51

	Domain	Requested by
42	www.bleepingcomputer.com	www.bleepingcomputer.com www.bleepstatic.com
37	adserver-us.adtech.advertising.com	13 redirects a.pub.network
13	btlr.sharethrough.com	a.pub.network
11	cdn.ampproject.org	securepubads.g.doubleclick.net
10	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.bleepingcomputer.com
8	g2.gumgum.com	a.pub.network
7	www.bleepstatic.com	www.bleepingcomputer.com
6	acdn.adnxs.com	a.pub.network
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.bleepingcomputer.com
6	dmx.districtm.io	a.pub.network
6	ib.adnxs.com	a.pub.network
6	mantodea.mantisadnetwork.com	a.pub.network
5	eb2.3lift.com	2 redirects a.pub.network
5	fastlane.rubiconproject.com	a.pub.network
5	c.amazon-adsystem.com	a.pub.network c.amazon-adsystem.com
4	eu-u.openx.net	1 redirects a.pub.network
4	w-it.m-t.io	analytics.webgains.io
4	track.webgains.com	www.bleepingcomputer.com
4	ad.zanox.com	2 redirects www.bleepingcomputer.com
4	www.googletagservices.com	a.pub.network securepubads.g.doubleclick.net
4	p.skimresources.com	www.bleepingcomputer.com
4	r.skimresources.com	1 redirects www.bleepingcomputer.com s.skimresources.com
4	apis.google.com	www.bleepingcomputer.com apis.google.com
3	cdn.connectad.io	a.pub.network
3	ib.3lift.com	3 redirects
3	ads.pubmatic.com	a.pub.network
3	cdn.districtm.io	a.pub.network
3	hal90004.redintelligence.net	1 redirects www.bleepingcomputer.com
3	tags.mathtag.com	www.bleepingcomputer.com
3	as-sec.casalemedia.com	a.pub.network
3	freestar-d.openx.net	a.pub.network
3	i.connectad.io	a.pub.network
3	hbopenbid.pubmatic.com	a.pub.network
3	web.hb.ad.cpe.dotomi.com	a.pub.network
3	tlx.3lift.com	a.pub.network
3	x.skimresources.com	3 redirects
3	d.pub.network	a.pub.network
2	pixel.advertising.com
2	8019191.fls.doubleclick.net	1 redirects www.bleepingcomputer.com
2	diapi.webgains.com	track.webgains.com
2	pagead2.googlesyndication.com
2	fonts.gstatic.com	www.bleepingcomputer.com
2	ox-delivery-prod-1-europe-west1.openx.net	www.bleepingcomputer.com
2	googleads.g.doubleclick.net	www.bleepingcomputer.com
2	www.google.com	2 redirects
2	c.pub.network	a.pub.network
2	sync.crwdcntrl.net	2 redirects
2	ad-delivery.net	freestar-io.videoplayerhub.com
2	confiant-integrations.global.ssl.fastly.net	a.pub.network confiant-integrations.global.ssl.fastly.net
2	loadeu.exelator.com	2 redirects
2	www.facebook.com	connect.facebook.net
2	t.skimresources.com	www.bleepingcomputer.com s.skimresources.com
2	connect.facebook.net	www.bleepingcomputer.com connect.facebook.net
2	static.quantcast.mgr.consensu.org	quantcast.mgr.consensu.org
2	www.google-analytics.com	www.googletagmanager.com www.bleepingcomputer.com
2	a.pub.network	www.bleepingcomputer.com a.pub.network
1	match.adsrvr.org
1	pixel.quantserve.com	1 redirects
1	aol-match.dotomi.com
1	eus.rubiconproject.com	a.pub.network
1	mathid.mathtag.com	www.bleepingcomputer.com
1	analytics.webgains.io	track.webgains.com
1	www.awin1.com	www.bleepingcomputer.com
1	pb.media01.eu	1 redirects
1	www.11teamsports.com	www.bleepingcomputer.com
1	fonts.googleapis.com	securepubads.g.doubleclick.net
1	pixel.mathtag.com	www.bleepingcomputer.com
1	hal9000.redintelligence.net	www.bleepingcomputer.com
1	protected-by.clarium.io	www.bleepingcomputer.com
1	audit.quantcast.mgr.consensu.org	static.quantcast.mgr.consensu.org
1	cluster-na.cdnjquery.com	freestar-io.videoplayerhub.com
1	api.quantcast.mgr.consensu.org	quantcast.mgr.consensu.org
1	vendorlist.consensu.org	quantcast.mgr.consensu.org
1	accounts.google.com	apis.google.com
1	staticxx.facebook.com	connect.facebook.net
1	adservice.google.com	www.googletagservices.com
1	adservice.google.de	www.googletagservices.com
1	api.skimlinks.mgr.consensu.org	s.skimresources.com
1	freestar-io.videoplayerhub.com	a.pub.network
1	s.skimresources.com	www.bleepingcomputer.com
1	quantcast.mgr.consensu.org	www.bleepstatic.com
1	ecdn.analysis.fi	www.bleepingcomputer.com
1	i.imgur.com	www.bleepingcomputer.com
1	www.googletagmanager.com	www.bleepingcomputer.com
278	84

This site contains links to these domains. Also see Links.

Domain
bcgo.to
uniteagainstmalware.com
downloads.malwareremoval.com
www.java.com
www.invisionpower.com

Subject Issuer	Validity	Valid
bleepingcomputer.com COMODO RSA Domain Validation Secure Server CA	`2018-05-12` - `2020-05-17`	2 years	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-11` - `2020-10-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-02-12`	a year	crt.sh
*.analysis.fi Sectigo RSA Domain Validation Secure Server CA	`2019-06-13` - `2020-06-12`	a year	crt.sh
quantcast.mgr.consensu.org Amazon	`2019-05-06` - `2020-06-06`	a year	crt.sh
*.apis.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2018-09-13` - `2020-10-07`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-11-06` - `2020-02-04`	3 months	crt.sh
*.pub.network Go Daddy Secure Certificate Authority - G2	`2019-02-09` - `2020-05-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.videoplayerhub.com Amazon	`2019-07-18` - `2020-08-18`	a year	crt.sh
api.skimlinks.mgr.consensu.org DigiCert SHA2 Secure Server CA	`2019-10-04` - `2021-10-07`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
accounts.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
vendorlist.consensu.org Amazon	`2019-03-06` - `2020-04-06`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2019-10-07` - `2020-09-29`	a year	crt.sh
*.freetls.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-01-02` - `2020-01-03`	a year	crt.sh
ad-delivery.net Amazon	`2019-03-07` - `2020-04-07`	a year	crt.sh
*.assetbucket.net Amazon	`2019-09-11` - `2020-10-11`	a year	crt.sh
*.mantisadnetwork.com Amazon	`2019-04-21` - `2020-05-21`	a year	crt.sh
*.3lift.com Amazon	`2019-07-17` - `2020-08-17`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 High Assurance Server CA	`2018-05-22` - `2020-05-26`	2 years	crt.sh
*.sharethrough.com Amazon	`2019-10-07` - `2020-11-07`	a year	crt.sh
districtm.io CloudFlare Inc ECC CA-2	`2019-03-26` - `2020-03-26`	a year	crt.sh
*.gumgum.com Amazon	`2019-07-31` - `2020-08-31`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
connectad.io CloudFlare Inc ECC CA-2	`2019-07-18` - `2020-07-17`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2019-07-17` - `2020-03-09`	8 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2018-01-26` - `2020-04-16`	2 years	crt.sh
protected-by.clarium.io Gandi Standard SSL CA 2	`2018-04-26` - `2020-04-26`	2 years	crt.sh
*.redintelligence.net Go Daddy Secure Certificate Authority - G2	`2019-03-22` - `2020-03-22`	a year	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2019-01-25` - `2020-04-25`	a year	crt.sh
*.googleapis.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
11teamsports.com CloudFlare Inc ECC CA-2	`2019-02-11` - `2020-02-11`	a year	crt.sh
ad.zanox.com Thawte RSA CA 2018	`2019-06-17` - `2021-07-16`	2 years	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2019-05-20` - `2021-06-08`	2 years	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2019-03-22` - `2020-06-20`	a year	crt.sh
*.webgains.io Amazon	`2019-05-08` - `2020-06-08`	a year	crt.sh
w-it.m-t.io Let's Encrypt Authority X3	`2019-10-15` - `2020-01-13`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2019-04-23` - `2020-02-19`	10 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2017-06-14` - `2020-06-18`	3 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 40 frames:

Primary Page: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Frame ID: 700D62A5CE37A8037B00C4793B1524D7
Requests: 191 HTTP requests in this frame

Frame: https://static.quantcast.mgr.consensu.org/v27/cmp-3pc-check.html
Frame ID: D8FB365B6393544A82E1363C4A15A6D6
Requests: 1 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.941063776967985
Frame ID: 1ABB7E18888F7652BD62E695156929C6
Requests: 3 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.2O_3XQTFIPY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw%2Fm%3D__features__
Frame ID: 48CD87A5EFB442FAFD48FD18EAB220A6
Requests: 1 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Frame ID: DF2F0435E8866B2155AEF340EA9E5872
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.2O_3XQTFIPY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw%2Fm%3D__features__
Frame ID: F383FBC565E39CE0FB58E6C815073C49
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df242bc438bd13c%26domain%3Dwww.bleepingcomputer.com%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff1df0e855d1feac%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
Frame ID: 6D18B0FF7F4AF7D8217E155699ED7498
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js
Frame ID: 7CB53D0D99C1FBB191D7522C43484EA9
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuW0KsAbrXANnp5JF66sAH1pbuKK5eopkHCnlWjFRiqgFVVdn6jXgeP1ETWBY1-380CgMcs0RYe_DQzT2_A3dYLxza6zp6sJ7DFKoXRLfw42iNoIxa-BDJLohx1DyPfvrYBdergB_26OmwGOdSX6v57zSgLeXeZXBTlusxZ9fylEWzOexiRsFfu8cJpMYHGU8xbUzJCz-DTsSgLB13vRgFqpjuJ4-8HK2g0K0ngJBfy5LBlDMk5mEatEZvkjW6i8O0YOTqKi8LCeuROBfd5lVHuAeDbcl0Maake-fKfTwQX8LZJ&sai=AMfl-YQ24NWbUd5tBNhg9x-bkyRcSDmjQLHH3cCKRnvUJGNc2XG3Aa6QReKysOmMKgNg6PkiHsckYQgdH_yAbgylVeog3-Bvts18kZk38_vdmw&sig=Cg0ArKJSzPFwZj_WfJygEAE&urlfix=1&adurl=
Frame ID: 81286468166BAFF8E111D7D88F08A94C
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuDCHbW04qS6duCklOU2LzY-SaCkJ7BEXTh4OOGUEuGVoyPo-W1n2Am63sX6Dccycjd2UMOayOVGFi7Ukbvt1F5Lrx_uBaN_QpsZppTcZvIETorhBtxlCeRCcdt3p0i36XfFwjPhixFoaUpwo9n-ZPhOtiuHaIA1SRsWNxVbihFoLKxJ4vKJhtZDdgX8-O1hzRPHrsw1HrSH6vGNoowIEz0s-57vQ6kdsu4rebwPCy1ZDyGHc4rPXAgl2vsyDPS6_wY1ho1o3WbjAnrWbvVfJtAal7T0niNVfgiYRHWer2B8Z2-RrFKyjmOqm4oVqfI5-20wR3BIGU&sai=AMfl-YQYGC4c9y3_bGM9jlxVz6ylL9UETv-UC2IcytK5rduXrlHFTUvq5QVMREGvXJqHC8i5DRj42_AXBrtezBGyrMzUXS_6-jiFrDaCmmV9&sig=Cg0ArKJSzMJJprVmEoINEAE&urlfix=1&adurl=
Frame ID: 339F13E1D0666178A0A818D6998CA2B6
Requests: 25 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js
Frame ID: 8C2866B57D16D34A1B3357A97AB9AA80
Requests: 14 HTTP requests in this frame

Frame: https://www.11teamsports.com/de-de/htlp-webgains
Frame ID: F5AED040EC2BDBB97AB68FAEB9D2832A
Requests: 1 HTTP requests in this frame

Frame: https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dyn_id=
Frame ID: 7186272937E78538168E6AF05FE715EF
Requests: 1 HTTP requests in this frame

Frame: https://8019191.fls.doubleclick.net/activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498
Frame ID: E1D0040FBD9C4D78EF7A9A7109F8EBD2
Requests: 1 HTTP requests in this frame

Frame: https://hal90004.redintelligence.net/request_content.php?s=37413000118387000951579011066004&a=9d237f83
Frame ID: 521FD5F3CB161FA03350156ADB44C655
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: CD0C5E2F3B7E69B25A394AE17B6FA811
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 5971E03787978628419303803FEF4B1D
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: 38B8CF6EF52E2C1B2E2E593873CCE2E3
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: DB5DD118B7CBAD4C7BA5943F000D3A9D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 87A199F50EF25A0434ACAA5C5ADC52FD
Requests: 1 HTTP requests in this frame

Frame: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=-60&buster=1575388987878&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
Frame ID: 96FCDC41827F7FA08B1F83E07A4B78A8
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 11B8C1AD8D7C35E09F5FB6A9BEED10B1
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 520AD8077618146F96FC3ABEFD4E2686
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: FCCDBA6A9316A336043700439154E6BB
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php
Frame ID: BDC476795450B8B39B57B5026612C36E
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 4E68FCD8AC7B2288D0657183582C5E63
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: AA0D51412703E96DC0806BDED7E1DA47
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: 11F08584BCA219B67115AF7C16E87B37
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 717ECA55600EE15C7388604B1200B1F3
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 9B5A51F1F985F4F2A1FF45F6D7780ED3
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: FF1766A2363554EC6660CFF6CD5F5E89
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 4630BFC5E5AD123AAA0BFE05166E1E7B
Requests: 1 HTTP requests in this frame

Frame: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=-60&buster=1575388987755&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
Frame ID: A3406FBB5138D51E647354CF304E65DC
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php
Frame ID: 9D56A13143C60954BA50D34F4372C13A
Requests: 1 HTTP requests in this frame

Frame: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=-60&buster=1575388987512&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
Frame ID: D7FE2E17255F730D0B7AEF13575B1800
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 5E48882F0D11B7818BC4B102BBB56EA4
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Frame ID: E7F5BB36544220732FCE8D7D79E06CD7
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php
Frame ID: FADD1236B8DA1063562DE3E6E4F7B9AF
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 19912522905D4B97C5E5CB7660C09830
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: F1463CD5E8E225736847A7E266A78B36
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

278
Requests

99 %
HTTPS

30 %
IPv6

51
Domains

84
Subdomains

68
IPs

9
Countries

1668 kB
Transfer

4903 kB
Size

11
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://bcgo.to/5cWiq
Title: Cyber Monday Deals

Search URL Search Domain Scan URL

URL: https://uniteagainstmalware.com/

Search URL Search Domain Scan URL

URL: http://downloads.malwareremoval.com/CKScanner.exe
Title: CKScanner

Search URL Search Domain Scan URL

URL: https://www.java.com/en/download/faq/screenshot.xml
Title: Take a screenshot

Search URL Search Domain Scan URL

URL: http://www.invisionpower.com/apps/board/
Title: Community Forum Software by IP.Board

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://r.skimresources.com/api/ HTTP 307
https://r.skimresources.com/api/?xguid=01DV680E5PM0P9ZC5STKE1G9SA&persistence=1&checksum=a0267d76e6c770a49756299b061b3a14e4f789d473836bcad6145b96dd20072c

Request Chain 82

https://x.skimresources.com/?provider=exelate HTTP 302
https://loadeu.exelator.com/load/?p=787&g=001&j=0& HTTP 302
https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1 HTTP 302
https://x.skimresources.com/?provider=exelate&skim_mapping=true&provider_id=2fe82b1df1472f46f9cbcba0f13df999 HTTP 302
https://p.skimresources.com/?provider_id=2fe82b1df1472f46f9cbcba0f13df999&skim_mapping=true

Request Chain 94

https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=2c431d699868bb6104dc0b98f9f67e47 HTTP 302
https://p.skimresources.com/?provider_id=2c431d699868bb6104dc0b98f9f67e47&skim_mapping=true

Request Chain 104

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191

Request Chain 105

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191

Request Chain 106

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191

Request Chain 107

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191

Request Chain 108

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191

Request Chain 109

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191

Request Chain 110

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191

Request Chain 136

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191

Request Chain 137

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191

Request Chain 138

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191

Request Chain 139

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191

Request Chain 140

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191

Request Chain 141

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191

Request Chain 186

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 224

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 229

https://hal90004.redintelligence.net/request.php?zone=hjrt81ypcuia&nw=20&renderingType=javascript&namespace=9fea2c57c4&subid=&uid=6ccdbb4c0b3fbe07&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D5759699375381630011%26mt_id%3D6622693%26mt_adid%3D216536%26mt_sid%3D4562395%26mt_exid%3D5%26mt_inapp%3D0%26mt_uuid%3D10155de6-873c-4801-b8d0-7559696824f4%26mt_3pck%3Dhttps%253A%2F%2Ffreestar-d.openx.net%2Fw%2F1.0%2Frc%253Fai%253D624ed02f-0feb-43e6-becf-201a57adbf98%2526ts%253D2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA%2526r%253D%26redirect%3D&documentReferer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ancestorOrigins=https%3A%2F%2Fwww.bleepingcomputer.com&random=6536043684635&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90004.redintelligence.net/request.php?zone=hjrt81ypcuia&nw=20&renderingType=javascript&namespace=9fea2c57c4&subid=&uid=6ccdbb4c0b3fbe07&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D5759699375381630011%26mt_id%3D6622693%26mt_adid%3D216536%26mt_sid%3D4562395%26mt_exid%3D5%26mt_inapp%3D0%26mt_uuid%3D10155de6-873c-4801-b8d0-7559696824f4%26mt_3pck%3Dhttps%253A%2F%2Ffreestar-d.openx.net%2Fw%2F1.0%2Frc%253Fai%253D624ed02f-0feb-43e6-becf-201a57adbf98%2526ts%253D2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA%2526r%253D%26redirect%3D&documentReferer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ancestorOrigins=https%3A%2F%2Fwww.bleepingcomputer.com&random=6536043684635&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 231

https://ad.zanox.com/tpv/?45475836C666538628T&zpar0=37413000118387000951579011066004 HTTP 302
https://pb.media01.eu/view.aspx?trackid=91C09AA007C123F60FDC6F5FD61F1F1B&dt_subid1=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dt_subid2=&actionid=879111&produktid=postbankratenkredit&dt_url=https%3A%2F%2Fad.zanox.com%2Fppv%2Fimages%2Fonepixel.gif%3Ffoo%3D45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049 HTTP 301
https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dyn_id=

Request Chain 234

https://ad.zanox.com/ppv/?45475836C666538628&zpar0=37413000118387000951579011066004 HTTP 302
https://ad.zanox.com/ppv/images/onepixel.gif

Request Chain 245

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498 HTTP 302
https://8019191.fls.doubleclick.net/activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498

Request Chain 253

https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1 HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

Request Chain 259

https://ib.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 264

https://ib.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 266

https://ib.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync

Request Chain 277

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&gdpr_consent=&uid=AmNqgA8wO4caY2uAATcig1YybYMaY26FATJOCqn7

278 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/ 219 KB
42 KB 937ms
905ms Document
text/html 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab17af378249d41781b324d20910899b1cff1e35532022c402e4770045602f20

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: www.bleepingcomputer.com
:scheme: https
:path: /forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:05 GMT
content-type: text/html;charset=ISO-8859-1
set-cookie: __cfduid=dc9a615ba4ebabd91ba6fa137add70b991575388984; expires=Thu, 02-Jan-20 16:03:04 GMT; path=/; domain=.bleepingcomputer.com; HttpOnly; Secure session_id=2c59ec601c392f6906ea394fda4a943f; path=/; domain=.bleepingcomputer.com; httponly;Secure modpids=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.bleepingcomputer.com;Secure
content-security-policy: upgrade-insecure-requests;
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate, max-age=0
expires: Mon, 02 Dec 2019 16:03:05 GMT
pragma: no-cache
vary: Accept-Encoding,User-Agent
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 53f6c4c03c8e6407-FRA
content-encoding: br

GET
H2 200 prettify.css
www.bleepingcomputer.com/forums/public/style_css/ 1 KB
572 B 18ms
18ms Stylesheet
text/css 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/style_css/prettify.css?ipbv=52a7720cc96dbdac084fb6fe2caf92b9

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 711
cf-polished: origSize=2207
status: 200
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
etag: W/"89f-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c5ea406407-FRA
cf-bgj: minify

GET
H2 200 prototype.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/ 134 KB
33 KB 27ms
26ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/prototype.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 6109
cf-polished: origSize=180829
status: 200
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
etag: W/"2c25d-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c5fa4c6407-FRA
cf-bgj: minify

GET
H2 200 ipb.js Show response
www.bleepingcomputer.com/forums/public/js/ 81 KB
19 KB 30ms
29ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=52a7720cc96dbdac084fb6fe2caf92b9&load=quickpm,hovercard,sharelinks,topic,like

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8604a0b3eecb1e513a14cae8b2c2ef56119dd310818cdfbc173cee5e8d685533

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 711
cf-polished: origSize=128615
status: 200
last-modified: Tue, 29 Dec 2015 18:41:33 GMT
server: cloudflare
etag: W/"1f667-5280dc546f140-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c5fa4f6407-FRA
cf-bgj: minify

GET
H2 200 scriptaculous-cache.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/ 55 KB
13 KB 21ms
20ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/scriptaculous/scriptaculous-cache.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

61e225f0d67c03cc5a2cdfa2f63e971048d0201711c3cda27c4d4ea0f9f65176

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 3406
cf-polished: origSize=79618
status: 200
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
etag: W/"13702-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c5fa506407-FRA
cf-bgj: minify

GET
H2 200 ipb.lang.js Show response
www.bleepingcomputer.com/forums/cache/lang_cache/1/ 28 KB
7 KB 19ms
18ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/cache/lang_cache/1/ipb.lang.js?nck=4b93cd7f1f76df9c2c1783aae5cc39b1

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebbdc09f56e8b9cba9117f0d84b4903fdc89508496a9b5d5b8d6bf59ff13ebbf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 3406
cf-polished: origSize=30126
status: 200
last-modified: Fri, 25 Oct 2019 14:30:02 GMT
server: cloudflare
etag: W/"75ae-595bcfc4bde67-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c5fa516407-FRA
cf-bgj: minify

GET
H2 200 qc-consent.js Show response
www.bleepstatic.com/js/qc-consent/ 3 KB
2 KB 74ms
23ms Script
text/javascript 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
cf-cache-status: HIT
age: 2215136
cf-polished: origSize=3848
status: 200
cf-bgj: minify
last-modified: Thu, 07 Feb 2019 13:49:44 GMT
server: cloudflare
etag: W/"3981350888"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 53f6c4c65e2e7cb8-MUC
expires: Fri, 13 Dec 2019 00:44:09 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 73 KB
27 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:821::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-91740-1

