securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Submission: On January 09 via api (January 9th 2021, 7:01:08 am UTC) from US

Summary HTTP 215 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 39 IPs in 7 countries across 27 domains to perform 215 HTTP transactions. The main IP is 2001:8d8:100f:f000::289, located in Germany and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is securityaffairs.co.

This is the only time securityaffairs.co was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
42	2001:8d8:100f... 2001:8d8:100f:f000::289	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:219... 2600:9000:2190:f400:3:c04e:c780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:219... 2600:9000:2190:8600:1c:8a07:5e80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 54	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
7	68.183.31.14 68.183.31.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
13	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:219... 2600:9000:2190:3800:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:219... 2600:9000:2190:9e00:c:a9b7:ddc0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	3.127.132.197 3.127.132.197	16509 (AMAZON-02) (AMAZON-02)
1	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
6	2606:4700:20:... 2606:4700:20::681a:a9c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
4 6	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
18	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
6	52.52.52.5 52.52.52.5	16509 (AMAZON-02) (AMAZON-02)
2	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
3	157.245.94.128 157.245.94.128	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	185.33.221.14 185.33.221.14	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
2	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
2	178.162.133.150 178.162.133.150	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE)
2	216.58.205.226 216.58.205.226	15169 (GOOGLE) (GOOGLE)
1 1	104.19.134.78 104.19.134.78	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
3	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
2	63.33.218.134 63.33.218.134	16509 (AMAZON-02) (AMAZON-02)
2	2.18.232.130 2.18.232.130	16625 (AKAMAI-AS) (AKAMAI-AS)
215	39

42 2001:8d8:100f:f000::289 (Germany)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

securityaffairs.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:f400:3:c04e:c780:93a1 (United States)

ASN16509 (AMAZON-02, US)

w.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:8600:1c:8a07:5e80:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

54 2.18.235.93 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lg3.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cvision.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 68.183.31.14 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

served-by.pixfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:3800:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:9e00:c:a9b7:ddc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.127.132.197 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-132-197.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:20::681a:a9c (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.pixfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.233.180 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:2638::1c (France) 4 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.52.52.5 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-52-52-5.us-west-1.compute.amazonaws.com

navvy.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 157.245.94.128 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)

prebidserver.pixfuture.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.14 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States)

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.64.218 (United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

pixfuture2-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.162.133.150 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-apex.go.sonobi.com

apex.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.205.226 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra15s24-in-f226.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.134.78 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cm.mgid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.120.207.148 (United States)

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.33.218.134 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-218-134.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.232.130 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-130.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	media.net 1 redirects contextual.media.net lg3.media.net navvy.media.net cvision.media.net	566 KB
42	securityaffairs.co securityaffairs.co	1 