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4cae697d304b6cae1bb457589d549ec39239ca1d1e32bd7201200cb7562eeb32

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
last-modified: Tue, 03 Dec 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 27662
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:05 GMT

GET
H2 200 twitter.png
www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/ 545 B
765 B 20ms
20ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/loginmethods/twitter.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

92597d72536ce2725db3f04c7ad34252f8d4037ae0a61cdec08f93a0c2db05f2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 979805
cf-polished: origSize=575, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 545
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "23f-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c61a756407-FRA
expires: Sun, 22 Dec 2019 07:53:00 GMT

GET
H2 200 forum-logo.png
www.bleepstatic.com/logo/ 5 KB
5 KB 20ms
20ms Image
image/webp 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/logo/forum-logo.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 311b90855c9f23f4f7531137aa339d941b81af0409120d0281a535f0d2920d49

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
cf-cache-status: HIT
age: 662895
cf-polished: origFmt=png, origSize=9361
status: 200
content-disposition: inline; filename="forum-logo.webp"
cf-bgj: imgq:85
content-length: 4670
last-modified: Fri, 26 Nov 2010 18:53:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 53f6c4c65e317cb8-MUC
expires: Wed, 25 Dec 2019 23:54:50 GMT

GET
H2 200 useropts_arrow.png
www.bleepingcomputer.com/forums/public/style_images/master/ 94 B
245 B 31ms
30ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/useropts_arrow.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

114af008615fbe18f9cc0dfd36ebafd202e12eda91137d48d8a2cab529274d9f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 462700
cf-polished: pngoptimizer, origSize=129, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 94
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "81-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ad76407-FRA
expires: Sat, 28 Dec 2019 07:31:25 GMT

GET
H2 200 default_large.png
www.bleepingcomputer.com/forums/public/style_images/master/profile/ 2 KB
3 KB 23ms
23ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/profile/default_large.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

48100a7efdd07d27ede8e151c39cad2a2b55853d038c25fc2a846316ea0184ef

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 462697
cf-polished: pngoptimizer, origSize=2589, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 2503
last-modified: Wed, 09 Mar 2011 20:59:50 GMT
server: cloudflare
etag: "a1d-49e13027a9d80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ad96407-FRA
expires: Sat, 28 Dec 2019 07:31:28 GMT

GET
H2 200 lock.png
www.bleepingcomputer.com/forums/public/style_images/master/ 702 B
957 B 21ms
19ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/lock.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6f78e58af9ada6448ab228377b29b65486267ec81f6e2cb68e3f3e0113ebe53

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 374907
cf-polished: origSize=729, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 702
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "2d9-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67add6407-FRA
expires: Sun, 29 Dec 2019 07:54:37 GMT

GET
H2 200 icon_share.png
www.bleepingcomputer.com/forums/public/style_images/master/ 169 B
346 B 17ms
15ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/icon_share.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b5a35aa59af15012b03c44769087fb85282ed12e3c417030d78f95f61697b53

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 370003
cf-polished: pngoptimizer, origSize=1201, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 169
last-modified: Fri, 12 Oct 2012 09:31:38 GMT
server: cloudflare
etag: "4b1-4cbd95ac45280"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ae16407-FRA
expires: Sun, 29 Dec 2019 09:16:22 GMT

GET
H2 200 post_top.png
www.bleepstatic.com/skin_images/bc/ 369 B
520 B 20ms
18ms Image
image/png 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/skin_images/bc/post_top.png
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f05e5537bc91bd6026cd2ee7a4ce48d5141ba791f68f1ce1264283c8af6c3aeb

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
cf-cache-status: HIT
age: 2215135
cf-polished: origSize=3076, status=webp_bigger
status: 200
cf-bgj: imgq:85
content-length: 369
last-modified: Wed, 09 Jun 2010 03:08:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 53f6c4c68e617cb8-MUC
expires: Sun, 08 Dec 2019 00:44:10 GMT

GET
H2 200 bot.jpg
www.bleepstatic.com/images/site/forum/bots/ 880 B
1020 B 20ms
18ms Image
image/webp 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bleepstatic.com/images/site/forum/bots/bot.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 967e2ca4f6acdd30fe8199d905a42f91e578494c5ae014f79d8cae4423219edc

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
cf-cache-status: HIT
age: 2215135
cf-polished: qual=85, origFmt=jpeg, origSize=1566
status: 200
content-disposition: inline; filename="bot.webp"
cf-bgj: imgq:85
content-length: 880
last-modified: Tue, 20 Oct 2009 04:08:57 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 53f6c4c68e637cb8-MUC
expires: Sun, 08 Dec 2019 00:44:10 GMT

GET
H2 200 photo-thumb-1032077.jpg
www.bleepingcomputer.com/forums/uploads/profile/ 8 KB
8 KB 20ms
19ms Image
image/jpeg 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/uploads/profile/photo-thumb-1032077.jpg?_r=1568217375

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f38498d47b2022447140b188857a2dc8328971e2ce8d9fe787e8a48eeae876c3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 285685
cf-polished: origSize=8749, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 8118
last-modified: Wed, 11 Sep 2019 15:56:30 GMT
server: cloudflare
etag: "222d-59249108472ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ae26407-FRA
expires: Mon, 30 Dec 2019 08:41:40 GMT

GET
H2 200 bwJ9zDr.jpg
i.imgur.com/ 5 KB
5 KB 24ms
7ms Image
image/jpeg 151.101.112.193
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.imgur.com/bwJ9zDr.jpg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: cat factory 1.0 /
Resource Hash: e8a150c26c7dc70fc345e71df6ddedd7560d21c23004732735d60b0aad93341d

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
age: 4531626
x-cache: HIT, HIT
status: 200
content-length: 5036
x-served-by: cache-bwi5150-BWI, cache-hhn4071-HHN
last-modified: Fri, 18 Jan 2019 20:55:22 GMT
server: cat factory 1.0
x-timer: S1575388985.368916,VS0,VE0
etag: "6fe4e1eb29a3257ee40a210ae34f74b8"
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 2

GET
H2 200 txt.gif
www.bleepingcomputer.com/forums/public/style_extra/mime_types/ 203 B
409 B 19ms
18ms Image
image/gif 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/mime_types/txt.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

59e6b6895ab9c1fab302d73906ec3259ac826ffc4a3ae743412bf8a096a33054

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 2518991
cf-polished: status=not_needed
status: 200
cf-bgj: imgq:100
content-length: 203
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "cb-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ae56407-FRA
expires: Wed, 04 Dec 2019 12:19:54 GMT

GET
H2 200 thumbup2.gif
www.bleepingcomputer.com/forums/public/style_emoticons/default/ 486 B
622 B 28ms
26ms Image
image/gif 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_emoticons/default/thumbup2.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

50ec0dfe51bd77eee427ce38cc90ef3564afea1a2e1148dc788c2d89b7fa4fb9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 1850071
cf-polished: status=not_needed
status: 200
cf-bgj: imgq:100
content-length: 486
last-modified: Sun, 07 May 2006 20:38:57 GMT
server: cloudflare
etag: "1e6-41338be33ba40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ae66407-FRA
expires: Thu, 12 Dec 2019 06:08:34 GMT

GET
H2 200 ips.quickpm.js Show response
www.bleepingcomputer.com/forums/public/js/ 5 KB
2 KB 23ms
23ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.quickpm.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=52a7720cc96dbdac084fb6fe2caf92b9&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 2862
cf-polished: origSize=7306
status: 200
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
etag: W/"1c8a-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c64aa46407-FRA
cf-bgj: minify

GET
H2 200 ips.hovercard.js Show response
www.bleepingcomputer.com/forums/public/js/ 7 KB
2 KB 26ms
26ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.hovercard.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=52a7720cc96dbdac084fb6fe2caf92b9&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 2862
cf-polished: origSize=12576
status: 200
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
etag: W/"3120-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c64aa56407-FRA
cf-bgj: minify

GET
H2 200 ips.sharelinks.js Show response
www.bleepingcomputer.com/forums/public/js/ 4 KB
1 KB 29ms
28ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.sharelinks.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=52a7720cc96dbdac084fb6fe2caf92b9&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 2830
cf-polished: origSize=5869
status: 200
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
etag: W/"16ed-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c64aa76407-FRA
cf-bgj: minify

GET
H2 200 ips.topic.js Show response
www.bleepingcomputer.com/forums/public/js/ 28 KB
6 KB 23ms
22ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.topic.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=52a7720cc96dbdac084fb6fe2caf92b9&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 269
cf-polished: origSize=45653
status: 200
last-modified: Tue, 29 Dec 2015 18:39:43 GMT
server: cloudflare
etag: W/"b255-5280dbeb879c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c64aa86407-FRA
cf-bgj: minify

GET
H2 200 ips.like.js Show response
www.bleepingcomputer.com/forums/public/js/ 4 KB
1022 B 20ms
20ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/ips.like.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/public/js/ipb.js?ipbv=52a7720cc96dbdac084fb6fe2caf92b9&load=quickpm,hovercard,sharelinks,topic,like

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 6317
cf-polished: origSize=6287
status: 200
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
etag: W/"188f-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c64aa96407-FRA
cf-bgj: minify

GET
H2 200 pubfig.min.js Show response
a.pub.network/bleepingcomputer-com/ 438 KB
116 KB 90ms
46ms Script
application/javascript 2606:4700:20::681a:8b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 799fa39e1b22d0b8e9ac024b276783eb036519a543798dbcdea8f0e61ff4b9fc

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
cf-cache-status: HIT
age: 17
status: 200
x-guploader-uploadid: AEnB2UqkpY-SdYr1Z5XXVDcIb8LF3uzBJ1YNgbU8sSfUskIOvQEt5iYVdWJNnGUjUc1jhcB4swAC3uZd7zhalYOhTC8Fs4VkrQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
last-modified: Mon, 25 Nov 2019 22:03:44 GMT
server: cloudflare
etag: W/"2e867f0aa51aed653faad16e9a32ca95"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ErDy+w==, md5=LoZ/CqUa7WU/qtFumjLKlQ==
content-type: application/javascript
x-goog-generation: 1574719424644840
cache-control: public, max-age=1800
x-goog-stored-content-length: 448459
cf-ray: 53f6c4c6cc2d597c-VIE
expires: Tue, 03 Dec 2019 16:03:48 GMT

GET
H/1.1 200
OK fab.js Show response
ecdn.analysis.fi/static/js/ 2 KB
1 KB 75ms
19ms Script
application/javascript 178.79.175.86
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://ecdn.analysis.fi/static/js/fab.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.79.175.86 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: nb-178-79-175-86.london.nodebalancer.linode.com
Software: nginx/1.12.2 /
Resource Hash: 489b6703852c290f6b4d10eed79f17d378682f423e427c4e709fcf5aa16bc78e

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Jul 2015 00:00:00 GMT
Server: nginx/1.12.2
ETag: "55a5a280-404"
Content-Type: application/javascript
Cache-Control: max-age=3600
Connection: close
Content-Length: 1028
Expires: Tue, 03 Dec 2019 17:03:27 GMT

GET
H2 200 ipb_print.css
www.bleepingcomputer.com/forums/public/style_css/css_7/ 3 KB
1 KB 23ms
22ms Stylesheet
text/css 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/style_css/css_7/ipb_print.css

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 6333
cf-polished: origSize=2715
status: 200
last-modified: Fri, 22 Dec 2017 15:03:37 GMT
server: cloudflare
etag: W/"a9b-560ef1efe8440-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c67ae76407-FRA
cf-bgj: minify

GET
H2 200 cmp.js Show response
quantcast.mgr.consensu.org/ 213 KB
58 KB 26ms
10ms Script
text/javascript 2600:9000:21f3:a600:9:46dc:4700:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/cmp.js
Requested by: Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:a600:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ff1e65d5292ac70fa0ceaf87d04313c975d6299e212e0274d3d0362b218ccab8

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 15:53:22 GMT
content-encoding: gzip
last-modified: Mon, 25 Nov 2019 17:24:00 GMT
server: AmazonS3
age: 972
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
status: 200
x-amz-meta-qc-ineu: True
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: PlZt_H-3tYJO8NFUOosXuSQDOGouF4N57REPFMvVN-qmHoX9SPLdEA==
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)

GET
H2 200 user_navigation.png
www.bleepingcomputer.com/forums/public/style_images/master/ 191 B
380 B 14ms
14ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/user_navigation.png

Requested by

Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab1a12c0da652f8e525d21b28ca7c45b5ea34e787b561120cd8564089faf2a96

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 979804
cf-polished: pngoptimizer, origSize=282, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 191
last-modified: Tue, 01 Mar 2011 13:54:08 GMT
server: cloudflare
etag: "11a-49d6c2153a000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67ae86407-FRA
expires: Sun, 22 Dec 2019 07:53:01 GMT

GET
H2 200 advanced_search.png
www.bleepingcomputer.com/forums/public/style_images/master/ 272 B
504 B 13ms
13ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/advanced_search.png

Requested by

Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a55c6652514d6e2ebc88198444ac6b199e6ad119d0d009eea0a52e87cd7b39df

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 961382
cf-polished: pngoptimizer, origSize=293, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 272
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "125-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67aea6407-FRA
expires: Sun, 22 Dec 2019 13:00:03 GMT

GET
H2 200 search_icon.png
www.bleepingcomputer.com/forums/public/style_images/master/ 202 B
433 B 19ms
18ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/search_icon.png

Requested by

Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 2160110
cf-polished: pngoptimizer, origSize=223, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 202
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "df-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67aeb6407-FRA
expires: Sun, 08 Dec 2019 16:01:15 GMT

GET
H2 200 icon_quicknav.png
www.bleepingcomputer.com/forums/public/style_images/master/ 374 B
551 B 15ms
15ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/icon_quicknav.png

Requested by

Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/js/qc-consent/qc-consent.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef879b83b39fe97ac9e83cc9329bf03ec9199fe7433b1ae62d311ef1dac86cbc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 2284606
cf-polished: pngoptimizer, origSize=489, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 374
last-modified: Fri, 01 Jul 2011 10:17:42 GMT
server: cloudflare
etag: "1e9-4a6ff53f0bd80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c67aec6407-FRA
expires: Sat, 07 Dec 2019 05:26:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 5368
date: Tue, 03 Dec 2019 14:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Tue, 03 Dec 2019 16:33:37 GMT

GET
H2 200 topic_button_closed.png
www.bleepingcomputer.com/forums/public/style_images/master/ 170 B
343 B 20ms
18ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/topic_button_closed.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bee1151fc65063ef2369f485bf24fc0506927659cc421d5f7a58a4f1b824a91

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 291010
cf-polished: pngoptimizer, origSize=251, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 170
last-modified: Wed, 20 Apr 2011 17:38:04 GMT
server: cloudflare
etag: "fb-4a15d163d7700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c69b036407-FRA
expires: Mon, 30 Dec 2019 07:12:55 GMT

GET
H2 200 maintitle.png
www.bleepingcomputer.com/forums/public/style_images/master/ 193 B
372 B 27ms
26ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/maintitle.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8347a92981a0fdc73af9e2536f688b1a14e6ebea3b4ee5df22e6654bb5e8ca6c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 2150844
cf-polished: pngoptimizer, origSize=295, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 193
last-modified: Tue, 01 Mar 2011 13:54:08 GMT
server: cloudflare
etag: "127-49d6c2153a000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c69b046407-FRA
expires: Sun, 08 Dec 2019 18:35:41 GMT

GET
H2 200 twitter.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 545 B
688 B 22ms
19ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/twitter.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

92597d72536ce2725db3f04c7ad34252f8d4037ae0a61cdec08f93a0c2db05f2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 375788
cf-polished: origSize=575, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 545
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "23f-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab1b6407-FRA
expires: Sun, 29 Dec 2019 07:39:57 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 48 KB
19 KB 33ms
31ms Script
application/javascript 2a00:1450:4001:800::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

0166899095125d9e765f2b8d3a7e1f1e7b227f80b9990532f9c655cce83ba67c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: script-src 'report-sample' 'nonce-2ouQoAmBJozAWHtRaCPHTQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
strict-transport-security: max-age=31536000
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "22fbc32cff236c1d04000a802a39cfc3"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin: *
expires: Tue, 03 Dec 2019 16:03:05 GMT

GET
H2 200 digg.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 357 B
592 B 30ms
27ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/digg.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

669641985eb1bb7b0e71762f8e734ae2d1832b6976a97f099218d714da1f214e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 462697
cf-polished: pngoptimizer, origSize=431, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 357
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "1af-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab1c6407-FRA
expires: Sat, 28 Dec 2019 07:31:28 GMT

GET
H2 200 delicious.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 245 B
390 B 20ms
17ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/delicious.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bc2ee096d68f1de3dfd74d23e4a3d1550001d5a459a537e276b5bdf6f011893

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 462697
cf-polished: origSize=308, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 245
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "134-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab1d6407-FRA
expires: Sat, 28 Dec 2019 07:31:28 GMT

GET
H2 200 reddit.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 542 B
723 B 25ms
22ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/reddit.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

424b5f41dcbc693d32ca73f0e2b1daa5cf5524bc2220865c15b81f032bf3052d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 365198
cf-polished: pngoptimizer, origSize=614, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 542
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "266-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab1e6407-FRA
expires: Sun, 29 Dec 2019 10:36:27 GMT

GET
H2 200 stumble.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 418 B
542 B 22ms
19ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/stumble.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a915aab28857afeac49311ceff852888da1623eb0f589d7f43fbfbfbceb562e9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 462697
cf-polished: pngoptimizer, origSize=519, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 418
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "207-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab206407-FRA
expires: Sat, 28 Dec 2019 07:31:28 GMT

GET
H2 200 email.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 419 B
672 B 20ms
18ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/email.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee469e3d281e77f7dcc2655ff8d187907f2240c76a03bf868e7dcfd67f08d880

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 291009
cf-polished: origSize=530, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 419
last-modified: Thu, 04 Feb 2010 11:47:46 GMT
server: cloudflare
etag: "212-47ec4e74b3c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab226407-FRA
expires: Mon, 30 Dec 2019 07:12:56 GMT

GET
H2 200 print.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 272 B
483 B 19ms
17ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/print.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e0533d6585c026d1f72a040b902b67d76994eafa3593049d16ee319e9ec9be8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 2107596
cf-polished: origSize=409, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 272
last-modified: Fri, 30 Apr 2010 22:16:02 GMT
server: cloudflare
etag: "199-4857b96a96c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab236407-FRA
expires: Mon, 09 Dec 2019 06:36:29 GMT

GET
H2 200 download.png
www.bleepingcomputer.com/forums/public/style_extra/sharelinks/ 633 B
800 B 21ms
19ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_extra/sharelinks/download.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

563777fc54d07e48cbea78dd97911bdd12a62d1888d12fe4dfeaaa9b3563d676

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 2463589
cf-polished: origSize=646, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 633
last-modified: Fri, 12 Feb 2010 14:33:56 GMT
server: cloudflare
etag: "286-47f6828485d00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab246407-FRA
expires: Thu, 05 Dec 2019 03:43:16 GMT

GET
H2 200 prettify.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/ 14 KB
6 KB 22ms
20ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/prettify.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 861
cf-polished: origSize=14551
status: 200
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
etag: W/"38d7-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c6ab186407-FRA
cf-bgj: minify

GET
H2 200 lang-sql.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/ 2 KB
1 KB 19ms
18ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/prettify/lang-sql.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 6317
cf-polished: origSize=1802
status: 200
last-modified: Wed, 29 May 2013 16:10:52 GMT
server: cloudflare
etag: W/"70a-4dddda0323b00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c6ab266407-FRA
cf-bgj: minify

GET
H2 200 top.png
www.bleepingcomputer.com/forums/public/style_images/master/ 147 B
325 B 23ms
21ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/top.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7cc36f47b70988855c5cde9579581871e9dc92a285a8b1ba4602a89c915c902c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 291009
cf-polished: origSize=207, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 147
last-modified: Thu, 09 Jun 2011 17:25:44 GMT
server: cloudflare
etag: "cf-4a54abe32b600"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab286407-FRA
expires: Mon, 30 Dec 2019 07:12:56 GMT

GET
H2 200 feed.png
www.bleepingcomputer.com/forums/public/style_images/master/ 641 B
822 B 20ms
18ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/feed.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9158290895e962ac081ae5856cf1c361811b63e1dadf7a6b09fa2f3abbd6ecb5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 1313541
cf-polished: origSize=680, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 641
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "2a8-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c6ab296407-FRA
expires: Wed, 18 Dec 2019 11:10:44 GMT

GET
H2 200 lightbox.js Show response
www.bleepingcomputer.com/forums/public/js/3rd_party/ 9 KB
2 KB 23ms
22ms Script
application/javascript 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bleepingcomputer.com/forums/public/js/3rd_party/lightbox.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a78f7bf63f851cbab54a7f7e9ccb76b53ef79834c33cd242aa98d16d228e855

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
vary: Accept-Encoding,User-Agent
cf-cache-status: HIT
age: 5693
cf-polished: origSize=10063
status: 200
last-modified: Wed, 29 May 2013 16:10:44 GMT
server: cloudflare
etag: W/"274f-4dddd9fb82900-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=18000
content-security-policy: upgrade-insecure-requests;
cf-ray: 53f6c4c6ab276407-FRA
cf-bgj: minify

GET
H2 200 3687X620620.skimlinks.js Show response
s.skimresources.com/js/ 40 KB
16 KB 24ms
8ms Script
application/octet-stream 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/3687X620620.skimlinks.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 84f9225b2c33c7e6689c30413ce5623d7221ab5463aea1baca4e3737f2bce3eb

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
last-modified: Wed, 06 Nov 2019 13:34:04 GMT
server: AmazonS3
x-amz-request-id: 23EDF06F442B1D35
etag: "2c2ef3b7f51ce084f52970ecd10c8d7d"
x-hw: 1575388985.cds107.fr8.hc,1575388985.cds137.fr8.c
content-type: application/octet-stream
status: 200
cache-control: max-age=3600
accept-ranges: bytes
content-length: 15826
x-amz-id-2: 97Eef/LA0ONQpqjf9JA7fk45wG3ptW0y3HMJQnVNbt6pvysZ8OHY6ArQ99G0Gpcm722HLkfUnlE=

GET
H2 200 noty.css
www.bleepstatic.com/js/noty/ 14 KB
2 KB 21ms
20ms Stylesheet
text/css 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/noty/noty.css
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c1bd0f4a8086eaaf6aff1ae5db3a58caa8f37a97503dbb0dbbe96c3ff86412f0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
cf-cache-status: HIT
age: 506148
cf-polished: origSize=17493
status: 200
cf-bgj: minify
last-modified: Fri, 24 Nov 2017 16:52:17 GMT
server: cloudflare
etag: W/"3461293989"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 53f6c4c6ce957cb8-MUC
expires: Wed, 01 Jan 2020 19:27:16 GMT

GET
H2 200 noty.js Show response
www.bleepstatic.com/js/noty/ 46 KB
11 KB 26ms
25ms Script
text/javascript 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/noty/noty.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5f51209e23b5d8a4ba4370726b53a7bf8165c655fc3d9757cfa05ae33c7f270

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
cf-cache-status: HIT
age: 506148
cf-polished: origSize=79865
status: 200
cf-bgj: minify
last-modified: Thu, 23 Nov 2017 17:50:15 GMT
server: cloudflare
etag: W/"2074561786"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 53f6c4c6ce977cb8-MUC
expires: Wed, 01 Jan 2020 19:27:16 GMT

GET
H2 200 js.cookie.min.js Show response
www.bleepstatic.com/js/jq-cookie/ 2 KB
1 KB 19ms
19ms Script
text/javascript 104.26.13.6
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bleepstatic.com/js/jq-cookie/js.cookie.min.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.13.6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3d2f3c252cb69ecc65b35060f06d8f20d5af93d751731c9b47d5ad0a4b28c5a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Nov 2017 16:58:52 GMT
server: cloudflare
age: 506148
etag: W/"3155542618"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: max-age=3024000
cf-ray: 53f6c4c6ce997cb8-MUC
access-control-allow-origin: *
expires: Wed, 01 Jan 2020 19:27:16 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
121 B 14ms
13ms Image
image/gif 2a00:1450:4001:808::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2138188376&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ul=en-us&de=windows-1252&dt=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=209102348&gjid=1768679476&cid=678002882.1575388985&tid=UA-91740-1&_gid=2069288893.1575388985&_r=1&gtm=2ouav9&z=997188805

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cmp-3pc-check.html
static.quantcast.mgr.consensu.org/v27/ Frame D8FB 0
0 53ms
7ms Document
text/html 2600:9000:2156:6000:9:46dc:4700:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://static.quantcast.mgr.consensu.org/v27/cmp-3pc-check.html
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:6000:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: static.quantcast.mgr.consensu.org
:scheme: https
:path: /v27/cmp-3pc-check.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
content-type: text/html
content-length: 583
last-modified: Mon, 18 Nov 2019 19:20:05 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Tue, 03 Dec 2019 15:57:55 GMT
etag: "2382c3f01978a379e8fa8bc1a3bec605"
x-cache: Hit from cloudfront
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: jMYdiXg1C2vmP9W_yAFMMeg04Cxf0uX8ByBZjZ2ZYK8CeMrSCcpinQ==
age: 469

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

33f22afb1f74640570092ba76dc65853890d52143fd2fa9c694fd5f76eac5450

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 2P+lKbpw5O6+QCRhUmv6sw==
status: 200
date: Tue, 03 Dec 2019 16:03:05 GMT
expires: Tue, 03 Dec 2019 16:04:34 GMT
alt-svc: h3-23=":443"; ma=3600
content-length: 1780
x-fb-debug: H9yZtX/X9rSVIONHeNZDd6TQHAxHvuWZ249JVkQpMCJp8hp6Y+AgV+t3D82eamCEIUG9PNHKgkRPL0Ecg5AHEw==
x-fb-trip-id: 2000377899
x-fb-content-md5: 0554abe45a23348bc567a43bfe30b3f9
etag: "4344d308b1d218074b294b9316044ef6"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.2O_3XQTFIPY.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw/ 139 KB
49 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.2O_3XQTFIPY.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7b5bbcbf15b2ae7c554c86986bd4412a26c9c11058c19142a8892614bd41ff7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 Nov 2019 01:53:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 Nov 2019 22:31:30 GMT
server: sffe
age: 1001395
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 49979
x-xss-protection: 0
expires: Sat, 21 Nov 2020 01:53:10 GMT

GET
H2 200 icon_warning.png
www.bleepingcomputer.com/forums/public/style_images/master/ 270 B
523 B 16ms
15ms Image
image/png 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/icon_warning.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea99b0d7d706f0144a121af332e2efaae3a1fa76a4a3dbdbec7faa2b0177a2b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 290916
cf-polished: origSize=408, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 270
last-modified: Wed, 20 Apr 2011 21:00:34 GMT
server: cloudflare
etag: "198-4a15fea6fc080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c71ba36407-FRA
expires: Mon, 30 Dec 2019 07:14:29 GMT

POST
H2

307

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/
https://r.skimresources.com/api/?xguid=01DV680E5PM0P9ZC5STKE1G9SA&persistence=1&checksum=a0267d76e6c770a49756299b061b3a14e4f789d473836bcad6145b96dd20072c

0
-1 B

28ms
14ms

XHR
text/html

35.190.59.101
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://r.skimresources.com/api/?xguid=01DV680E5PM0P9ZC5STKE1G9SA&persistence=1&checksum=a0267d76e6c770a49756299b061b3a14e4f789d473836bcad6145b96dd20072c
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 101.59.190.35.bc.googleusercontent.com
Software: openresty/1.11.2.5 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
via: 1.1 google
server: openresty/1.11.2.5
access-control-allow-origin: https://www.bleepingcomputer.com
location: //r.skimresources.com/api/?xguid=01DV680E5PM0P9ZC5STKE1G9SA&persistence=1&checksum=a0267d76e6c770a49756299b061b3a14e4f789d473836bcad6145b96dd20072c
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 307
access-control-allow-credentials: true
content-type: text/html
alt-svc: clear
content-length: 193

Redirect headers

date: Tue, 03 Dec 2019 16:03:05 GMT
via: 1.1 google
server: openresty/1.11.2.5
status: 307
location: //r.skimresources.com/api/?xguid=01DV680E5PM0P9ZC5STKE1G9SA&persistence=1&checksum=a0267d76e6c770a49756299b061b3a14e4f789d473836bcad6145b96dd20072c
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
content-type: text/html
alt-svc: clear
content-length: 193

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame 1ABB 0
105 B 33ms
19ms Image
text/plain 35.201.67.47
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.941063776967985
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 206
date: Tue, 03 Dec 2019 16:03:05 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
471 B 16ms
8ms Image
image/gif 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=9.950252300374192
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
status: 200
x-guploader-uploadid: AEnB2UrULGIC-1YWw-D8dcJNvhIU-zpQl6qnyg1MknBRZHW-x1uV2xza1KZtCEroETlb8yOibsRtzSfltbMkHhB3zbJtMicmyg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1575388985.cds107.fr8.hc,1575388985.cds054.fr8.c
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
107 B 16ms
8ms Image
image/gif 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=9.950252300374192
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
status: 200
x-guploader-uploadid: AEnB2UrULGIC-1YWw-D8dcJNvhIU-zpQl6qnyg1MknBRZHW-x1uV2xza1KZtCEroETlb8yOibsRtzSfltbMkHhB3zbJtMicmyg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1575388985.cds107.fr8.hc,1575388985.cds054.fr8.c
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 186 KB
56 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=402ff7cc9a212ed6e542db2141304a68&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

c289838929ec906a2a1029cefe28c65774f5d15ef2c0d1c2e78c9d9f7de9db3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: q3es6iEad4yhLK7iGprwJg==
status: 200
date: Tue, 03 Dec 2019 16:03:05 GMT
expires: Wed, 02 Dec 2020 14:11:27 GMT
alt-svc: h3-23=":443"; ma=3600
content-length: 56790
x-fb-debug: ddK1aurHpsFeyrUrnj436g1k9hjFyMvur6uqM/yD05u6P80s+OLbmrLnwFrnKUhY8JOo8+8UvmaNd3fZzJ1RrQ==
x-fb-trip-id: 420120009
x-fb-content-md5: e769ccbb2492849ecf60e6d5ecdbdfdb
etag: "0f4ba4db36c6915842eb36c10340be91"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK cookie Show response
d.pub.network/ 36 B
527 B 668ms
114ms XHR
text/plain 35.188.71.214
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/cookie
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: bacd7fe1202d267cfcb279ede84739eb2ca3edc00b0785e0acaeff86abe72df1

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Date: Tue, 03 Dec 2019 16:03:06 GMT
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 51 KB
15 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9d5718f13181da45241b915b1d7ae28f54f80f543bb8aab1904fe3efbcb2465e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "355 / 715 of 1000 / last-modified: 1575323226"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15723
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:05 GMT

GET
H/1.1 200
OK gallery.js Show response
freestar-io.videoplayerhub.com/ 130 KB
130 KB 40ms
12ms Script
application/javascript 143.204.101.16
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://freestar-io.videoplayerhub.com/gallery.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.16 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-16.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 62efaaf2cbb78cb582da9f7d10a92da43ea30df7034c43dd0b5213d58a5d9cdc

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: htINEFZYTN08xwtDT7jTdCNg54.cGg8X
Via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
Last-Modified: Wed, 27 Nov 2019 20:44:09 GMT
Server: AmazonS3
Age: 84
ETag: "98130e9766ebdf3729cf5de7214035b9"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Date: Tue, 03 Dec 2019 16:02:12 GMT
X-Amz-Cf-Pop: FRA50-C1
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 132887
X-Amz-Cf-Id: ssYzYxJZucCEc2IX1OlLuDXz6OjXlfT6AVcc5k10ldI2nev2R2JYFg==

GET
H2 200 prebid-analytics-2.36.5.js Show response
a.pub.network/core/ 388 KB
115 KB 210ms
210ms Script
text/html 2606:4700:20::681a:8b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ed72fa5a10977212d2b3fff3633b1a813970474f0b5cbd04e52170879faa455

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: br
cf-cache-status: BYPASS
status: 200
x-guploader-uploadid: AEnB2UpzgHVfuMWd0BnvlQpfoN3pBqllqDRv1-DhAMq3ehN2Xs1hmT3vqT5Io-gBO0NWBTseUODjr7zdLA_SqUKCjZCjKIoKzQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
last-modified: Tue, 05 Nov 2019 17:37:41 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=EJ1yIw==, md5=e2KPF9QKTQj2iapaLVhLdw==
content-type: text/html
x-goog-generation: 1572975461697049
cache-control: private
x-goog-stored-content-length: 397332
cf-ray: 53f6c4c7ed07597c-VIE
expires: Wed, 02 Dec 2020 16:03:05 GMT

GET
H/1.1 200
OK location Show response
d.pub.network/ 25 B
344 B 460ms
116ms XHR
application/json 35.188.71.214
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/location
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: 98f88d642acd9024773bf77b93f9546e3cd6fd8fa3d539d16f7b018e0cb513f2

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Date: Tue, 03 Dec 2019 16:03:05 GMT
Access-Control-Allow-Credentials: true
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding: chunked
Content-Type: application/json

GET
H2 200 loading.gif
www.bleepingcomputer.com/forums/public/style_images/master/lightbox/ 2 KB
2 KB 25ms
24ms Image
image/gif 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/loading.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 375787
cf-polished: origSize=2767, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 1588
last-modified: Thu, 18 Dec 2008 14:27:04 GMT
server: cloudflare
etag: "acf-45e52fc88de00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c7fccd6407-FRA
expires: Sun, 29 Dec 2019 07:39:58 GMT

GET
H2 200 closelabel.gif
www.bleepingcomputer.com/forums/public/style_images/master/lightbox/ 471 B
608 B 26ms
26ms Image
image/gif 104.20.60.209
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.bleepingcomputer.com/forums/public/style_images/master/lightbox/closelabel.gif

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.20.60.209 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
vary: User-Agent, Accept-Encoding
cf-cache-status: HIT
age: 375787
cf-polished: origSize=483, status=vary_header_present
status: 200
cf-bgj: imgq:100
content-length: 471
last-modified: Mon, 03 May 2010 23:34:02 GMT
server: cloudflare
etag: "1e3-485b90722ae80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: max-age=2592000
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
cf-ray: 53f6c4c7fcce6407-FRA
expires: Sun, 29 Dec 2019 07:39:58 GMT

POST
H2 200 / Show response
r.skimresources.com/api/ 152 B
460 B 17ms
17ms XHR
application/json 35.190.59.101
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

c5fccfd6a575a7a977abd0bf5ecb184a9f9755780fa8758ffecd2b94371a2d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

GET
H2 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.2O_3XQTFIPY.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw/ 95 KB
33 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:800::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.2O_3XQTFIPY.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

8bcd115fedf08ec9fdfe9f8fbc4b52d20b15f4d89d3d16ca947c9e6874e88799

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 20 Nov 2019 08:02:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 Nov 2019 22:37:32 GMT
server: sffe
age: 1152018
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 34069
x-xss-protection: 0
expires: Thu, 19 Nov 2020 08:02:47 GMT

GET
H2 404 fastbutton
apis.google.com/se/0/_/+1/ Frame 48CD 0
0 26ms
26ms Document
text/html 2a00:1450:4001:800::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.2O_3XQTFIPY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: apis.google.com
:scheme: https
:path: /se/0/_/+1/fastbutton?usegapi=1&count=false&size=small&hl=en-GB&origin=https%3A%2F%2Fwww.bleepingcomputer.com&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.2O_3XQTFIPY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: NID=192=o-hsz4oKMlGH3luCxizaTrR3pwSN6EDASL4vLhMquup3yXy6gXoH-rjHvCvxQeE-gyc6UzOgMhi7znX8edomW66TgwuIB4gYmpO4WrykPddMlxYgn6UytRMK85ktjA12xRGQsc52p3R5WiK3knXfxnOSSQb8zst_bltkaqhIeSQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 404
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 03 Dec 2019 16:03:05 GMT
content-security-policy-report-only: script-src 'report-sample' 'nonce-88k+rO0B1+tFOgXRFVzUIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

POST
H2 200 / Show response
r.skimresources.com/api/ 152 B
409 B 17ms
16ms XHR
application/json 35.190.59.101
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01DV680E5PM0P9ZC5STKE1G9SA&persistence=1&checksum=a0267d76e6c770a49756299b061b3a14e4f789d473836bcad6145b96dd20072c

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

c5fccfd6a575a7a977abd0bf5ecb184a9f9755780fa8758ffecd2b94371a2d6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

GET
H2 200 cmpui-popup.js Show response
static.quantcast.mgr.consensu.org/v27/ 222 KB
60 KB 8ms
8ms Script
text/javascript 2600:9000:2156:6000:9:46dc:4700:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://static.quantcast.mgr.consensu.org/v27/cmpui-popup.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:6000:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2363cbdace3d4db7b0ee2f0fcf42a722658814affea6c100f3679f7c21ff9e11

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:00:11 GMT
content-encoding: gzip
last-modified: Mon, 18 Nov 2019 19:20:04 GMT
server: AmazonS3
age: 1014
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
status: 200
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: MuarGwrq2nMUJKC2HiMUTVZ60yU4UYDOpRC4QKjRaa6mewoYE7Of4g==
via: 1.1 45de888accabe1a1cb5a389e8c9c1e07.cloudfront.net (CloudFront)

GET
H2 200 iab Show response
api.skimlinks.mgr.consensu.org/ 772 B
643 B 31ms
16ms XHR
application/json 35.190.40.172
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://api.skimlinks.mgr.consensu.org/iab?nocache=1575388985644

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

172.40.190.35.bc.googleusercontent.com

Software

nginx/1.14.0 /

Resource Hash

4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx/1.14.0
access-control-allow-headers: *
status: 200
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
171 B 16ms
16ms Script
application/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.bleepingcomputer.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 17ms
17ms Script
application/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: application/javascript; charset=UTF-8
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019111801.js Show response
securepubads.g.doubleclick.net/gpt/ 159 KB
58 KB 16ms
16ms Script
text/javascript 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

sffe /

Resource Hash

03b07f320a1692a2d507465027fffaa6560d19d248c33bb6a5f2c97b75680c1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 18 Nov 2019 14:07:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 59620
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:05 GMT

GET
H2 200 xd_arbiter.php
staticxx.facebook.com/connect/ Frame DF2F 0
0 8ms
6ms Document
text/html 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://staticxx.facebook.com/connect/xd_arbiter.php?version=44

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=402ff7cc9a212ed6e542db2141304a68&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: staticxx.facebook.com
:scheme: https
:path: /connect/xd_arbiter.php?version=44
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
content-type: text/html; charset=utf-8
expires: Tue, 24 Nov 2020 12:42:36 GMT
strict-transport-security: max-age=15552000; preload
content-encoding: gzip
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: public,max-age=31536000,immutable
x-fb-debug: TyzW4Im8igqxdjD2xE2ADBC7NLcNecVqdYleG2ITKjzLKdfIMYtX//0vlRSNC6LHDzpb9dYvMX22ZDqOYghvrA==
content-length: 12382
x-fb-trip-id: 2000377899
date: Tue, 03 Dec 2019 16:03:05 GMT
alt-svc: h3-23=":443"; ma=3600

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 31ms
31ms Fetch
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=942111685863795&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=402ff7cc9a212ed6e542db2141304a68&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/
Origin: https://www.bleepingcomputer.com

Response headers

pragma: no-cache
x-fb-debug: CNYKesU2yhWVisPyibRe9wNDZfh+/ydEk2gqNai7T50XEZhFF29nlfGl0qePuxsiIIHbI3pi/whipVYqAiph6g==
fb-s: unknown
status: 200
date: Tue, 03 Dec 2019 16:03:05 GMT
strict-transport-security: max-age=15552000; preload
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-23=":443"; ma=3600
content-length: 0
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 postmessageRelay
accounts.google.com/o/oauth2/ Frame F383 0
0 38ms
18ms Document
text/html 2a00:1450:4001:819::200d
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.2O_3XQTFIPY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.2O_3XQTFIPY.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw/cb=gapi.loaded_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-W0NQwfCLL16ysNx55ywhow' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.bleepingcomputer.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.2O_3XQTFIPY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCM0JjSA0I0wvcxN0q5y4p-sc5Yxiw%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: NID=192=o-hsz4oKMlGH3luCxizaTrR3pwSN6EDASL4vLhMquup3yXy6gXoH-rjHvCvxQeE-gyc6UzOgMhi7znX8edomW66TgwuIB4gYmpO4WrykPddMlxYgn6UytRMK85ktjA12xRGQsc52p3R5WiK3knXfxnOSSQb8zst_bltkaqhIeSQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 03 Dec 2019 16:03:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-W0NQwfCLL16ysNx55ywhow' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2

200

/
p.skimresources.com/ Frame 1ABB
Redirect Chain

https://x.skimresources.com/?provider=exelate
https://loadeu.exelator.com/load/?p=787&g=001&j=0&
https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1
https://x.skimresources.com/?provider=exelate&skim_mapping=true&provider_id=2fe82b1df1472f46f9cbcba0f13df999
https://p.skimresources.com/?provider_id=2fe82b1df1472f46f9cbcba0f13df999&skim_mapping=true

43 B
269 B

50ms
49ms

Image
image/gif

151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/?provider_id=2fe82b1df1472f46f9cbcba0f13df999&skim_mapping=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:06 GMT
age: 1
status: 200
x-guploader-uploadid: AEnB2UpO-cUadhYssRcz6PPpcpe-hcyNEfPqhefPTkPdLLEqdZAbN-pURw66uqyAcI4XL4mMtmChjvO831AB2M6orT2-BDq7cg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1575388986.cds107.fr8.hc,1575388986.cds135.fr8.sc,1575388986.cds135.fr8.pr
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

Redirect headers

Location: https://p.skimresources.com?provider_id=2fe82b1df1472f46f9cbcba0f13df999&skim_mapping=true
Date: Tue, 03 Dec 2019 16:03:05 GMT
Server: TornadoServer/2.4.1
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 vendorlist.json Show response
vendorlist.consensu.org/ 92 KB
17 KB 24ms
8ms XHR
application/json 2600:9000:21f3:ce00:1:af78:4c0:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://vendorlist.consensu.org/vendorlist.json
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:ce00:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 87cbeab00a06ecdea6d059473f8223197b3e2e70c7023e50279a210de90815aa

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Sat, 30 Nov 2019 23:35:46 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 232040
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 28 Nov 2019 16:00:26 GMT
server: AmazonS3
access-control-max-age: 604800
access-control-allow-methods: GET
x-amz-version-id: s.mE4yKhUZITOXBYWuTuGEw4Fxd4sD4L
via: 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA2-C2
content-type: application/json; charset=utf-8
x-amz-cf-id: 6XUdTOu_liyr5iuHO9f4ds-YlBN7lk2YK8oDWYpe1JBrZFQWTYdF_w==

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 88 KB
26 KB 26ms
12ms Script
application/javascript 13.225.86.250
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 1412d7245072504d1975da264074e475485b5bab1edab58938a536542a4f3dd5

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 02 Dec 2019 17:32:54 GMT
content-encoding: gzip
server: Server
age: 81011
etag: f95fda3d4fe6103808d969fc52fa66db
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: mFNRuyOVpayXBGa_Bw_xH3mW2eD47hrE7dJklNO8n2KQWmhou7Txqg==
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)

GET
H/1.1 200
OK config.js Show response
confiant-integrations.global.ssl.fastly.net/dvS98IKwDukcG6gPDYBBcCk9sKY/gpt_and_prebid/ 279 KB
61 KB 27ms
6ms Script
text/javascript 151.101.113.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/dvS98IKwDukcG6gPDYBBcCk9sKY/gpt_and_prebid/config.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7b4314b5e9f9c2aac6587856b6528df0c70f02403927f86e03ad45df271bdc10

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:05 GMT
Content-Encoding: gzip
Age: 367
X-Cache: HIT
Connection: keep-alive
Content-Length: 61547
x-amz-id-2: 39WpKE5EsyV3r3b5AqNEYxs98LB1HoFcnGhwt2PyZ20dtSf0eRXX1i2XvJwEDZSLoyuVnF0Igw4=
X-Served-By: cache-hhn4026-HHN
Last-Modified: Tue, 03 Dec 2019 15:50:18 GMT
Server: AmazonS3
X-Timer: S1575388986.748020,VS0,VE0
ETag: "68f579d70c187df373e8289c4402de9f"
x-amz-request-id: 2584DD87E467B093
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: text/javascript
X-Cache-Hits: 11

GET
H/1.1 200
OK v2 Show response
d.pub.network/floors/ 2 KB
2 KB 583ms
116ms XHR
application/json 35.188.71.214
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://d.pub.network/floors/v2?key=535desktop
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.188.71.214 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 214.71.188.35.bc.googleusercontent.com
Software: /
Resource Hash: b83f83af16c29530301aa94d3dd2fe664212afea8f8cc9436fcaa18c0d7848f0

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Date: Tue, 03 Dec 2019 16:03:06 GMT
Access-Control-Allow-Credentials: true
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Transfer-Encoding: chunked
Content-Type: application/json

GET
H2 200 beacon.js Show response
ad-delivery.net/ 1 KB
987 B 54ms
7ms Script
application/x-javascript 143.204.101.62
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ad-delivery.net/beacon.js
Requested by: Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.62 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-62.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Tue, 31 Jan 2017 15:06:54 GMT
server: AmazonS3
age: 502
date: Tue, 03 Dec 2019 15:54:47 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: X4QavO4_sMU-QGjfHLqjNLijpBosZFsYblprn8CKrg5bQ0267fK_CQ==
via: 1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)

GET
H2 404 CookieAccess Show response
api.quantcast.mgr.consensu.org/ 30 B
596 B 301ms
283ms XHR
application/json 13.225.78.52
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.quantcast.mgr.consensu.org/CookieAccess
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.52 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-52.fra2.r.cloudfront.net
Software: /
Resource Hash: 5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:06 GMT
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-amzn-requestid: f428e21d-d5df-4398-b77e-1a9563bdad3b
x-cache: Error from cloudfront
status: 404
x-amz-apigw-id: EIoREEgRoAMFdTA=
content-length: 50
access-control-allow-origin: https://www.bleepingcomputer.com
x-amzn-trace-id: Root=1-5de68739-4ad29dd1cc246d147bddaad6;Sampled=0
vary: Origin
access-control-allow-methods: GET, POST
content-type: application/json
via: 1.1 2afacc6ad96dbba3f0b477cd95f16459.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
x-amz-cf-id: fON7YyaWU4SBHeJgLvWBRkoGATKnLIgziNxdlnUp_71sH3DAyGTGRg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 20ms
7ms XHR
application/javascript 13.225.86.250
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 14:28:37 GMT
content-encoding: gzip
vary: Origin
age: 5669
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Fri, 01 Nov 2019 13:46:13 GMT
server: AmazonS3
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 f99b5b46e77cfe9c3413f99dc8a4088c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: QEqdScSBYlafLc0H9RAym9BrrEPJ3F5WtmcyAnWJnzwfD3bZoZ0OFA==

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/prebid/201911261602/ 30 KB
12 KB 7ms
7ms Script
application/javascript 151.101.113.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/prebid/201911261602/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/dvS98IKwDukcG6gPDYBBcCk9sKY/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8db624e21c35d3f1626601a61acb544d8dc307f820c325f945d4a2b60cb2c2eb

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:05 GMT
Content-Encoding: gzip
Age: 437
X-Cache: HIT
Connection: keep-alive
Content-Length: 11494
x-amz-id-2: +MmXd7I2qh9ftuh+IUtpjMNBmQsaYsvYI7hRtqEvVua62F21vaKoDApOaArSMmvY1h8aNU5kYy0=
X-Served-By: cache-hhn4026-HHN
Last-Modified: Tue, 26 Nov 2019 21:02:28 GMT
Server: AmazonS3
X-Timer: S1575388986.774144,VS0,VE0
ETag: "2c466e3e28fad37f3a2d6af83dcf47bf"
x-amz-request-id: 8136804A1BFAB3A6
Via: 1.1 varnish
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 931

GET
H2 200 like.php
www.facebook.com/plugins/ Frame 6D18 0
0 88ms
87ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df242bc438bd13c%26domain%3Dwww.bleepingcomputer.com%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff1df0e855d1feac%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=402ff7cc9a212ed6e542db2141304a68&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?action=like&app_id=942111685863795&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df242bc438bd13c%26domain%3Dwww.bleepingcomputer.com%26origin%3Dhttps%253A%252F%252Fwww.bleepingcomputer.com%252Ff1df0e855d1feac%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&layout=button_count&locale=en_US&sdk=joey&send=false&show_faces=false&width=150
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
strict-transport-security: max-age=15552000; preload
content-encoding: br
timing-allow-origin: *
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-type: text/html; charset="utf-8"
x-fb-debug: vRp0UcDA3nX0OlnRKW9aw7WQdDBlvrfle6xyPYINrdnJ6IMHBcoeTCxY6HD6CnAZKnHKqXBrlt2YTpPcWprErw==
date: Tue, 03 Dec 2019 16:03:06 GMT
alt-svc: h3-23=":443"; ma=3600

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
376 B 51ms
50ms XHR
text/javascript 13.225.86.250
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&pid=VQgEXlsozqxPz&cb=0&ws=1600x1200&v=7.44.02&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_2%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:05 GMT
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA2-C2
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 4mTlv2zuaVLirQC1KfCxpiwvSZhBAfH3uZ3A0R8So5W_h5CCBQJlNQ==

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
390 B 38ms
24ms XHR
application/javascript 35.201.67.47
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/3687X620620.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:06 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

GET
H2

200

/
p.skimresources.com/ Frame 1ABB
Redirect Chain

https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=2c431d699868bb6104dc0b98f9f67e47
https://p.skimresources.com/?provider_id=2c431d699868bb6104dc0b98f9f67e47&skim_mapping=true

43 B
189 B

43ms
43ms

Image
image/gif

151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/?provider_id=2c431d699868bb6104dc0b98f9f67e47&skim_mapping=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:06 GMT
age: 1
status: 200
x-guploader-uploadid: AEnB2UrCauKGzVMxiF4oP2vEBBV-_LuZpZTDytdikY5ECpCloVtOaHSyB9xS47o7-aYd582v4pp_kHpbD3CsXFnxryFy1ImiQg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
x-hw: 1575388986.cds107.fr8.hc,1575388986.cds135.fr8.sc,1575388986.cds135.fr8.pr
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

Redirect headers

Location: https://p.skimresources.com?provider_id=2c431d699868bb6104dc0b98f9f67e47&skim_mapping=true
Date: Tue, 03 Dec 2019 16:03:06 GMT
Server: TornadoServer/2.4.1
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK jquery.color-2.1.2.min.js Show response
cluster-na.cdnjquery.com/color/ 92 B
356 B 412ms
100ms Script
text/javascript 3.222.69.96
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cluster-na.cdnjquery.com/color/jquery.color-2.1.2.min.js?integrity=btjsonpcallback1575388986198&checksum=%7B%22cbc%22%3A0%2C%22st%22%3A2%2C%22au%22%3A%5B%5D%2C%22hau%22%3A%5B%5D%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F%22%2C%22aa%22%3A3%2C%22pgid%22%3A%22644a1cb0-15e6-11ea-bfda-adeca241cc7b%22%2C%22v%22%3A1%2C%22format%22%3A%22jsonp%22%7D&o=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&csVersion=1.21.0&clearThroughOptions=undefined

Requested by

Host: freestar-io.videoplayerhub.com
URL: https://freestar-io.videoplayerhub.com/gallery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.222.69.96 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-3-222-69-96.compute-1.amazonaws.com

Software

nginx/1.12.1 /

Resource Hash

dbdae5c33d3c40ab952c62ad6532516212cfc676fc1b1585b2aa4f37bad8523f

Security Headers

Name	Value
X-Frame-Options	DENY

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:06 GMT
Content-Encoding: gzip
Server: nginx/1.12.1
ETag: W/"5c-OVcZfEBrdrGc9Qmmz0P3plzVL9c"
X-Frame-Options: DENY
Content-Type: text/javascript; charset=utf-8
Charset: utf8
Connection: keep-alive
Content-Length: 84

GET
H2 200 px.gif
ad-delivery.net/ 43 B
386 B 9ms
9ms Image
image/gif 143.204.101.62
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7854862227911248
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.62 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-62.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)
last-modified: Thu, 27 Jul 2017 18:59:05 GMT
server: AmazonS3
age: 75037
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
date: Mon, 02 Dec 2019 23:08:39 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: aNl_T_X9HBgda0XqqbMFkNheWW6p5K09f63BqrJYYFsQyCQr1EPNgw==

POST
H/1.1 200
OK c Show response
c.pub.network/ 36 B
344 B 470ms
116ms XHR
text/plain 35.226.36.58
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.226.36.58 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 58.36.226.35.bc.googleusercontent.com
Software: /
Resource Hash: bacd7fe1202d267cfcb279ede84739eb2ca3edc00b0785e0acaeff86abe72df1

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Date: Tue, 03 Dec 2019 16:03:06 GMT
Access-Control-Allow-Credentials: true
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

GET
H2 200 / Show response
audit.quantcast.mgr.consensu.org/ 80 B
486 B 37ms
11ms XHR
text/html 143.204.101.58
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://audit.quantcast.mgr.consensu.org/?log=;1575388986310;BleepingComputer.com;https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F;;;;;p,off,false,,1,en,27,177,true,false,false;displayConsentUi:mandatory,
Requested by: Host: static.quantcast.mgr.consensu.org
URL: https://static.quantcast.mgr.consensu.org/v27/cmpui-popup.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.58 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-58.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 09:03:52 GMT
via: 1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
vary: Origin
age: 25155
x-cache: Hit from cloudfront
status: 200
content-length: 80
last-modified: Mon, 11 Jun 2018 22:07:34 GMT
server: AmazonS3
etag: "0614149d8033903db5de46d6c184bbfd"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/html
access-control-allow-origin: *
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: G1ofcbiPVEDWEoIim0YGobWe5DrCMUSp7cHvT99fSduPMIaFMUVpbA==

GET
H2 200 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
318 B 325ms
108ms XHR
application/javascript 52.4.163.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=-60&buster=1575388987184&secure=true&version=9&mobile=false&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&measurable=true&bids[0][bidId]=5d0b7d35351b57&bids[0][config][property]=5c3404d83e048a00261ad27f&bids[0][config][zone]=bleepingcomputer_728x90_970x90_970x250_320x50_ATF&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[0][sizes][2][width]=970&bids[0][sizes][2][height]=250&bids[1][bidId]=6c9269ab1f4706&bids[1][config][property]=5c3404d83e048a00261ad27f&bids[1][config][zone]=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&bids[1][sizes][0][width]=728&bids[1][sizes][0][height]=90&bids[1][sizes][1][width]=970&bids[1][sizes][1][height]=90&bids[1][sizes][2][width]=970&bids[1][sizes][2][height]=250&bids[2][bidId]=7726e72d7fe6f9&bids[2][config][property]=5c3404d83e048a00261ad27f&bids[2][config][zone]=bleepingcomputer_728x90_320x50_InContent_2&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&property=5c3404d83e048a00261ad27f&foo
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.163.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-163-43.compute-1.amazonaws.com
Software: / Express
Resource Hash: acd199754b7137704f41bc7d1cf75b688b6f9d06968e250d33465b2fad8b8942

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
status: 200
x-powered-by: Express
etag: "-1860372469"
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
546 B 150ms
131ms XHR
application/json 35.156.206.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.36.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tmax=1200

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.206.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-35-156-206-192.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 375 B
1 KB 86ms
45ms XHR
application/json 185.33.223.202
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.202 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

c419fe9d697507db44b762c2216588184dfd2e64bc6a629e9b4e314eaf505183

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
X-Proxy-Origin: 185.151.58.114; 185.151.58.114; 318.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.167:80
AN-X-Request-Uuid: 293f4509-a592-4502-a163-af551943b20c
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 375
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 404
Not Found 24 Show response
web.hb.ad.cpe.dotomi.com/s2s/header/ 678 B
878 B 40ms
12ms XHR
text/plain 2a02:fa8:8806:12::1430
VCLK-EU-

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Dec 2019 16:03:07 GMT
Cache-Control: max-age=0, no-store
Server: nginx
Connection: keep-alive
Content-Length: 678
Content-Type: text/plain; charset=UTF-8

GET
H2

302

ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191

0
-1 B

123ms
99ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191

0
-1 B

123ms
99ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191

0
-1 B

118ms
95ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191

0
-1 B

119ms
96ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191

0
-1 B

121ms
99ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191

0
-1 B

399ms
376ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191;
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191

0
-1 B

122ms
99ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 38ms
8ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=35db8238a78e4a5&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 39ms
10ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=wDH8n844o8J5LF7qDwHQ7sj5&bidId=36c497acacd1dda&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 39ms
9ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=L7rKdgz52e7UZ4fMkwkYmaxf&bidId=37e5d709f585248&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 40ms
10ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=381b1ad874b4db6&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 39ms
9ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=wDH8n844o8J5LF7qDwHQ7sj5&bidId=39d5ef325645396&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 39ms
10ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=L7rKdgz52e7UZ4fMkwkYmaxf&bidId=407571817708183&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 52ms
12ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=4134d1df289e78b&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 52ms
12ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=Ggh1aXSgpQAvBpkxoyAsBJPd&bidId=428110d5816156&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

OPTIONS
H2 204 v1 Show response
dmx.districtm.io/b/ 0
459 B 147ms
124ms XHR
text/plain 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: https://www.bleepingcomputer.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
status: 204
access-control-max-age: 14400
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53f6c4d22cdc96a4-FRA
access-control-allow-headers: origin, content-type

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
659 B 104ms
40ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14287&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d8b1d56f910b1b912617744660596ec699b13a5548bdda03579aff1651afa2d6

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
660 B 104ms
41ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14288&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6a6791537c8dbac7a0632f4d05a0fef65d926abc70fc31e1b8ac0a2da282c9f8

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
660 B 115ms
52ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14287&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f27cf7c85ec69a44e44258bd12c07939cc9c715c895527813609e482035b3300

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
660 B 104ms
42ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14288&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 4253287e01423d47fa504539ab204ff8993547131db8caa68088257665d17e08

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
658 B 103ms
41ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?si=14287&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 792ca8c88408660ac1460ae6099949491b1a2f14219396215f927004d786ebab

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
122 B 172ms
144ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Tue, 03 Dec 2019 16:03:07 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com

POST
H2 200 v2 Show response
i.connectad.io/api/ 142 B
693 B 278ms
244ms XHR
application/json 2606:4700:10::6814:9174
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.connectad.io/api/v2
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:9174 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: beac17f947e2a553943045782e2ebe877500da304ee9f4d701134cce5ae7d502

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
alt-svc: clear
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 53f6c4d24e925a18-VIE
content-type: application/json
via: 1.1 google

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 259 B
2 KB 129ms
97ms XHR
application/json 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tk_flint=pbjs_lite_v2.36.0&x_source.tid=1c536a03-7175-4904-8cf4-b44af671d428&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9205213414395506
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 3e9695ddb52374f361a5e6d2b6fd1666e85c002e7dacad455dfb8dab48e4ffb6

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=297
Content-Length: 259
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 259 B
2 KB 216ms
183ms XHR
application/json 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tk_flint=pbjs_lite_v2.36.0&x_source.tid=38848e85-e31b-4330-ace0-a19f41f21db1&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8101949161276589
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 27a649cf4b325933dcc49f908a227583bdce0ada97d129cac346624bd4eec96a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=401
Content-Length: 259
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
2 KB 165ms
130ms XHR
application/json 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tk_flint=pbjs_lite_v2.36.0&x_source.tid=b8ca1ff3-16fe-49f3-a3e4-9a0703504803&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.1468211418717129
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 2041712798be6dbdabefc34f4e454272971206a9767a4b3c69ae2b5c7ae5c30a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=52
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 arj Show response
freestar-d.openx.net/w/1.0/ 7 KB
7 KB 158ms
151ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&jr=&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_2.1.9&dddid=1c536a03-7175-4904-8cf4-b44af671d428%2C38848e85-e31b-4330-ace0-a19f41f21db1%2Cb8ca1ff3-16fe-49f3-a3e4-9a0703504803&nocache=1575388987204&x_gdpr_f=1&pubcid=d862d9f9-b42a-4af7-bb11-d2d39ef84547&aus=728x90%2C970x90%2C970x250%7C728x90%2C970x90%2C970x250%7C728x90&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_728x90_320x50_InContent_2&auid=539181725%2C539181725%2C539181725&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash: fbe858994ebec2fc448059339f1d40abfee06ef0e532bf30ae6bf8a472b29c49

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
via: 1.1 google
server: OXGW/16.167.2
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 7143
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 361 B
1 KB 72ms
24ms XHR
application/json 185.33.223.202
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.202 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

896d841259064b8bbb2de90fe57aff6118cb0223eaa6f2f93c0df4d71ef78665

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
X-Proxy-Origin: 185.151.58.114; 185.151.58.114; 318.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.167:80
AN-X-Request-Uuid: 17b07e0e-f1f1-4e0f-92e9-6ebb970ea990
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 361
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
914 B 187ms
157ms XHR
application/json 95.100.197.53
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%2277e68066fd1c5fe%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22785a009222bcaae%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%2279b45de011ba953%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22id%22%3A%228091076afeb4df9%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22id%22%3A%2281d2b049efd5a31%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%22824816ca174391d%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22id%22%3A%2283e9dfe0e6f25cb%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22id%22%3A%22840c7b2b5b64a2e%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.197.53 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-197-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e84f34b9c0f4a71f01d0ca6f0e2345b110c9025b0af4846899aeb3e07303196e

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 43 KB
11 KB 384ms
384ms XHR
text/plain 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3547729954264097&correlator=3380395257919349&output=ldjh&impl=fifs&adsid=NT&eid=21064550%2C21065138&vrg=2019111801&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A134250504&sc=1&sfv=1-0-36&ecs=20191203&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_ATF%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF%2Cbleepingcomputer_728x90_320x50_InContent_2%2Cbleepingcomputer_1x1_pushdown&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%7C970x250%2C728x90%7C970x90%7C970x250%2C728x90%2C1x1&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1575388987&dt=1575388987215&dlt=1575388985261&idt=459&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C436%2C524%2C800&adys=268%2C34106%2C1142%2C37&adks=960084856%2C976516616%2C1808008496%2C2697902146&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&dssz=86&icsg=17592119627712&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x105%7C1392x105%7C1177x152%7C1600x34377&msz=970x90%7C1392x90%7C1177x90%7C1600x1&ga_vid=678002882.1575388985&ga_sid=1575388987&ga_hid=2138188376&fws=4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

7a69bffb6e9271a63c554a66729a11ae26e4939dc0a6f589b21e28ef17cd16f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11057
x-xss-protection: 0
google-lineitem-id: -1,-2,-2,4893662829
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-2,-2,138254592126
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019111801.js Show response
securepubads.g.doubleclick.net/gpt/ 65 KB
25 KB 15ms
15ms Script
text/javascript 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

sffe /

Resource Hash

23f5a3eca6fec1f8380dd45a87da65ee9ab4c93d4602403dc26b18e2afeb201f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 18 Nov 2019 14:07:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 25219
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-36/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2

302

ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=15...

0
-1 B

95ms
95ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=15...

0
-1 B

99ms
98ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=15...

0
-1 B

99ms
98ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=15...

0
-1 B

97ms
97ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=15...

0
-1 B

101ms
101ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

302

ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=15...

0
-1 B

99ms
99ms

XHR

152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
access-control-allow-origin: https://www.bleepingcomputer.com
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
status: 302
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
437 B 40ms
25ms XHR
text/plain 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53f6c4d309d19772-FRA
access-control-allow-headers: origin, content-type

GET
H2 200 ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ 945 B
1 KB 176ms
176ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65401c92-15e6-11ea-9127-120ea4e1ae80;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=8796aee60bcca92;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 1c537f383ff3a785ea87ed8a189769e88ac8b83a5258ee8b5c96b9c43c5c7ac8

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ 945 B
1 KB 166ms
165ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A6540b8f0-15e6-11ea-a822-1245d65848a4;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=882a5c6d8dbcfdb;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: e9f25bcf2516f56f5ad54cadee59eb9bd24d5b5eaa33f10344d6caefc4ea105c

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ 945 B
1 KB 156ms
155ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;apid=1A65410800-15e6-11ea-b119-128b912572ea;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=85e96478198182e;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: ce5d13984b78782259e7d6f236e37dcccb6ab1a5ad7f85bac1b83214eb6376a8

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ 945 B
1 KB 177ms
177ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A6541229a-15e6-11ea-8cf4-12dccfef2018;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=890a7fcf6d1a353;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 1b1706050199c867e5586fb8cd8273040dbb42fc2b2442176de6b7c3c694ebe2

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ 945 B
1 KB 163ms
163ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;apid=1A654119ee-15e6-11ea-8b17-123c39a1c2a0;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=867a2c833e67459;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 14cd637179c522aee08827631920f4c45be640bd0bdcbc108198f7bb806b18fc

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ 945 B
1 KB 165ms
165ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;apid=1A65414e78-15e6-11ea-822c-123ff9725662;cfp=1;rndc=1575388986;v=2;cmd=bid;cors=yes;alias=91aadc28a37113c;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: b858c15d1c76a8e7afb85a55f00e9918358b162be31e0a9b58a68c56be32d656

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ 945 B
1 KB 177ms
177ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;cfp=1;rndc=1575388987;v=2;cmd=bid;cors=yes;alias=90f11b13a27142a;misc=1575388987191
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: e72e776a1d4d5d967a04f317e996b951d11d41448e72e43f5d0dc0ef6d621bbf

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/011911070201440/ 20 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

866a1264b956a58da8e640a6191453d62f20d8676f63f193d2786318f83f6422

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9448
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7132
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:25:39 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "796f98bb73f13f89"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:25:39 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/011911070201440/ Frame 7CB5 200 KB
54 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7a52d4e3f541e459f9069f6f596242684704eeaca5a95f05285d16e2e609927d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9443
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55611
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:25:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d3c4309c2c9fce1d"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:25:44 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 7CB5 15 KB
6 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f6b7ba3cc9a8177d62950984426ff73450f229d389c449b0631392be2f5b5b61

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9603
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5592
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9ac5c138bfec1b90"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:23:04 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 7CB5 151 KB
40 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e4ad56bd91f08203b208a3db86c463c7952fad443a239de6454c73b7ce669657

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9443
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41358
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:25:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ed96f4a845755c74"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:25:44 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 7CB5 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3c10cb1ddf712f08a5082f5759b9496c250d195a9e6746e2ab0088b52775b21e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9613
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1402
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "49ed1549bef9ee2d"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:22:54 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 7CB5 44 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

71dae7cc7766c98bdc4b766789af22fe0442d58aced342736f044ec12aaba058

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9613
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14180
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "15a9b640489a7720"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:22:54 GMT

GET
DATA 200
OK truncated
/ Frame 7CB5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8844de510c63a3bd1038027b5d3976efdd043839aec4c65d74efd05d5d070638

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
376 B 54ms
54ms XHR
text/javascript 13.225.86.250
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&pid=RgwJlWGpDtxu2&cb=1&ws=1600x1200&v=7.44.02&t=1000&slots=%5B%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_970x90_970x250_320x50_BTF%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA2-C2
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: rfphu7q0bUvorU4c8srFmS5BPMjmLJ4boFiwKjrQUDBHMsfVZKA96Q==

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 1 KB
2 KB 133ms
133ms XHR
application/json 95.100.197.53
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22968e77c24845ad2%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22970e5e1e7cbfcd1%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%22987674f83af82c6%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22id%22%3A%2299548fa6594af82%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x250%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.197.53 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-197-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7123d7348344bb4e50d4aee77d0f8f00f1db864a43c161acdac66e399485db85

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 1004
Expires: Tue, 03 Dec 2019 16:03:07 GMT

OPTIONS
H2 204 v1 Show response
dmx.districtm.io/b/ 0
40 B 24ms
23ms XHR
text/plain 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: https://www.bleepingcomputer.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
status: 204
access-control-max-age: 14400
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53f6c4d4bf8e96a4-FRA
access-control-allow-headers: origin, content-type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 45ms
45ms XHR
application/json 185.33.223.202
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.202 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

9da345f99ff7351802644234c37b0e2be08dbdbcc4250110088e75df5792b9aa

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
X-Proxy-Origin: 185.151.58.114; 185.151.58.114; 318.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.44:80
AN-X-Request-Uuid: f621e1ab-af4a-42b9-af7f-62ddb7875dae
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 404
Not Found 24 Show response
web.hb.ad.cpe.dotomi.com/s2s/header/ 678 B
878 B 14ms
14ms XHR
text/plain 2a02:fa8:8806:12::1430
VCLK-EU-

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Dec 2019 16:03:07 GMT
Cache-Control: max-age=0, no-store
Server: nginx
Connection: keep-alive
Content-Length: 678
Content-Type: text/plain; charset=UTF-8

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
66 B 113ms
113ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Tue, 03 Dec 2019 16:03:07 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=136aafd9e6d1e133;misc=1575388987634; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ 945 B
1 KB 166ms
165ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146915/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=136aafd9e6d1e133;misc=1575388987634;
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: e19600d4174eedb41b49877e1487c52d5176855f8b7574268ebdd525e7304ca2

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=137f6b952f6d70b9;misc=1575388987634; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ 945 B
1 KB 176ms
175ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146916/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=137f6b952f6d70b9;misc=1575388987634;
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 93277b2b6c0c1418a963e10ac33adab0f1bd4b3e971aea2febea0a841efed3ba

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=1389bf5a58f628e1;misc=1575388987634; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ 945 B
1 KB 177ms
176ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=1389bf5a58f628e1;misc=1575388987634;
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 11c49fd8b0e75998066dbeb97e73d1851d447a70a640f06fcc701aecec0a6545

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 200 v2 Show response
i.connectad.io/api/ 97 B
173 B 312ms
311ms XHR
application/json 2606:4700:10::6814:9174
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.connectad.io/api/v2
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:9174 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 464bd0e837c5dcbd6ddeb6c8167f22937bf73d6d4d6f634f8497191d5ca4bfa8

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
alt-svc: clear
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 53f6c4d4c82b5a18-VIE
content-type: application/json
via: 1.1 google

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
610 B 17ms
16ms XHR
application/json 35.156.206.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.36.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tmax=1200

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.206.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-35-156-206-192.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
x-auction-status: 12, 12, 12, 12
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
3 KB 105ms
104ms XHR
application/json 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55%2C57&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tk_flint=pbjs_lite_v2.36.0&x_source.tid=75768338-26ae-4f0a-a849-36bc66fb51fc&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5577016936318289
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 91aab4ca16c777cf1bfcf7525e01df9c4968d84366dd2b36b8813b49b4d9b387

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=361
Content-Length: 1518
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 10ms
10ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=12483756637f7d07&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 9ms
8ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=wDH8n844o8J5LF7qDwHQ7sj5&bidId=125b6f40bd986801&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 9ms
8ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=L7rKdgz52e7UZ4fMkwkYmaxf&bidId=1267e4e9e979fd32&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H2 200 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
318 B 110ms
110ms XHR
application/javascript 52.4.163.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=-60&buster=1575388987635&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&measurable=true&bids[0][bidId]=128ff03dae8c6131&bids[0][config][property]=5c3404d83e048a00261ad27f&bids[0][config][zone]=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[0][sizes][2][width]=970&bids[0][sizes][2][height]=250&property=5c3404d83e048a00261ad27f&foo
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.163.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-163-43.compute-1.amazonaws.com
Software: / Express
Resource Hash: acd199754b7137704f41bc7d1cf75b688b6f9d06968e250d33465b2fad8b8942

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
status: 200
x-powered-by: Express
etag: "-1860372469"
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 140 B
990 B 20ms
20ms XHR
application/json 185.33.223.202
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.202 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

310d068013f9637d3200d35a53db75bee9b3ccfaa990401cfa6c8a0be98db2ab

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
X-Proxy-Origin: 185.151.58.114; 185.151.58.114; 318.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.187:80
AN-X-Request-Uuid: f6815a99-be73-4f39-83c0-24ee9ee4b55d
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 140
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
413 B 40ms
39ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?pv=7fa76a4b-6d92-49b2-bfe9-f57e73cd36ac&si=14287&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f27cf7c85ec69a44e44258bd12c07939cc9c715c895527813609e482035b3300

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
413 B 40ms
40ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?pv=7fa76a4b-6d92-49b2-bfe9-f57e73cd36ac&si=14288&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f27cf7c85ec69a44e44258bd12c07939cc9c715c895527813609e482035b3300

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H2 200 arj Show response
freestar-d.openx.net/w/1.0/ 175 B
364 B 240ms
240ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&jr=&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_2.1.9&dddid=75768338-26ae-4f0a-a849-36bc66fb51fc&nocache=1575388987637&x_gdpr_f=1&pubcid=d862d9f9-b42a-4af7-bb11-d2d39ef84547&aus=728x90%2C970x90%2C970x250&divIds=bleepingcomputer_728x90_970x90_970x250_320x50_BTF&auid=539181725&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash: 6b98669bc613fd85ff709aa32076df4ef0097c2d0716426f71d7fd8d0ffd50f9

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
via: 1.1 google
server: OXGW/16.167.2
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 175
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
376 B 52ms
52ms XHR
text/javascript 13.225.86.250
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&pid=DXUBmyAhWdU7t&cb=2&ws=1600x1200&v=7.44.02&t=1000&slots=%5B%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F15184186%2Fbleepingcomputer_728x90_320x50_InContent_2%22%7D%5D&cfgv=0&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.86.250 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-86-250.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA2-C2
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 2ugBqREVsYW_bakiXBemvygZfSe0FY_04h9LluiDZQ-shnwZxG3F4A==

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 8128 0
0 17ms
17ms Fetch
image/gif 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuW0KsAbrXANnp5JF66sAH1pbuKK5eopkHCnlWjFRiqgFVVdn6jXgeP1ETWBY1-380CgMcs0RYe_DQzT2_A3dYLxza6zp6sJ7DFKoXRLfw42iNoIxa-BDJLohx1DyPfvrYBdergB_26OmwGOdSX6v57zSgLeXeZXBTlusxZ9fylEWzOexiRsFfu8cJpMYHGU8xbUzJCz-DTsSgLB13vRgFqpjuJ4-8HK2g0K0ngJBfy5LBlDMk5mEatEZvkjW6i8O0YOTqKi8LCeuROBfd5lVHuAeDbcl0Maake-fKfTwQX8LZJ&sai=AMfl-YQ24NWbUd5tBNhg9x-bkyRcSDmjQLHH3cCKRnvUJGNc2XG3Aa6QReKysOmMKgNg6PkiHsckYQgdH_yAbgylVeog3-Bvts18kZk38_vdmw&sig=Cg0ArKJSzPFwZj_WfJygEAE&urlfix=1&adurl=

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Dec 2019 16:03:07 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8128 76 KB
29 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e48c4975b293be404aa17aca3844095d270597494ffabe5316cad8c3e45d5004

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1573858490126243"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29138
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 78 KB
29 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0e946b0ee0337cf23c845f67a238e1fefd5f1e014fdbd8ea27870172fcedd40f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1573858490126243"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29338
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 15816820026251592773
tpc.googlesyndication.com/simgad/ Frame 7CB5 44 KB
44 KB 8ms
7ms Image
image/gif 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15816820026251592773

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0d848ce732e0944faee4acb27d45bbe47cb1930bfcbe8888eb77b16a13f44517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 19 Nov 2019 09:10:17 GMT
x-content-type-options: nosniff
age: 1234370
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 45323
x-xss-protection: 0
last-modified: Tue, 30 Jul 2019 13:27:51 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Nov 2020 09:10:17 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7CB5 2 KB
3 KB 7ms
6ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 02 Dec 2019 23:33:42 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 59365
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Tue, 03 Dec 2019 23:33:42 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7CB5 295 B
426 B 6ms
6ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 02 Dec 2019 21:53:21 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 65386
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Tue, 03 Dec 2019 21:53:21 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7CB5 0
0 19ms
18ms Image
text/html 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CJbJbO4fmXezMEMftgAefpYroD9KolOJXuOm31oEKv87z_QgQASDa18U5YJXaiIKYB6AB_dGx8wLIAQOpAiEvaIqMmLI-4AIAqAMByAMIqgS0Ak_QDy7-kep3fTKsHedjxC82b94ZM0G5KahufL-qK1I4ZBCGc84PsvWQBWqSeiDNGfhGDQ8JRk8lLurkdg8jOYBCjsTHLLs6IvS0p-Utx9c0Qn86nophTTFG1n-QPTMGEAoGx9zBhEwT0TVNF1qJspOBWOoFO9pVTs9tw5EdQUr6hTwSWDRkhczwVQpipTPuwsDUmqKrJSVhrz7njCTlm-r0_WgoPAWY3e6eOB2ELu1I7MqiH4d4ZgWG5-09d7BXzOA24oMlu17zbbK8QsUinVKKEQ-31-lfm87R_qAm95FNDRmulBswhvggL_mVHDEb2Kg7bB6JD7IFQgpZ3_5a-RyVWqrdZgI14XwJWwlbTajto6n9Uv23NXrBfd2hU6kDejkAad5jE4xnlcbetDeTAikuLqIIwAS35MmAmQLgBAGgBgOAB-utzowBqAeOzhuoB9XJG6gHk9gbqAe6BqgH2csbqAfPzBuoB6a-G6gH7NUb2AcB8gcEEMTrB9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA9gTAw&sigh=1WZSUT8b4wI&tpd=AGWhJmsKUPPAZrmIOl4AvrOAjTDL3LI5tl9TAUS8FTrSIlF7yg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s16-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 17ms
17ms XHR
text/plain 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53f6c4d4ebef9772-FRA
access-control-allow-headers: origin, content-type

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 7CB5
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

38ms
38ms

Image
text/html

2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Tue, 03 Dec 2019 16:03:07 GMT
x-content-type-options: nosniff
server: safe
location: https://googleads.g.doubleclick.net/pagead/drt/si
content-type: text/html; charset=UTF-8
status: 302
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

POST
H/1.1 404
Not Found 24 Show response
web.hb.ad.cpe.dotomi.com/s2s/header/ 678 B
878 B 12ms
12ms XHR
text/plain 2a02:fa8:8806:12::1430
VCLK-EU-

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/s2s/header/24
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1430 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 03 Dec 2019 16:03:07 GMT
Cache-Control: max-age=0, no-store
Server: nginx
Connection: keep-alive
Content-Length: 678
Content-Type: text/plain; charset=UTF-8

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 26 B
813 B 145ms
144ms XHR
application/json 95.100.197.53
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=393562&v=7.2&r=%7B%22id%22%3A%22144b460bc214dfca%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22145120fff482e1a4%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.197.53 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-197-53.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 426f10b0db653307653e893e190b840807af13366cc9ea48ddaf29d9209e7eeb

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 46
Expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
318 B 107ms
107ms XHR
application/javascript 52.4.163.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=-60&buster=1575388987770&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&measurable=true&bids[0][bidId]=147a4af727fc615d&bids[0][config][property]=5c3404d83e048a00261ad27f&bids[0][config][zone]=bleepingcomputer_728x90_320x50_InContent_2&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&property=5c3404d83e048a00261ad27f&foo
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.163.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-163-43.compute-1.amazonaws.com
Software: / Express
Resource Hash: acd199754b7137704f41bc7d1cf75b688b6f9d06968e250d33465b2fad8b8942

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
status: 200
x-powered-by: Express
etag: "-1860372469"
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
66 B 231ms
231ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Tue, 03 Dec 2019 16:03:07 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.bleepingcomputer.com

POST
H2 200 v2 Show response
i.connectad.io/api/ 96 B
173 B 199ms
199ms XHR
application/json 2606:4700:10::6814:9174
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://i.connectad.io/api/v2
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:9174 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f60c321fe29240646caaa6ad5c1368266cd545b6ac48c22636434828d3422e5

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
alt-svc: clear
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 53f6c4d5988a5a18-VIE
content-type: application/json
via: 1.1 google

OPTIONS
H2 204 v1 Show response
dmx.districtm.io/b/ 0
40 B 39ms
39ms XHR
text/plain 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Access-Control-Request-Method: POST
Origin: https://www.bleepingcomputer.com
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: https://www.bleepingcomputer.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
status: 204
access-control-max-age: 14400
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53f6c4d5988a96a4-FRA
access-control-allow-headers: origin, content-type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 140 B
990 B 24ms
23ms XHR
application/json 185.33.223.202
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.202 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

5efbdf536fc0f21fcbb9aa20ba96f679f3cdfc42a75a1d2bbbce17807ee252d7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
X-Proxy-Origin: 185.151.58.114; 185.151.58.114; 318.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.142:80
AN-X-Request-Uuid: 73291478-4560-4e28-a6da-fda415ca2676
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 140
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ADTECH;v=2;cmd=bid;cors=yes;alias=17397f5567db664c;misc=1575388987772; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ 945 B
1 KB 195ms
195ms XHR
application/json 152.199.21.89
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/11751.1/5146917/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=17397f5567db664c;misc=1575388987772;
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.21.89 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 99d6ac74dfaffcb926b9e878fd75a12d032bd1bab5bd9fed54c9ac9dd599ba57

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 945
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 123 B
413 B 36ms
36ms XHR
application/json 52.214.34.242
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?pv=7fa76a4b-6d92-49b2-bfe9-f57e73cd36ac&si=14287&pi=3&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ns=10240&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.214.34.242 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-214-34-242.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f27cf7c85ec69a44e44258bd12c07939cc9c715c895527813609e482035b3300

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 8ms
8ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=GrVComq83JzCSLK1pi9waoyR&bidId=161cb8f5ab5e792e&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H/1.1 204
No Content v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
168 B 9ms
8ms XHR
text/plain 3.120.201.254
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1?placement_key=Ggh1aXSgpQAvBpkxoyAsBJPd&bidId=1627712381027fca&consent_required=false&instant_play_capable=true&hbSource=prebid&hbVersion=2.36.0&strVersion=3.1.0&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.201.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-120-201-254.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin

GET
H2 200 arj Show response
freestar-d.openx.net/w/1.0/ 175 B
360 B 125ms
125ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&jr=&ch=windows-1252&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_2.1.9&dddid=d9a18e86-093a-468d-ab6c-e596a49a4555&nocache=1575388987772&x_gdpr_f=1&pubcid=d862d9f9-b42a-4af7-bb11-d2d39ef84547&aus=728x90&divIds=bleepingcomputer_728x90_320x50_InContent_2&auid=539181725&
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash: e87d99ca8178aa39473798dc91c8dad28257c7c1380123c9250a8b8090047acb

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
via: 1.1 google
server: OXGW/16.167.2
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 175
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
562 B 17ms
17ms XHR
application/json 35.156.206.192
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.36.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tmax=1200

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.206.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-35-156-206-192.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:07 GMT
x-auction-status: 12
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 43ms
43ms XHR
application/json 185.33.223.202
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.202 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

318.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

b93396cad1138a379d441b4e03e9bb5156ad04207ec2eb6842564b85f2917c28

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
X-Proxy-Origin: 185.151.58.114; 185.151.58.114; 318.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.40:80
AN-X-Request-Uuid: 87e99fd5-1701-46e0-9519-97625e287374
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
1 KB 74ms
73ms XHR
application/json 69.173.144.140
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&tk_flint=pbjs_lite_v2.36.0&x_source.tid=d9a18e86-093a-468d-ab6c-e596a49a4555&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.06685008848702356
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: d89aa20de1d78f110f7f70d1f1e60a731ffcaf1bd753748f94bff673d9a74b65

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:07 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=425
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 16ms
15ms XHR
text/plain 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 03 Dec 2019 16:03:07 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53f6c4d5dd189772-FRA
access-control-allow-headers: origin, content-type

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
3 KB 267ms
267ms XHR
text/plain 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3547729954264097&correlator=3380395257919349&output=ldjh&impl=fifs&adsid=NT&eid=21064550%2C21065138&vrg=2019111801&guci=1.2.0.0.2.2.0.0&plat=1%3A67108864%2C2%3A67108864%2C8%3A67108864&sc=1&sfv=1-0-36&ecs=20191203&iu_parts=15184186%2Cbleepingcomputer_728x90_970x90_970x250_320x50_BTF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90%7C970x250&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2%26freestar_path%3D%252Fforums%252Ft%252F696187%252Finfected-with-cloudnet-epicnet-bitcoin-miner%252F%26freestar_domain%3Dbleepingcomputer.com%26fs_safeframe%3Dfalse%26custom_bidder_size%3Dopenx_970x250%26hb_format%3Dbanner%26hb_size%3D970x250%26hb_pb%3D0.13%26hb_adid%3D92fec5bdf504ec9%26hb_bidder%3Dopenx&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1575388987&dt=1575388987951&dlt=1575388985261&idt=459&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=34105&adks=976516616&ucis=5&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&dssz=87&icsg=17592119627712&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1392x105&msz=1392x90&psts=CigI7by9nRLoAf7Q9oSDBIICDfrd4Qby3uEGkK7chFHRAikJDhkLmJTe&ga_vid=678002882.1575388985&ga_sid=1575388987&ga_hid=2138188376&fws=4&ohw=1600

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

57b8974b7aa2619a286afb111fed2f317357ae880ec058b2a01b41e9e15ce96e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2433
x-xss-protection: 0
google-lineitem-id: 4721360308
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138237452898
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 42 KB
10 KB 422ms
422ms XHR
text/plain 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3547729954264097&correlator=3380395257919349&output=ldjh&impl=fifs&adsid=NT&eid=21064550%2C21065138&vrg=2019111801&guci=1.2.0.0.2.2.0.0&plat=1%3A67108864%2C2%3A67108864%2C8%3A67108864&sc=1&sfv=1-0-36&ecs=20191203&iu_parts=15184186%2Cbleepingcomputer_728x90_320x50_InContent_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=user-agent%3DChrome&cookie_enabled=1&bc=31&abxe=1&lmt=1575388988&dt=1575388988004&dlt=1575388985261&idt=459&frm=20&biw=1600&bih=1200&oid=3&adxs=524&adys=1141&adks=1808008496&ucis=6&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&dssz=87&icsg=17592119627712&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1177x152&msz=1177x90&psts=CigI7by9nRLoAf7Q9oSDBIICDfrd4Qby3uEGkK7chFHRAikJDhkLmJTe&ga_vid=678002882.1575388985&ga_sid=1575388987&ga_hid=2138188376&fws=4&ohw=1600

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

6404b8cdbb463b8b37ad13570c8a56a5c6aad1b5f37f41ce0255aae77e5cecb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com

Response headers

date: Tue, 03 Dec 2019 16:03:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 10103
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bleepingcomputer.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK c Show response
c.pub.network/ 36 B
527 B 473ms
127ms XHR
text/plain 35.226.36.58
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://c.pub.network/c
Requested by: Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.226.36.58 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 58.36.226.35.bc.googleusercontent.com
Software: /
Resource Hash: cbc408797a84f8b8ef5d143f0917100740761c6f48af19235c22a65303fd229a

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Origin: https://www.bleepingcomputer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.bleepingcomputer.com
Date: Tue, 03 Dec 2019 16:03:08 GMT
Access-Control-Allow-Credentials: true
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Length: 36
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Content-Type: text/plain;charset=utf-8

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 339F 0
0 20ms
20ms Fetch
image/gif 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuDCHbW04qS6duCklOU2LzY-SaCkJ7BEXTh4OOGUEuGVoyPo-W1n2Am63sX6Dccycjd2UMOayOVGFi7Ukbvt1F5Lrx_uBaN_QpsZppTcZvIETorhBtxlCeRCcdt3p0i36XfFwjPhixFoaUpwo9n-ZPhOtiuHaIA1SRsWNxVbihFoLKxJ4vKJhtZDdgX8-O1hzRPHrsw1HrSH6vGNoowIEz0s-57vQ6kdsu4rebwPCy1ZDyGHc4rPXAgl2vsyDPS6_wY1ho1o3WbjAnrWbvVfJtAal7T0niNVfgiYRHWer2B8Z2-RrFKyjmOqm4oVqfI5-20wR3BIGU&sai=AMfl-YQYGC4c9y3_bGM9jlxVz6ylL9UETv-UC2IcytK5rduXrlHFTUvq5QVMREGvXJqHC8i5DRj42_AXBrtezBGyrMzUXS_6-jiFrDaCmmV9&sig=Cg0ArKJSzMJJprVmEoINEAE&urlfix=1&adurl=

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 03 Dec 2019 16:03:08 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:08 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 339F 3 KB
3 KB 53ms
15ms Script
application/x-javascript 185.29.133.223
MediaMath Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?id=5aW95q2jLzIwLyAvTVdWallqaGtNREV0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzU3NTk2OTkzNzUzODE2MzAwMTEvNjYyMjY5My80NTYyMzk1LzUvSDA3dmd6MGxZTnNYREVLN240WDY4YmNmcWczanc3QlR5TnZESHA2SDR2Zy8xLzUvMC8wLzk1NjgwMy8zMTEzNjk1ODU4LzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC81NzU5Njk5Mzc1MzgxNjMwMDExL3pyaC8wLzUzMTAvNzEvOTk5LzQwLzE4NS4xNTEuNTguMC8wLjAwMC8xNTc1Mzg4OTg3Lw/ojiDM1Y4Fz9BB0Ap0A4WNYAH2s0&nodeid=1343&auctionid=5759699375381630011&exch=opx&sid=4562395&cid=6622693&price=AAABbsyAP9g3DtTHrnnFCtR1wMQWWyAasdni_w&act=LiIiJiQocHxrPSwuJCMqcHxrKy5wfGshIioqJCMqcHxrOiwkOQsiPwQgPQMiOSQrcH0&group=eu&bp=a_bgaaac&3pck=https%3A%2F%2Ffreestar-d.openx.net%2Fw%2F1.0%2Frc%3Fai%3D624ed02f-0feb-43e6-becf-201a57adbf98%26ts%3D2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA%26r%3D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.223 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: MMBD/3.160.0 /
Resource Hash: 7467421fd2832a0116d5e60da661e47b20bbe46992afb46cb1061ad372de13a9

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:08 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1575388987
Last-Modified: Tue, 03 Dec 2019 16:03:07 GMT
Server: MMBD/3.160.0
x-mm-latency: 1 (1)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: count
Cache-Control: no-cache
x-mm-host: zrh-router-x36, zrh-bidder-x118
Connection: close
x-mm-pending-bid-state: eyJOb3RpZnlUeXBlIjoid2ViIiwiUEJEYXRhU291cmNlIjoiUEJDIiwiV2FpdEZvcldlYiI6ZmFsc2UsIldhaXRGb3JJbXAiOmZhbHNlLCJXYWl0Rm9yQ2siOnRydWUsIlBCU3RhdGUiOiJXaW4iLCJEdXBOb3RpZnkiOmZhbHNlLCJCaWRDbGFpbWVkIjpmYWxzZSwiUEJTV29ya2VkIjpmYWxzZSwiUEJTV2luUGF5bG9hZCI6IiJ9
Content-Type: application/x-javascript; charset=UTF-8
Expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 ri
ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ Frame 339F 43 B
111 B 21ms
20ms Image
image/gif 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ri?ai=624ed02f-0feb-43e6-becf-201a57adbf98&ph=89b2e804-9392-4144-aae0-0555f3960da4&ts=2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:08 GMT
via: 1.1 google
server: OXGW/16.167.2
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 339F 76 KB
29 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e48c4975b293be404aa17aca3844095d270597494ffabe5316cad8c3e45d5004

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1573858490126243"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29138
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:08 GMT

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 339F 68 B
345 B 305ms
13ms Image
image/png 3.123.66.234
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_ZHZTOThJS3dEdWtjRzZnUERZQkJjQ2s5c0tZL29wZW54Ojk3MHgyNTA=&v=5&s=v31dr680gq7&id=eyJwcmViaWQiOnsiYWRJZCI6IjkyZmVjNWJkZjUwNGVjOSIsImNwbSI6MC4xMzV9fQ%3D%3D&sb=0&cb=9923930&h=www.bleepingcomputer.com&d=eyJ3aCI6IlpIWlRPVGhKUzNkRWRXdGpSelpuVUVSWlFrSmpRMnM1YzB0WkwyOXdaVzU0T2prM01IZ3lOVEE9Iiwid2QiOnsiayI6eyJoYl9iaWRkZXIiOlsib3BlbngiXSwiaGJfc2l6ZSI6WyI5NzB4MjUwIl19fSwid3IiOjB9
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.66.234 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-123-66-234.eu-central-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:08 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK hjrt81ypcuia Show response
hal9000.redintelligence.net/zone/ Frame 339F 10 KB
3 KB 1038ms
13ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/hjrt81ypcuia?subid=&rnd=5759699375381630011&extVar[]=DOUBLEBORDER:1&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D5759699375381630011%26mt_id%3D6622693%26mt_adid%3D216536%26mt_sid%3D4562395%26mt_exid%3D5%26mt_inapp%3D0%26mt_uuid%3D10155de6-873c-4801-b8d0-7559696824f4%26mt_3pck%3Dhttps%253A%2F%2Ffreestar-d.openx.net%2Fw%2F1.0%2Frc%253Fai%253D624ed02f-0feb-43e6-becf-201a57adbf98%2526ts%253D2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA%2526r%253D%26redirect%3D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 9c9489fdf1b9876f445b862d720da55ea50131e372c9de9692be0fca4d5d5c71

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:09 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3271
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 339F 43 B
360 B 25ms
24ms Image
image/gif 2.18.233.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=5&v2=5759699375381630011&v3=651871&v4=4562395&v5=6622693&mt_nsync=1&no_attr=1
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.201 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-201.deploy.static.akamaitechnologies.com
Software: MT3 1913 979072d master zrh-pixel-x19 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:08 GMT
Server: MT3 1913 979072d master zrh-pixel-x19
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 339F 49 B
330 B 36ms
13ms Image
image/gif 185.29.133.223
MediaMath Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=opx&bid=5759699375381630011&st=4562395&time=1575388988&nodeid=1343
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.223 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: MMBD/3.160.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:08 GMT
Server: MMBD/3.160.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x25, zrh-bidder-x118
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Tue, 03 Dec 2019 16:03:07 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/011911070201440/ Frame 8C28 200 KB
54 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7a52d4e3f541e459f9069f6f596242684704eeaca5a95f05285d16e2e609927d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9444
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 55611
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:25:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d3c4309c2c9fce1d"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:25:44 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 8C28 15 KB
6 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f6b7ba3cc9a8177d62950984426ff73450f229d389c449b0631392be2f5b5b61

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9604
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5592
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:23:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9ac5c138bfec1b90"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:23:04 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 8C28 151 KB
40 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e4ad56bd91f08203b208a3db86c463c7952fad443a239de6454c73b7ce669657

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9444
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 41358
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:25:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ed96f4a845755c74"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:25:44 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 8C28 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3c10cb1ddf712f08a5082f5759b9496c250d195a9e6746e2ab0088b52775b21e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9614
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1402
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "49ed1549bef9ee2d"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:22:54 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/011911070201440/v0/ Frame 8C28 44 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:815::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011911070201440/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

71dae7cc7766c98bdc4b766789af22fe0442d58aced342736f044ec12aaba058

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 9614
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14180
x-xss-protection: 0
server: sffe
date: Tue, 03 Dec 2019 13:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "15a9b640489a7720"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Dec 2020 13:22:54 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 8C28 4 KB
688 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:820::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

efe95cb2cc312e0132b0ce914c642ecee0534223df3f1d47579cdabe6cc070cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 03 Dec 2019 16:03:08 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 03 Dec 2019 16:03:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 03 Dec 2019 16:03:08 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8C28 2 KB
3 KB 6ms
5ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 02 Dec 2019 23:33:42 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 59366
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Tue, 03 Dec 2019 23:33:42 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8C28 295 B
368 B 6ms
6ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 02 Dec 2019 21:53:21 GMT
x-content-type-options: nosniff
content-type: image/png
server: cafe
age: 65387
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Tue, 03 Dec 2019 21:53:21 GMT

GET
DATA 200
OK truncated
/ Frame 8C28 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1a351df56f9cdaea197422d834f4063cc3780d5ec28d6c3f8ad40a36cd35777d

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 8C28 0
0 19ms
18ms Image
text/html 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Ci7mfPIfmXeD4DJPtgAfByI3QDbuYjJlak-DZu98KwI23ARABINrXxTlgldqIgpgHoAGZ__rUA8gBAeACAKgDAcgDCqoErQJP0Gj8sMz97Nv7d9Vtr9KdxbwEWkHTluURSwMbj3tOzZuvccBnyg89uAGEliPRMhmf4dePnuDm3Sp86ks_H37v3mDDzRXYAzslPg6Axi3YOW5_WZjpDXAPKLK7iWdvFrpsXVWVvOywwwLnkB9mDu3L1gkrlRQR0ZcXiaIAEVFV3uZPi1jcLaAgL_Qm6xQuFy0vhxi_H3yM6z4cN9R_H5TyyV24AWjxyu08vvG7Jt-Zpx1z-cnhsUA3mh3VUH6hxu9-XVOP5oX3uAJb9iZ2275a6lN63-qBHeHCORJbGdGRppIsh9KLYnNx8YHpBJJI6Q_TMLsiie5aCfB13IppKJaeY9ViEQLwt2CYZXlm2PWe3s3EUHYzKM8dz1OXdcWm8pN58jFB8OBJB45JrfBCwATYhPilvALgBAGSBQQIBBgBkgUECAUYBIAHz4CFK6gHjs4bqAfVyRuoB5PYG6gHugaoB9nLG6gHz8wbqAemvhuoB-zVG9gHAfIHBBCE9gTSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTE3NDIyNDk2MDMyODkwODOACgPYEwyIFAE&sigh=fIY20lUFE0k&tpd=AGWhJmvJBs6tua53ZAPQNhm_aDEvR90L8CzTSaCUIBs_nQhBFg
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s16-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 8C28
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

38ms
38ms

Image
text/html

2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date: Tue, 03 Dec 2019 16:03:08 GMT
x-content-type-options: nosniff
server: safe
location: https://googleads.g.doubleclick.net/pagead/drt/si
content-type: text/html; charset=UTF-8
status: 302
cache-control: private
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 246
x-xss-protection: 0

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 8C28 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500
Origin: https://www.bleepingcomputer.com

Response headers

date: Thu, 21 Nov 2019 20:40:07 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 1020181
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11056
x-xss-protection: 0
expires: Fri, 20 Nov 2020 20:40:07 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 8C28 11 KB
11 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500
Origin: https://www.bleepingcomputer.com

Response headers

date: Thu, 21 Nov 2019 15:36:21 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 1038407
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11016
x-xss-protection: 0
expires: Fri, 20 Nov 2020 15:36:21 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7CB5 0
0 19ms
19ms Image
text/html 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CG2cGO4fmXezMEMftgAefpYroD9KolOJXuOm31oEKv87z_QgQASDa18U5YJXaiIKYB6AB_dGx8wLIAQOpAiEvaIqMmLI-4AIAqAMBqgS0Ak_QDy7-kep3fTKsHedjxC82b94ZM0G5KahufL-qK1I4ZBCGc84PsvWQBWqSeiDNGfhGDQ8JRk8lLurkdg8jOYBCjsTHLLs6IvS0p-Utx9c0Qn86nophTTFG1n-QPTMGEAoGx9zBhEwT0TVNF1qJspOBWOoFO9pVTs9tw5EdQUr6hTwSWDRkhczwVQpipTPuwsDUmqKrJSVhrz7njCTlm-r0_WgoPAWY3e6eOB2ELu1I7MqiH4d4ZgWG5-09d7BXzOA24oMlu17zbbK8QsUinVKKEQ-31-lfm87R_qAm95FNDRmulBswhvggL_mVHDEb2Kg7bB6JD7IFQgpZ3_5a-RyVWqrdZgI14XwJWwlbTajto6n9Uv23NXrBfd2hU6kDejkAad5jE4xnlcbetDeTAikuLqIIwAS35MmAmQLgBAGgBgOAB-utzowBqAeOzhuoB9XJG6gHk9gbqAe6BqgH2csbqAfPzBuoB6a-G6gH7NUb2AcB8gcEEMTrB9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA9gTAw&sigh=rj0Wo3zC9cU&vt=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra15s16-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7CB5 42 B
116 B 16ms
16ms Image
image/gif 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsulv1WOn99WTg2ptlIfOv4NCbl0jW_3tLssyQvzifX5niHJC4rJaw0aLdEQbWU52p20Ehqm5hrLYkhfFZ162-qj0z3pF8vfJ8-kESlOyZliQc8B9G1LDoVgIuXovQ&sai=AMfl-YTZMaVnmKSYAq35fZE9Bs2j-r6d4YyYIOtshtdfSR-3ZM4vceJYkLWGxgF2M8iUjmzo-of8liviM3dUbrGDD20M_a4ZNw5hccXsTzYn-Q&sig=Cg0ArKJSzKo7xxirTsiREAE&id=ampim&o=436,267&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=114&tls=1114&g=100&h=100&tt=1115&r=v&adk=960084856&avms=ampa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:08 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal90004.redintelligence.net/ Frame 339F
Redirect Chain

https://hal90004.redintelligence.net/request.php?zone=hjrt81ypcuia&nw=20&renderingType=javascript&namespace=9fea2c57c4&subid=&uid=6ccdbb4c0b3fbe07&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90004.redintelligence.net/request.php?zone=hjrt81ypcuia&nw=20&renderingType=javascript&namespace=9fea2c57c4&subid=&uid=6ccdbb4c0b3fbe07&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

91ms
68ms

Script
application/x-javascript

138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=hjrt81ypcuia&nw=20&renderingType=javascript&namespace=9fea2c57c4&subid=&uid=6ccdbb4c0b3fbe07&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D5759699375381630011%26mt_id%3D6622693%26mt_adid%3D216536%26mt_sid%3D4562395%26mt_exid%3D5%26mt_inapp%3D0%26mt_uuid%3D10155de6-873c-4801-b8d0-7559696824f4%26mt_3pck%3Dhttps%253A%2F%2Ffreestar-d.openx.net%2Fw%2F1.0%2Frc%253Fai%253D624ed02f-0feb-43e6-becf-201a57adbf98%2526ts%253D2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA%2526r%253D%26redirect%3D&documentReferer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ancestorOrigins=https%3A%2F%2Fwww.bleepingcomputer.com&random=6536043684635&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 Heppenheim an der Bergstrasse, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 6b47306803e5abe44045a784487ad41b6d3dcb480ed997ae56d43c5241ca8900

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 37413000118387000951579011066004
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1253
Expires: Tue, 03 Dec 2019 16:03:09 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=hjrt81ypcuia&nw=20&renderingType=javascript&namespace=9fea2c57c4&subid=&uid=6ccdbb4c0b3fbe07&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D5759699375381630011%26mt_id%3D6622693%26mt_adid%3D216536%26mt_sid%3D4562395%26mt_exid%3D5%26mt_inapp%3D0%26mt_uuid%3D10155de6-873c-4801-b8d0-7559696824f4%26mt_3pck%3Dhttps%253A%2F%2Ffreestar-d.openx.net%2Fw%2F1.0%2Frc%253Fai%253D624ed02f-0feb-43e6-becf-201a57adbf98%2526ts%253D2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA%2526r%253D%26redirect%3D&documentReferer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F&ancestorOrigins=https%3A%2F%2Fwww.bleepingcomputer.com&random=6536043684635&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Tue, 03 Dec 2019 16:03:09 +0100

GET
H2 200 htlp-webgains
www.11teamsports.com/de-de/ Frame F5AE 0
0 67ms
34ms Document
text/html 2606:4700::6810:a727
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.11teamsports.com/de-de/htlp-webgains
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a727 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.11teamsports.com
:scheme: https
:path: /de-de/htlp-webgains
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:09 GMT
content-type: text/html
content-length: 0
set-cookie: __cfduid=d18ab81b24a75f1692bedf612915da1df1575388989; expires=Thu, 02-Jan-20 16:03:09 GMT; path=/; domain=.11teamsports.com; HttpOnly wgPostView=true; Expires=Wed, 04 Dec 2019 16:03:09 GMT; Path='/'; Domain=.11teamsports.com;
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 53f6c4e0bf4b59fa-VIE

GET
H/1.1

200
OK

onepixel.gif
ad.zanox.com/ppv/images/ Frame 7186
Redirect Chain

https://ad.zanox.com/tpv/?45475836C666538628T&zpar0=37413000118387000951579011066004
https://pb.media01.eu/view.aspx?trackid=91C09AA007C123F60FDC6F5FD61F1F1B&dt_subid1=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dt_subid2=&actionid=879111&produ...
https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dyn_id=

0
0

32ms
22ms

Document
image/gif

195.216.249.67
ZANOX

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dyn_id=
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.216.249.67 , France, ASN47268 (ZANOX, FR),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash

Request headers

Host: ad.zanox.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Cookie: zttpvc=5C356900S2636976633223298049T0II5C332956S2636976633223298048T0II45475836C0SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049; zptpvc=5C356900S2636976633223298049T0II5C332956S2636976633223298048T0II45475836C0SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Content-Type: image/gif
Last-Modified: Thu, 04 May 2000 17:04:38 GMT
Accept-Ranges: bytes
ETag: "09764d4eab5bf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
jobs-at-zanox: https://www.zanox.com/jobs/international
Date: Tue, 03 Dec 2019 16:03:41 GMT
Content-Length: 43
Via: 10.30.0.118%1
Vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Tue, 03 Dec 2019 05:03:07 GMT
Location: https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq73216458132957245753037036536240yb5yb7T2636976633223298049&dyn_id=
Server: Microsoft-IIS/8.5
Set-Cookie: ASP.NET_SessionId=dpvinrw5u0f22idgmzk4j43f; path=/; HttpOnly DTU=03AF31B08D07E122297201C256E0D3BE; expires=Fri, 03-Dec-2021 16:03:07 GMT; path=/
P3P: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Tue, 03 Dec 2019 16:03:07 GMT
Content-Length: 0

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 339F 12 KB
12 KB 189ms
105ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&viewref=37413000118387000951579011066004&js=1&nw=1
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: a9637bcfaf8b95a3439eb4d57868b06c37f5b172327366d5086967a366ccd153

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
Last-Modified: Tue, 03 Dec 2019 16:03:09 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 339F 43 B
621 B 48ms
33ms Image
image/gif 104.90.154.57
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.awin1.com/cshow.php?s=2519563&v=14098&q=368694&r=296283&pref1=37413000118387000951579011066004&pv=1
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.90.154.57 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-90-154-57.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:09 GMT
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H/1.1

200
OK

onepixel.gif
ad.zanox.com/ppv/images/ Frame 339F
Redirect Chain

https://ad.zanox.com/ppv/?45475836C666538628&zpar0=37413000118387000951579011066004
https://ad.zanox.com/ppv/images/onepixel.gif

43 B
460 B

65ms
22ms

Image
image/gif

195.216.249.67
ZANOX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.zanox.com/ppv/images/onepixel.gif
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.216.249.67 , France, ASN47268 (ZANOX, FR),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 73e88dfcd0f3a535341fb641c5400fcf772ffe36c628241104f829d3cf48e29b

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:41 GMT
Via: 10.30.0.118%1
ETag: "09764d4eab5bf1:0"
Last-Modified: Thu, 04 May 2000 17:04:38 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
jobs-at-zanox: https://www.zanox.com/jobs/international
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

Redirect headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:41 GMT
Via: 10.30.2.140%1
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
Location: https://ad.zanox.com/ppv/images/onepixel.gif
Cache-Control: no-store
Connection: close
Content-Length: 0
jobs-at-zanox: https://www.zanox.com/jobs/international

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 8C28 42 B
116 B 16ms
16ms Image
image/gif 2a00:1450:4001:820::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv50SMY_4q_F_hI7riF0xgsS8MI90YaMj1eBOtGlKB41TrzI9osU18EczjITJOgAATPiOhUTwztNQXHfQLEdpN2myPN0dQrbMpmeq3MZFVC0uzx84g14djSHvan1g&sai=AMfl-YSTIS36rFFMugABVkwrQIMC5bTWItOM7qFtkwOOwzHXgzsgQKuP_pJ2FBl0ipmOQhhhMiGzSicDCsPEFCYB6IjZRUvwDx0pcF8T7eqN&sig=Cg0ArKJSzANqa44y48ldEAE&id=ampim&o=524,1141&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=101&tls=1102&g=65.55555462837219&h=65.55555462837219&tt=1102&r=v&adk=1808008496&avms=ampa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bleepingcomputer.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:09 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clk.min.js Show response
analytics.webgains.io/ Frame 339F 43 KB
13 KB 24ms
7ms Script
application/javascript 2600:9000:21f3:600:9:352d:a240:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/clk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&viewref=37413000118387000951579011066004&js=1&nw=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:600:9:352d:a240:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7dca9338d8f5830b8fbe837cf92eb809f6b54fc7aa7a0037bbf188adf1f37baa

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: py.8fc0V01VATXSxDbR51vVNcNXkUT3E
content-encoding: gzip
last-modified: Thu, 14 Nov 2019 15:44:06 GMT
server: AmazonS3
age: 64304
date: Tue, 03 Dec 2019 15:44:41 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: aMi82oGYiV8mTuQUkFG2GGBN0iM9L7bGNe4ENWJy8aKzpN66o09akQ==
via: 1.1 03d509e8374e9f42668961b5e0201349.cloudfront.net (CloudFront)

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame 339F 79 B
374 B 125ms
54ms Script
text/javascript 81.29.72.47
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=NWa44iFBBNlY5Du4UXuKrnZ2CI9XkPrwXC_JEkNgvlE4yy2XElgebiYMpztNKscKsoUs_43wuZPup_nH2t05oaYAhrcpMxE6DBUr5xj6KkuJCjCBeipa2hvLG9mhORoVidPZW2AUMnGWVQdgMVQdgAYx92u2p.j.2UMnGWFfwMHDCQyG5me6sBLSsbXzU0l6sqKIrGfuzwg9wJ9wPEwHXXTSHCSPmtd0wVYPIG_qvoPfybYb5EvYTrYesS95raaKMPn0qxf7_OLgiPFMtrs1OeyjaY1vSiwuiTtFUoxI6KGI0ljDdYejftckuyPBDjaY2ftckkCoq1HACVddI8uxTrMh9Zpmr.S9RdPQSzOy_Aw7UTlf_01kKHoNv_2U.0Y.KI0K68DJFvQjBzWHzWvTxYMJ5tFFg4K1kl1BNlY6RjLxU..6l5&wgcookie=%7B%22wgifp7121%22%3A%5B%2299582%22%2C%227121%22%2C%222513145%22%2C%22%22%2C%221575388989%22%2C%22https%253A%252F%252Fwww.bleepingcomputer.com%252Fforums%252Ft%252F696187%252Finfected-with-cloudnet-epicnet-bitcoin-miner%252F%22%2C%22%22%2C%22%22%2C%221583164989%22%2C%2237413000118387000951579011066004%22%5D%7D&wgchecksum=cfc2344d26f19edb308bd6572e8f123b&userIP=185.151.58.114&doAffectv=1&wgtime=1575388989
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&viewref=37413000118387000951579011066004&js=1&nw=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.29.72.47 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 81-29-72-47.servers.dedipower.net
Software: Apache /
Resource Hash: 94bdeaea0d33cb654b89540e96e02fe28afceb1624d8ed58f7a43f3609fb4a17

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 03 Dec 2019 16:03:09 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 339F 3 KB
3 KB 518ms
30ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=92886700083723000951571011066036&wglinkid=2513145
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:10 GMT
Last-Modified: Tue, 03 Dec 2019 16:03:10 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 2808
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 339F 12 KB
12 KB 408ms
110ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2919345&wgcampaignid=99582&js=1&viewref=37413000118387000951579011066004
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: de8e423965d43d19ebabb63898f39a34dd779ae7b2598dc90df679f99828998d

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:10 GMT
Last-Modified: Tue, 03 Dec 2019 16:03:10 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 tag Show response
w-it.m-t.io/ Frame 339F 70 B
250 B 51ms
30ms Script
application/javascript 2a00:1450:4001:820::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/tag?type=impr&date=1575388989747
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 267deb4a931743610d9aa55f64ce5947ac2c674924c114e558082b9f5e59d800

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:09 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
x-cloud-trace-context: df7a296b42777b6b8f14780cf94c3092
cache-control: private
content-length: 80

GET
H2 200 track Show response
w-it.m-t.io/ Frame 339F 0
78 B 44ms
44ms Script
application/javascript 2a00:1450:4001:820::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/track?campaignId=99582&clickId=7121_99582_15753889896127_b3431f1d12&programId=7121&expiry=1583164989&acc=wg&scriptTag=&type=postview&indicator=e333982cb4995014968ba9141113523e&
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
x-cloud-trace-context: ce25f24225b1a6d6f5bfbe1a373ffaec
server: Google Frontend
date: Tue, 03 Dec 2019 16:03:09 GMT
content-length: 0
content-type: application/javascript;charset=utf-8

GET
H2 200 tag Show response
w-it.m-t.io/ Frame 339F 70 B
168 B 39ms
39ms Script
application/javascript 2a00:1450:4001:820::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/tag?type=impr&date=1575388990178
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 267deb4a931743610d9aa55f64ce5947ac2c674924c114e558082b9f5e59d800

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Dec 2019 16:03:10 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
x-cloud-trace-context: b8c62a0633fa388951f0f9cdc647e264
cache-control: private
content-length: 80

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame 339F 79 B
267 B 86ms
43ms Script
text/javascript 81.29.72.47
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=.Wa44iFBBNlY5Du4UXuKrnZ2CI9XkPrwXC_JEkNgvlE4yy2XElgebiYMpztNKscKsoUs_43wuZPup_nH2t05oaYAhrcpMxE6DBUr5xj6KkuJCjCBeipa2hvLG9mhORoVidPZW2AUMnGWVQdgMVQdgAYx92u2p.j.2UMnGWFfwMHDCQyG5me6sBLSsbXzU0l6sqKIrGfuzwg9wJ9wPEwHXXTSHCSPmtd0wVYPIG_qvoPfybYb5EvYTrYesS95raaKMPn0qxf7_OLgiPFMtrs1OeyjaY1vSiwuiTtFUoxI6KGI0ljDdYejftckuyPBDjaY2ftckkCoq1HACVddI8uxTrNWpNAR0odm_dhrxbuJjkWxv5iJ3A0KAGYiLy.25.ea1eDHRcWqrTOz1_yL6rgPuVr914VecL57GY5BNv_urfs.ABe&wgcookie=%7B%22wgifp274615%22%3A%5B%2299582%22%2C%22274615%22%2C%222919345%22%2C%22%22%2C%221575388990%22%2C%22https%253A%252F%252Fwww.bleepingcomputer.com%252Fforums%252Ft%252F696187%252Finfected-with-cloudnet-epicnet-bitcoin-miner%252F%22%2C%22%22%2C%22%22%2C%221583164990%22%2C%2237413000118387000951579011066004%22%5D%7D&wgchecksum=a11b5bfdff3789770b8e4636f3102629&userIP=185.151.58.114&doAffectv=1&wgtime=1575388990
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2919345&wgcampaignid=99582&js=1&viewref=37413000118387000951579011066004
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.29.72.47 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 81-29-72-47.servers.dedipower.net
Software: Apache /
Resource Hash: 94bdeaea0d33cb654b89540e96e02fe28afceb1624d8ed58f7a43f3609fb4a17

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 03 Dec 2019 16:03:10 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 339F 3 KB
3 KB 647ms
33ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=81210800114089701046694011066005&wglinkid=2919345
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:10 GMT
Last-Modified: Tue, 03 Dec 2019 16:03:10 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 2808
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498
8019191.fls.doubleclick.net/ Frame E1D0
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498?

0
0

32ms
32ms

Document
text/html

216.58.205.230
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498?

Requested by

Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f230.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8019191.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 03 Dec 2019 16:03:10 GMT
expires: Tue, 03 Dec 2019 16:03:10 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 319
x-xss-protection: 0
set-cookie: IDE=AHWqTUm02WY2nbsH_qcPb0hAndtOAUicXoRy-YA_QJn93Jd6K5vug7QLv_7_oZlA; expires=Sun, 27-Dec-2020 16:03:10 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 03 Dec 2019 16:03:10 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CN_9kqntmeYCFcyrdwodkHwG2A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5202076809191.498?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 03-Dec-2019 16:18:10 GMT; path=/; domain=.doubleclick.net
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK request_content.php
hal90004.redintelligence.net/ Frame 521F 0
0 34ms
12ms Document
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=37413000118387000951579011066004&a=9d237f83
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 Heppenheim an der Bergstrasse, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash

Request headers

Host: hal90004.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=199ca7afd2e57746
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Date: Tue, 03 Dec 2019 16:03:10 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Tue, 03 Dec 2019 16:03:10 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1490
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK id.js Show response
mathid.mathtag.com/device/ Frame 339F 54 KB
19 KB 57ms
25ms Script
text/javascript 185.29.133.58
MediaMath Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://mathid.mathtag.com/device/id.js
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.58 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: / Express
Resource Hash: b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:10 GMT
Content-Encoding: gzip
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Transfer-Encoding: chunked
X-MM-Host: zrh-mathid-x2
Connection: keep-alive
Access-Control-Allow-Headers: Content-type, X-Optout
Keep-Alive: timeout=360
Expires: Tue, 03 Dec 2019 17:03:10 GMT

GET
DATA 200
OK truncated
/ Frame 339F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b48125a53955d6ef6aff7675970ac41cfdd9e08358c1f1ea42eb958158990e8b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 track Show response
w-it.m-t.io/ Frame 339F 0
75 B 42ms
41ms Script
application/javascript 2a00:1450:4001:820::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/track?campaignId=99582&clickId=274615_99582_15753889900497_f6eca94a2c&programId=274615&expiry=1583164990&acc=wg&scriptTag=&type=postview&indicator=e333982cb4995014968ba9141113523e&
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
x-cloud-trace-context: 906d306a9ddf0bc923bce49d6d53a45e
server: Google Frontend
date: Tue, 03 Dec 2019 16:03:10 GMT
content-length: 0
content-type: application/javascript;charset=utf-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 339F 49 B
330 B 17ms
17ms Image
image/gif 185.29.133.223
MediaMath Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=5759699375381630011&node_id=1343&exch_id=5&mathid_data=%7B%22dv1%22%3A%22TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNg%3D%3D%22%2C%22dv2%22%3A%22NWI2NjgwZjU1ZmFiYmMxM2YxMGMwMDgyNTM4NjQ0OTk%3D%22%2C%22dv3%22%3A%22%22%2C%22dv4%22%3A%22MTYwMHwxMjAwfDE2MDB8MTIwMHwyNHx8%22%2C%22dv5%22%3A%22RXVyb3BlL0Jlcmxpbg%3D%3D%22%2C%22dv6%22%3A%22%22%2C%22dv7%22%3A%22MA%3D%3D%22%2C%22dv8%22%3A%22ZmFsc2V8dHJ1ZXx0cnVl%22%2C%22dv9%22%3A%22fGVuLVVTfA%3D%3D%22%2C%22dv10%22%3A%22TW96aWxsYXxOZXRzY2FwZXxMaW51eCB4ODZfNjR8%22%7D
Requested by: Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.223 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: MMBD/3.160.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 03 Dec 2019 16:03:10 GMT
Server: MMBD/3.160.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x23, zrh-bidder-x118
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Tue, 03 Dec 2019 16:03:09 GMT

GET
H2 200 index.html
cdn.districtm.io/ids/ Frame CD0C 0
0 177ms
175ms Document
text/html 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.districtm.io/ids/index.html

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html
set-cookie: __cfduid=d3fb05b0fb851c7e85ce60004f1c9e5fe1575388993; expires=Thu, 02-Jan-20 16:03:13 GMT; path=/; domain=.districtm.io; HttpOnly
cf-ray: 53f6c4fb28959772-FRA
cf-cache-status: DYNAMIC
cache-control: s-maxage=1209600, max-age=14400
last-modified: Thu, 10 Jan 2019 16:50:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 5971 0
0 77ms
41ms Document
text/html 95.100.196.237
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.237 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-237.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Wed, 02 Dec 2020 16:03:13 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive

GET
H2

200

pd
eu-u.openx.net/w/1.0/ Frame 38B8
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1

0
0

49ms
49ms

Document
text/html

34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
vary: Accept
set-cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993; Version=1; Expires=Wed, 02-Dec-2020 16:03:13 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1575388993|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 18-Dec-2019 16:03:13 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server: OXGW/16.167.2
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html
content-length: 862
via: 1.1 google
alt-svc: clear

Redirect headers

status: 302
set-cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993; Version=1; Expires=Wed, 02-Dec-2020 16:03:13 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
server: OXGW/16.167.2
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
date: Tue, 03 Dec 2019 16:03:13 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame DB5D 0
0 73ms
44ms Document
text/html 95.100.196.250
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.250 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-250.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Tue, 12 Nov 2019 06:59:02 GMT
ETag: "13006b6-97cd-59720c88c16d1"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 14515
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=36227
Expires: Wed, 04 Dec 2019 02:07:00 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 index.html
cdn.districtm.io/ids/ Frame 87A1 0
0 111ms
111ms Document
text/html 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.districtm.io/ids/index.html

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html
set-cookie: __cfduid=d3fb05b0fb851c7e85ce60004f1c9e5fe1575388993; expires=Thu, 02-Jan-20 16:03:13 GMT; path=/; domain=.districtm.io; HttpOnly
cf-ray: 53f6c4fb28a29772-FRA
cf-cache-status: DYNAMIC
cache-control: s-maxage=1209600, max-age=14400
last-modified: Thu, 10 Jan 2019 16:50:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H2 200 iframe
mantodea.mantisadnetwork.com/prebid/ Frame 96FC 0
0 103ms
103ms Document
text/html 52.4.163.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=-60&buster=1575388987878&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.163.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-163-43.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

:method: GET
:authority: mantodea.mantisadnetwork.com
:scheme: https
:path: /prebid/iframe?tz=-60&buster=1575388987878&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=utf-8
content-length: 332
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
expires: -1
etag: "-816291178"

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame 11B8 0
0 68ms
42ms Document
text/html 95.100.196.250
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.250 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-250.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Tue, 12 Nov 2019 06:59:02 GMT
ETag: "13006b6-97cd-59720c88c16d1"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 14515
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=36227
Expires: Wed, 04 Dec 2019 02:07:00 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 520A 0
0 84ms
13ms Document
text/html 95.100.196.237
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.237 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-237.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Wed, 02 Dec 2020 16:03:13 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive

GET
H2

200

sync
eb2.3lift.com/ Frame FCCD
Redirect Chain

https://ib.3lift.com/sync?
https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

16ms
8ms

Document
text/html

3.121.172.124
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.172.124 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-121-172-124.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: tluid=4790290757366496731
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=utf-8
content-length: 516
set-cookie: sync=CgoI4gEQr7OB5OwtCgoI5gEQr7OB5OwtCgkICRCvs4Hk7C0KCgipARCvs4Hk7C0KCQg5EK-zgeTsLQoJCDoQr7OB5OwtCgkICxCvs4Hk7C0KCgjOARCvs4Hk7C0KCgiOARCvs4Hk7C0KCQgfEK-zgeTsLQ==; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/sync; Domain=.3lift.com tluid=4790290757366496731; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/; Domain=.3lift.com
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Tue, 03 Dec 2019 16:03:13 GMT
content-length: 0
set-cookie: tluid=11583278441213572436; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/; Domain=.3lift.com
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 connectmyusers.php
cdn.connectad.io/ Frame BDC4 0
0 59ms
58ms Document
text/html 2606:4700:10::6814:9174
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:9174 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.connectad.io
:scheme: https
:path: /connectmyusers.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d6443923aa3a6ea1378ad564363a723e21575388993; expires=Thu, 02-Jan-20 16:03:13 GMT; path=/; domain=.connectad.io; HttpOnly
cache-control: max-age=28800
cf-cache-status: HIT
age: 6735
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 53f6c4fb49645a18-VIE
content-encoding: gzip

GET
H2 200 index.html
cdn.districtm.io/ids/ Frame 4E68 0
0 157ms
157ms Document
text/html 104.16.68.69
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.districtm.io/ids/index.html

Requested by

Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

:method: GET
:authority: cdn.districtm.io
:scheme: https
:path: /ids/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html
set-cookie: __cfduid=d3fb05b0fb851c7e85ce60004f1c9e5fe1575388993; expires=Thu, 02-Jan-20 16:03:13 GMT; path=/; domain=.districtm.io; HttpOnly
cf-ray: 53f6c4fb38bb9772-FRA
cf-cache-status: DYNAMIC
cache-control: s-maxage=1209600, max-age=14400
last-modified: Thu, 10 Jan 2019 16:50:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
content-encoding: br

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame AA0D 0
0 71ms
8ms Document
text/html 104.111.230.142
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Thu, 14 Nov 2019 18:59:50 GMT
Content-Encoding: gzip
Content-Length: 7459
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=39672
Expires: Wed, 04 Dec 2019 03:04:25 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame 11F0 0
0 52ms
51ms Document
text/html 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
vary: Accept
set-cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993; Version=1; Expires=Wed, 02-Dec-2020 16:03:13 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1575388993|mOsLgqgikin0fcmWiygu; Version=1; Expires=Wed, 18-Dec-2019 16:03:13 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server: OXGW/16.167.2
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html
content-length: 862
via: 1.1 google
alt-svc: clear

GET
H2

200

sync
eb2.3lift.com/ Frame 717E
Redirect Chain

https://ib.3lift.com/sync?
https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

16ms
7ms

Document
text/html

3.121.172.124
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.172.124 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-121-172-124.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: tluid=4790290757366496731
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=utf-8
content-length: 516
set-cookie: sync=CgoI4gEQr7OB5OwtCgoI5gEQr7OB5OwtCgkICRCvs4Hk7C0KCgipARCvs4Hk7C0KCQg5EK-zgeTsLQoJCDoQr7OB5OwtCgkICxCvs4Hk7C0KCgjOARCvs4Hk7C0KCgiOARCvs4Hk7C0KCQgfEK-zgeTsLQ==; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/sync; Domain=.3lift.com tluid=4790290757366496731; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/; Domain=.3lift.com
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Tue, 03 Dec 2019 16:03:13 GMT
content-length: 0
set-cookie: tluid=4790290757366496731; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/; Domain=.3lift.com
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 9B5A 0
0 71ms
14ms Document
text/html 95.100.196.237
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.237 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-237.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Wed, 02 Dec 2020 16:03:13 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive

GET
H2

200

sync
eb2.3lift.com/ Frame FF17
Redirect Chain

https://ib.3lift.com/sync?
https://eb2.3lift.com/sync?

0
0

16ms
8ms

Document
text/html

3.121.172.124
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.172.124 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-3-121-172-124.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: tluid=4790290757366496731
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=utf-8
content-length: 516
set-cookie: sync=CgoI4gEQr7OB5OwtCgoI5gEQr7OB5OwtCgkICRCvs4Hk7C0KCgipARCvs4Hk7C0KCQg5EK-zgeTsLQoJCDoQr7OB5OwtCgkICxCvs4Hk7C0KCgjOARCvs4Hk7C0KCgiOARCvs4Hk7C0KCQgfEK-zgeTsLQ==; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/sync; Domain=.3lift.com tluid=4790290757366496731; Max-Age=7776000; Expires=Mon, 2 Mar 2020 16:03:13 GMT; Path=/; Domain=.3lift.com
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

Content-Length: 0
Connection: keep-alive
Cache-Control: public, max-age=900
Date: Tue, 3 Dec 2019 15:55:24 GMT
Last-Modified: Tue, 3 Dec 2019 15:55:24 GMT
Location: https://eb2.3lift.com/sync?
X-Rev: c4752e7
X-Served-By: impression-bus5.us_east.prod
X-Cache: Hit from cloudfront
Via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA50-C1
X-Amz-Cf-Id: Rzu8yXC-zXBDsNZYtiVAOyfRodrUGYTgJv3ZPgShjbrFHZ-CUvU_Eg==
Age: 468

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 4630 0
0 68ms
15ms Document
text/html 95.100.196.237
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.237 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-237.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Wed, 02 Dec 2020 16:03:13 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive

GET
H2 200 iframe
mantodea.mantisadnetwork.com/prebid/ Frame A340 0
0 142ms
141ms Document
text/html 52.4.163.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=-60&buster=1575388987755&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.163.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-163-43.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

:method: GET
:authority: mantodea.mantisadnetwork.com
:scheme: https
:path: /prebid/iframe?tz=-60&buster=1575388987755&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=utf-8
content-length: 332
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
expires: -1
etag: "-816291178"

GET
H2 200 connectmyusers.php
cdn.connectad.io/ Frame 9D56 0
0 43ms
43ms Document
text/html 2606:4700:10::6814:9174
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:9174 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.connectad.io
:scheme: https
:path: /connectmyusers.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d6443923aa3a6ea1378ad564363a723e21575388993; expires=Thu, 02-Jan-20 16:03:13 GMT; path=/; domain=.connectad.io; HttpOnly
cache-control: max-age=28800
cf-cache-status: HIT
age: 6735
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 53f6c4fb596f5a18-VIE
content-encoding: gzip

GET
H2 200 iframe
mantodea.mantisadnetwork.com/prebid/ Frame D7FE 0
0 140ms
138ms Document
text/html 52.4.163.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=-60&buster=1575388987512&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.163.43 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-4-163-43.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

:method: GET
:authority: mantodea.mantisadnetwork.com
:scheme: https
:path: /prebid/iframe?tz=-60&buster=1575388987512&secure=true&version=9&mobile=false&uuid=d445c784-4f01-4896-ae2c-2b7cc8b8fab0&title=Infected%20with%20CloudNet%20EpicNet%20Bitcoin%20Miner%20-%20Virus%2C%20Trojan%2C%20Spyware%2C%20and%20Malware%20Removal%20Help&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fforums%2Ft%2F696187%2Finfected-with-cloudnet-epicnet-bitcoin-miner%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=utf-8
content-length: 332
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
expires: -1
etag: "-816291178"

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 5E48 0
0 22ms
17ms Document
text/html 95.100.196.237
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.237 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-237.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Wed, 02 Dec 2020 16:03:13 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame E7F5 0
0 22ms
17ms Document
text/html 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993; pd=v2|1575388993|mOsLgqgikin0fcmWiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
vary: Accept
set-cookie: i=f8736a1c-07c6-0e97-082c-e5667c639e74|1575388993; Version=1; Expires=Wed, 02-Dec-2020 16:03:13 GMT; Max-Age=31536000; Domain=.openx.net; Path=/ pd=v2|1575388993|rskimWfcvmsHqGgqmuiynIsLomgemOgunsn0oagi; Version=1; Expires=Wed, 18-Dec-2019 16:03:13 GMT; Max-Age=1296000; Domain=.openx.net; Path=/
server: OXGW/16.167.2
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html
content-length: 825
via: 1.1 google
alt-svc: clear

GET
H2 200 connectmyusers.php
cdn.connectad.io/ Frame FADD 0
0 25ms
24ms Document
text/html 2606:4700:10::6814:9174
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:9174 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: cdn.connectad.io
:scheme: https
:path: /connectmyusers.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
accept-encoding: gzip, deflate, br
cookie: __cfduid=d6443923aa3a6ea1378ad564363a723e21575388993
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

status: 200
date: Tue, 03 Dec 2019 16:03:13 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=28800
cf-cache-status: HIT
age: 6735
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 53f6c4fba9935a18-VIE
content-encoding: gzip

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 1991 0
0 26ms
13ms Document
text/html 95.100.196.237
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.237 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-237.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Wed, 02 Dec 2020 16:03:13 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive

GET
H/1.1 200
OK Cookie set showad.js
ads.pubmatic.com/AdServer/js/ Frame F146 0
0 15ms
15ms Document
text/html 95.100.196.250
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-2.36.5.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.196.250 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-196-250.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
Accept-Encoding: gzip, deflate, br
Cookie: KTPCACOOKIE=YES
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/

Response headers

Last-Modified: Tue, 12 Nov 2019 06:59:02 GMT
ETag: "13006b6-97cd-59720c88c16d1"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
Set-Cookie: KTPCACOOKIE=YES; domain=.pubmatic.com; path=/; max-age=7776000;
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 14515
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=36227
Expires: Wed, 04 Dec 2019 02:07:00 GMT
Date: Tue, 03 Dec 2019 16:03:13 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 109ms
70ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A65410800-15e6-11ea-b119-128b912572ea&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 03 Dec 2019 16:03:13 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&gdpr_consent=&uid=AmNqgA8wO4caY2uAATcig1YybYMaY26FATJOCqn7

0
124 B

15ms
7ms

Image
text/plain

52.58.138.174
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&gdpr_consent=&uid=AmNqgA8wO4caY2uAATcig1YybYMaY26FATJOCqn7

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.138.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-138-174.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Tue, 03 Dec 2019 16:03:13 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Pragma: no-cache
Date: Tue, 03 Dec 2019 16:03:13 GMT
Server: QS
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&gdpr_consent=&uid=AmNqgA8wO4caY2uAATcig1YybYMaY26FATJOCqn7
Cache-Control: private, no-cache, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 bo
ox-delivery-prod-1-europe-west1.openx.net/w/1.0/ 43 B
108 B 17ms
16ms Image
image/gif 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ox-delivery-prod-1-europe-west1.openx.net/w/1.0/bo?bd=161&bp=150&br=p&bs=www.bleepingcomputer.com&bt=1200&ts=2DAABBgABAAECAAIBAAsAAgAAAYgcGAo3d3VVWnhkTGJJHBampsqG5-u9gz4WieCXyM3D07_aAQAcFt_KxYC2iNTfZRaN2a-9uoPTwtIBABb2nLTeCxUEESgkZDg2MmQ5ZjktYjQyYS00YWY3LWJiMTEtZDJkMzllZjg0NTQ3ACwcFQIAHBUCABwVAgAAHCa6ipqCBBUEFQQmuIqaggQWtoqaggTWrAIWrAIWrAIWrAIWrAIWrAIWrAIWwAIAHBwsFoCxiqS77IOtKhbrsrXZ5-KA56UBAAAW7tuYgAQWzrCegAQWxM_0gAQWgrWhgAQVGBwU9AMUlA8AFQQmwAIWwAIWwAIRNQ4ALCwWu_LVg6LhiYnnARbrjPD7ruCK3NEBABb2nLTeCwYo7tuYgAQWzrCegAQWgrWhgAQWxM_0gAQYBzY2MjI2OTMW1pRKFsACJQQWFBgGMTAxOTM2FQKWlLaLAhERGAJPWAx6FPgDFKYGABYCGANydGKBAAw8OBttYXRodGFnLmNvbUBzb2JlcmJlcmxpbi5jb20AAAA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.167.2 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:13 GMT
via: 1.1 google
server: OXGW/16.167.2
p3p: CP="CUR ADM OUR NOR STA NID"
status: 200
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 10ms
9ms Image
text/plain 52.58.138.174
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.138.174 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-138-174.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Tue, 03 Dec 2019 16:03:13 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 31ms
30ms Image
image/gif 52.49.153.216
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.153.216 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-49-153-216.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 03 Dec 2019 16:03:13 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

Verdicts & Comments Add Verdict or Comment

175 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-19 10:00:00	Name: NID Value: 192=o-hsz4oKMlGH3luCxizaTrR3pwSN6EDASL4vLhMquup3yXy6gXoH-rjHvCvxQeE-gyc6UzOgMhi7znX8edomW66TgwuIB4gYmpO4WrykPddMlxYgn6UytRMK85ktjA12xRGQsc52p3R5WiK3knXfxnOSSQb8zst_bltkaqhIeSQ
www.bleepingcomputer.com/	1969-12-31 23:59:59	Name: _cmpQcif3pcsupported Value: 1
www.bleepingcomputer.com/	1970-01-19 05:36:30	Name: fssts Value: false
www.bleepingcomputer.com/	1970-01-19 05:36:30	Name: _fssid Value: 78ae4237-2898-4ead-bdb5-88ca4adfd1c1
.bleepingcomputer.com/	1970-01-19 05:37:55	Name: _gid Value: GA1.2.2069288893.1575388985
.bleepingcomputer.com/	1970-01-19 23:07:40	Name: _ga Value: GA1.2.678002882.1575388985
.bleepingcomputer.com/	1970-01-19 06:19:40	Name: __cfduid Value: dc9a615ba4ebabd91ba6fa137add70b991575388984
.bleepingcomputer.com/	1970-01-19 05:36:29	Name: _gat_gtag_UA_91740_1 Value: 1
.bleepingcomputer.com/	1969-12-31 23:59:59	Name: session_id Value: 2c59ec601c392f6906ea394fda4a943f
.bleepingcomputer.com/	1970-01-19 06:19:40	Name: __beaconTrackerID Value: 407bx6zz3
www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner	1969-12-31 23:59:59	Name: fsbotchecked Value: true

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://quantcast.mgr.consensu.org/cmp.js(Line 1) Message: Dependency check failed for Publisher Purpose Legitimate Interest IDs: Publisher Purpose Legitimate Interest IDs must be an array containing only purpose IDs contained in the Publisher Purpose IDs array, the following purpose IDs will be ignored: 1, 4, 5
console-api	log	URL: https://freestar-io.videoplayerhub.com/gallery.js(Line 19) Message: Video gallery initializing
console-api	warning	URL: https://static.quantcast.mgr.consensu.org/v27/cmpui-popup.js(Line 1) Message: Unable to get NonIab Vendor list.
console-api	error	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js(Line 1) Message: Exception in queued GPT command TypeError: Cannot read property 'getItem' of null
console-api	info	URL: https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js(Line 411) Message: Powered by AMP ⚡ HTML – Version 1911070201440 https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
console-api	info	URL: https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js(Line 411) Message: Powered by AMP ⚡ HTML – Version 1911070201440 https://www.bleepingcomputer.com/forums/t/696187/infected-with-cloudnet-epicnet-bitcoin-miner/
console-api	warning	URL: https://cdn.ampproject.org/rtv/011911070201440/amp4ads-v0.js(Line 19) Message: [amp-analytics/transport] Response unparseable or failed to send image request https://securepubads.g.doubleclick.net/pagead/adview?ai=CG2cGO4fmXezMEMftgAefpYroD9KolOJXuOm31oEKv87z_QgQASDa18U5YJXaiIKYB6AB_dGx8wLIAQOpAiEvaIqMmLI-4AIAqAMBqgS0Ak_QDy7-kep3fTKsHedjxC82b94ZM0G5KahufL-qK1I4ZBCGc84PsvWQBWqSeiDNGfhGDQ8JRk8lLurkdg8jOYBCjsTHLLs6IvS0p-Utx9c0Qn86nophTTFG1n-QPTMGEAoGx9zBhEwT0TVNF1qJspOBWOoFO9pVTs9tw5EdQUr6hTwSWDRkhczwVQpipTPuwsDUmqKrJSVhrz7njCTlm-r0_WgoPAWY3e6eOB2ELu1I7MqiH4d4ZgWG5-09d7BXzOA24oMlu17zbbK8QsUinVKKEQ-31-lfm87R_qAm95FNDRmulBswhvggL_mVHDEb2Kg7bB6JD7IFQgpZ3_5a-RyVWqrdZgI14XwJWwlbTajto6n9Uv23NXrBfd2hU6kDejkAad5jE4xnlcbetDeTAikuLqIIwAS35MmAmQLgBAGgBgOAB-utzowBqAeOzhuoB9XJG6gHk9gbqAe6BqgH2csbqAfPzBuoB6a-G6gH7NUb2AcB8gcEEMTrB9IICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tMTc0MjI0OTYwMzI4OTA4M4AKA9gTAw&sigh=rj0Wo3zC9cU&vt=1
console-api	log	URL: https://analytics.webgains.io/clk.min.js(Line 1) Message: W-IT I
console-api	log	URL: https://analytics.webgains.io/clk.min.js(Line 1) Message: W-IT I

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8019191.fls.doubleclick.net
a.pub.network
accounts.google.com
acdn.adnxs.com
ad-delivery.net
ad.zanox.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.webgains.io
aol-match.dotomi.com
api.quantcast.mgr.consensu.org
api.skimlinks.mgr.consensu.org
apis.google.com
as-sec.casalemedia.com
audit.quantcast.mgr.consensu.org
btlr.sharethrough.com
c.amazon-adsystem.com
c.pub.network
cdn.ampproject.org
cdn.connectad.io
cdn.districtm.io
cluster-na.cdnjquery.com
confiant-integrations.global.ssl.fastly.net
connect.facebook.net
d.pub.network
diapi.webgains.com
dmx.districtm.io
eb2.3lift.com
ecdn.analysis.fi
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
freestar-d.openx.net
freestar-io.videoplayerhub.com
g2.gumgum.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal90004.redintelligence.net
hbopenbid.pubmatic.com
i.connectad.io
i.imgur.com
ib.3lift.com
ib.adnxs.com
loadeu.exelator.com
mantodea.mantisadnetwork.com
match.adsrvr.org
mathid.mathtag.com
ox-delivery-prod-1-europe-west1.openx.net
p.skimresources.com
pagead2.googlesyndication.com
pb.media01.eu
pixel.advertising.com
pixel.mathtag.com
pixel.quantserve.com
protected-by.clarium.io
quantcast.mgr.consensu.org
r.skimresources.com
s.skimresources.com
securepubads.g.doubleclick.net
static.quantcast.mgr.consensu.org
staticxx.facebook.com
sync.crwdcntrl.net
t.skimresources.com
tags.mathtag.com
tlx.3lift.com
tpc.googlesyndication.com
track.webgains.com
vendorlist.consensu.org
w-it.m-t.io
web.hb.ad.cpe.dotomi.com
www.11teamsports.com
www.awin1.com
www.bleepingcomputer.com
www.bleepstatic.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.skimresources.com
104.111.230.142
104.16.68.69
104.20.60.209
104.26.13.6
104.90.154.57
116.202.48.214
13.225.78.52
13.225.86.250
138.201.63.116
143.204.101.16
143.204.101.58
143.204.101.62
143.204.101.97
147.75.102.200
151.101.112.193
151.101.113.194
151.139.128.10
152.199.21.89
172.217.22.34
178.79.175.86
185.29.133.223
185.29.133.58
185.33.223.202
185.64.189.112
195.216.249.67
2.18.233.201
216.58.205.230
2600:9000:2156:6000:9:46dc:4700:93a1
2600:9000:21f3:600:9:352d:a240:93a1
2600:9000:21f3:a600:9:46dc:4700:93a1
2600:9000:21f3:ce00:1:af78:4c0:93a1
2606:4700:10::6814:9174
2606:4700:20::681a:8b
2606:4700::6810:a727
2a00:1450:4001:800::2004
2a00:1450:4001:800::200e
2a00:1450:4001:808::2001
2a00:1450:4001:808::200e
2a00:1450:4001:809::2003
2a00:1450:4001:815::2001
2a00:1450:4001:819::200d
2a00:1450:4001:820::2002
2a00:1450:4001:820::200a
2a00:1450:4001:820::2013
2a00:1450:4001:821::2008
2a02:fa8:8806:12::1400
2a02:fa8:8806:12::1430
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.120.201.254
3.121.172.124
3.123.66.234
3.222.69.96
34.95.120.147
35.156.206.192
35.188.71.214
35.190.40.172
35.190.59.101
35.201.67.47
35.226.36.58
46.236.13.147
52.18.217.230
52.214.34.242
52.4.163.43
52.49.153.216
52.58.138.174
63.33.115.128
69.173.144.140
81.29.72.47
85.10.231.199
91.228.74.232
95.100.196.237
95.100.196.250
95.100.197.53
0166899095125d9e765f2b8d3a7e1f1e7b227f80b9990532f9c655cce83ba67c
03b07f320a1692a2d507465027fffaa6560d19d248c33bb6a5f2c97b75680c1d
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0b5a35aa59af15012b03c44769087fb85282ed12e3c417030d78f95f61697b53
0bc2ee096d68f1de3dfd74d23e4a3d1550001d5a459a537e276b5bdf6f011893
0bee1151fc65063ef2369f485bf24fc0506927659cc421d5f7a58a4f1b824a91
0d848ce732e0944faee4acb27d45bbe47cb1930bfcbe8888eb77b16a13f44517
0e946b0ee0337cf23c845f67a238e1fefd5f1e014fdbd8ea27870172fcedd40f
0f1e90548e911e24dedcb2ca0ffee6847a49a8648e9c615bcd0582bb7c7993fd
114af008615fbe18f9cc0dfd36ebafd202e12eda91137d48d8a2cab529274d9f
11c49fd8b0e75998066dbeb97e73d1851d447a70a640f06fcc701aecec0a6545
1412d7245072504d1975da264074e475485b5bab1edab58938a536542a4f3dd5
14cd637179c522aee08827631920f4c45be640bd0bdcbc108198f7bb806b18fc
1a351df56f9cdaea197422d834f4063cc3780d5ec28d6c3f8ad40a36cd35777d
1a78f7bf63f851cbab54a7f7e9ccb76b53ef79834c33cd242aa98d16d228e855
1b1706050199c867e5586fb8cd8273040dbb42fc2b2442176de6b7c3c694ebe2
1c537f383ff3a785ea87ed8a189769e88ac8b83a5258ee8b5c96b9c43c5c7ac8
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
2041712798be6dbdabefc34f4e454272971206a9767a4b3c69ae2b5c7ae5c30a
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
2363cbdace3d4db7b0ee2f0fcf42a722658814affea6c100f3679f7c21ff9e11
23f5a3eca6fec1f8380dd45a87da65ee9ab4c93d4602403dc26b18e2afeb201f
267deb4a931743610d9aa55f64ce5947ac2c674924c114e558082b9f5e59d800
27a649cf4b325933dcc49f908a227583bdce0ada97d129cac346624bd4eec96a
2d0f6b590917e7d27ddeb026b280d62dde9d03bb92f47f56342fc5f68f0c24eb
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f60c321fe29240646caaa6ad5c1368266cd545b6ac48c22636434828d3422e5
310d068013f9637d3200d35a53db75bee9b3ccfaa990401cfa6c8a0be98db2ab
311b90855c9f23f4f7531137aa339d941b81af0409120d0281a535f0d2920d49
33f22afb1f74640570092ba76dc65853890d52143fd2fa9c694fd5f76eac5450
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3b6a84a416edfb98ed7608dad8cd26ffd7123e54bce2bb13a4a3394e0b948382
3c10cb1ddf712f08a5082f5759b9496c250d195a9e6746e2ab0088b52775b21e
3e3b8f6c06d2d74cc294ee6439e67b08890587be0081249a158469ace2eaeaaf
3e89beb7d66ef7d5e58dfcefd22a51e1a8ae452a49bc20d020418cf2b6c666d0
3e9695ddb52374f361a5e6d2b6fd1666e85c002e7dacad455dfb8dab48e4ffb6
424b5f41dcbc693d32ca73f0e2b1daa5cf5524bc2220865c15b81f032bf3052d
4253287e01423d47fa504539ab204ff8993547131db8caa68088257665d17e08
426f10b0db653307653e893e190b840807af13366cc9ea48ddaf29d9209e7eeb
464bd0e837c5dcbd6ddeb6c8167f22937bf73d6d4d6f634f8497191d5ca4bfa8
48100a7efdd07d27ede8e151c39cad2a2b55853d038c25fc2a846316ea0184ef
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
489b6703852c290f6b4d10eed79f17d378682f423e427c4e709fcf5aa16bc78e
4cae697d304b6cae1bb457589d549ec39239ca1d1e32bd7201200cb7562eeb32
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ed72fa5a10977212d2b3fff3633b1a813970474f0b5cbd04e52170879faa455
50ec0dfe51bd77eee427ce38cc90ef3564afea1a2e1148dc788c2d89b7fa4fb9
51f20d95dad9ea1473e4f877b5f7a7d8bcd589f1f989b8875ffddd83ae716a21
563777fc54d07e48cbea78dd97911bdd12a62d1888d12fe4dfeaaa9b3563d676
57b8974b7aa2619a286afb111fed2f317357ae880ec058b2a01b41e9e15ce96e
59e6b6895ab9c1fab302d73906ec3259ac826ffc4a3ae743412bf8a096a33054
5a4061ff8312e2ad494bd984b7df966438232be64a3b284ab69f66c6705009a6
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5efbdf536fc0f21fcbb9aa20ba96f679f3cdfc42a75a1d2bbbce17807ee252d7
61da0a4638505960ec52709b7df80d92683c56e13042079daf5f082fc9548d5e
61e225f0d67c03cc5a2cdfa2f63e971048d0201711c3cda27c4d4ea0f9f65176
62efaaf2cbb78cb582da9f7d10a92da43ea30df7034c43dd0b5213d58a5d9cdc
6404b8cdbb463b8b37ad13570c8a56a5c6aad1b5f37f41ce0255aae77e5cecb1
669641985eb1bb7b0e71762f8e734ae2d1832b6976a97f099218d714da1f214e
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6a6791537c8dbac7a0632f4d05a0fef65d926abc70fc31e1b8ac0a2da282c9f8
6b47306803e5abe44045a784487ad41b6d3dcb480ed997ae56d43c5241ca8900
6b98669bc613fd85ff709aa32076df4ef0097c2d0716426f71d7fd8d0ffd50f9
6e0533d6585c026d1f72a040b902b67d76994eafa3593049d16ee319e9ec9be8
7123d7348344bb4e50d4aee77d0f8f00f1db864a43c161acdac66e399485db85
71dae7cc7766c98bdc4b766789af22fe0442d58aced342736f044ec12aaba058
73e88dfcd0f3a535341fb641c5400fcf772ffe36c628241104f829d3cf48e29b
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7467421fd2832a0116d5e60da661e47b20bbe46992afb46cb1061ad372de13a9
770cb6f8747e90dad261e049dfa5cf42e622dac61bcbc86ecb0a8c134228eb91
792ca8c88408660ac1460ae6099949491b1a2f14219396215f927004d786ebab
799fa39e1b22d0b8e9ac024b276783eb036519a543798dbcdea8f0e61ff4b9fc
7a52d4e3f541e459f9069f6f596242684704eeaca5a95f05285d16e2e609927d
7a69bffb6e9271a63c554a66729a11ae26e4939dc0a6f589b21e28ef17cd16f6
7b4314b5e9f9c2aac6587856b6528df0c70f02403927f86e03ad45df271bdc10
7b5bbcbf15b2ae7c554c86986bd4412a26c9c11058c19142a8892614bd41ff7c
7cc36f47b70988855c5cde9579581871e9dc92a285a8b1ba4602a89c915c902c
7dca9338d8f5830b8fbe837cf92eb809f6b54fc7aa7a0037bbf188adf1f37baa
7e94fbebf526effec4239c82e5435a412d81ffc4bc9bddf13f9aa1170f6d803e
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8347a92981a0fdc73af9e2536f688b1a14e6ebea3b4ee5df22e6654bb5e8ca6c
84f9225b2c33c7e6689c30413ce5623d7221ab5463aea1baca4e3737f2bce3eb
8604a0b3eecb1e513a14cae8b2c2ef56119dd310818cdfbc173cee5e8d685533
866a1264b956a58da8e640a6191453d62f20d8676f63f193d2786318f83f6422
87562d3773ffab3d0716a70faa73c38b322fde3b8f265c3d646a3cea976ef67e
87cbeab00a06ecdea6d059473f8223197b3e2e70c7023e50279a210de90815aa
8844de510c63a3bd1038027b5d3976efdd043839aec4c65d74efd05d5d070638
896d841259064b8bbb2de90fe57aff6118cb0223eaa6f2f93c0df4d71ef78665
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8bcd115fedf08ec9fdfe9f8fbc4b52d20b15f4d89d3d16ca947c9e6874e88799
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8db624e21c35d3f1626601a61acb544d8dc307f820c325f945d4a2b60cb2c2eb
9158290895e962ac081ae5856cf1c361811b63e1dadf7a6b09fa2f3abbd6ecb5
91aab4ca16c777cf1bfcf7525e01df9c4968d84366dd2b36b8813b49b4d9b387
92597d72536ce2725db3f04c7ad34252f8d4037ae0a61cdec08f93a0c2db05f2
93277b2b6c0c1418a963e10ac33adab0f1bd4b3e971aea2febea0a841efed3ba
94bdeaea0d33cb654b89540e96e02fe28afceb1624d8ed58f7a43f3609fb4a17
967e2ca4f6acdd30fe8199d905a42f91e578494c5ae014f79d8cae4423219edc
98f88d642acd9024773bf77b93f9546e3cd6fd8fa3d539d16f7b018e0cb513f2
99d6ac74dfaffcb926b9e878fd75a12d032bd1bab5bd9fed54c9ac9dd599ba57
9c9489fdf1b9876f445b862d720da55ea50131e372c9de9692be0fca4d5d5c71
9d5718f13181da45241b915b1d7ae28f54f80f543bb8aab1904fe3efbcb2465e
9da345f99ff7351802644234c37b0e2be08dbdbcc4250110088e75df5792b9aa
a51f645170637f10f3eba218020318af3fff3ad8e7087db87ef607896f19a940
a55c6652514d6e2ebc88198444ac6b199e6ad119d0d009eea0a52e87cd7b39df
a915aab28857afeac49311ceff852888da1623eb0f589d7f43fbfbfbceb562e9
a9637bcfaf8b95a3439eb4d57868b06c37f5b172327366d5086967a366ccd153
ab17af378249d41781b324d20910899b1cff1e35532022c402e4770045602f20
ab1a12c0da652f8e525d21b28ca7c45b5ea34e787b561120cd8564089faf2a96
acd199754b7137704f41bc7d1cf75b688b6f9d06968e250d33465b2fad8b8942
b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b48125a53955d6ef6aff7675970ac41cfdd9e08358c1f1ea42eb958158990e8b
b6f78e58af9ada6448ab228377b29b65486267ec81f6e2cb68e3f3e0113ebe53
b83f83af16c29530301aa94d3dd2fe664212afea8f8cc9436fcaa18c0d7848f0
b858c15d1c76a8e7afb85a55f00e9918358b162be31e0a9b58a68c56be32d656
b93396cad1138a379d441b4e03e9bb5156ad04207ec2eb6842564b85f2917c28
b937537ed7f13e70dc6a69b6e9b308237cd369e11fa2a2b97a24d97d8487673e
bacd7fe1202d267cfcb279ede84739eb2ca3edc00b0785e0acaeff86abe72df1
beac17f947e2a553943045782e2ebe877500da304ee9f4d701134cce5ae7d502
bf50c94253085740a5cce42e9c14f7b897cfc384303b38a5d9d7a0ab8ea5160f
bfd753d445592a633d4e3b8f74fe6e4ca85ab95a1f0b2fc00f11afeaaeed8194
c1bd0f4a8086eaaf6aff1ae5db3a58caa8f37a97503dbb0dbbe96c3ff86412f0
c289838929ec906a2a1029cefe28c65774f5d15ef2c0d1c2e78c9d9f7de9db3f
c2a0ed3ea5aebdf80781e96b0e677656f9db72ea592b679299953852fef84b02
c419fe9d697507db44b762c2216588184dfd2e64bc6a629e9b4e314eaf505183
c5fccfd6a575a7a977abd0bf5ecb184a9f9755780fa8758ffecd2b94371a2d6b
cbc408797a84f8b8ef5d143f0917100740761c6f48af19235c22a65303fd229a
cbd8236978dd3f165bc49566f78c460e3937e552df38787439c1ef2797c4c709
ce5d13984b78782259e7d6f236e37dcccb6ab1a5ad7f85bac1b83214eb6376a8
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d3a970101d5c1c13fe97539903a8285d524c87295f551421ab9e40d9c1324e4a
d89aa20de1d78f110f7f70d1f1e60a731ffcaf1bd753748f94bff673d9a74b65
d8b1d56f910b1b912617744660596ec699b13a5548bdda03579aff1651afa2d6
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dbdae5c33d3c40ab952c62ad6532516212cfc676fc1b1585b2aa4f37bad8523f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de8e423965d43d19ebabb63898f39a34dd779ae7b2598dc90df679f99828998d
e19600d4174eedb41b49877e1487c52d5176855f8b7574268ebdd525e7304ca2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48c4975b293be404aa17aca3844095d270597494ffabe5316cad8c3e45d5004
e4ad56bd91f08203b208a3db86c463c7952fad443a239de6454c73b7ce669657
e5f51209e23b5d8a4ba4370726b53a7bf8165c655fc3d9757cfa05ae33c7f270
e72e776a1d4d5d967a04f317e996b951d11d41448e72e43f5d0dc0ef6d621bbf
e84f34b9c0f4a71f01d0ca6f0e2345b110c9025b0af4846899aeb3e07303196e
e87d99ca8178aa39473798dc91c8dad28257c7c1380123c9250a8b8090047acb
e8a150c26c7dc70fc345e71df6ddedd7560d21c23004732735d60b0aad93341d
e9f25bcf2516f56f5ad54cadee59eb9bd24d5b5eaa33f10344d6caefc4ea105c
ea99b0d7d706f0144a121af332e2efaae3a1fa76a4a3dbdbec7faa2b0177a2b0
ebbdc09f56e8b9cba9117f0d84b4903fdc89508496a9b5d5b8d6bf59ff13ebbf
ee469e3d281e77f7dcc2655ff8d187907f2240c76a03bf868e7dcfd67f08d880
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef879b83b39fe97ac9e83cc9329bf03ec9199fe7433b1ae62d311ef1dac86cbc
efe95cb2cc312e0132b0ce914c642ecee0534223df3f1d47579cdabe6cc070cd
f05e5537bc91bd6026cd2ee7a4ce48d5141ba791f68f1ce1264283c8af6c3aeb
f27cf7c85ec69a44e44258bd12c07939cc9c715c895527813609e482035b3300
f34544ddb27241b3eccb8e06d7447230005e8718b463a30d9dd83d1e8bada1a1
f38498d47b2022447140b188857a2dc8328971e2ce8d9fe787e8a48eeae876c3
f3d2f3c252cb69ecc65b35060f06d8f20d5af93d751731c9b47d5ad0a4b28c5a
f6b7ba3cc9a8177d62950984426ff73450f229d389c449b0631392be2f5b5b61
fbe858994ebec2fc448059339f1d40abfee06ef0e532bf30ae6bf8a472b29c49
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
ff1e65d5292ac70fa0ceaf87d04313c975d6299e212e0274d3d0362b218ccab8

www.bleepingcomputer.com Open in urlscan Pro 104.20.60.209 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

278 Requests

99 %HTTPS

30 %IPv6

51 Domains

84 Subdomains

68 IPs

9 Countries

1668 kBTransfer

4903 kBSize

11 Cookies

5 Outgoing links

Redirected requests

278 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209 Public Scan

Screenshot
Live screenshot

Full Image

278
Requests

99 %
HTTPS

30 %
IPv6

51
Domains

84
Subdomains

68
IPs

9
Countries

1668 kB
Transfer

4903 kB
Size

11
Cookies

278 HTTP transactions
4 data transactions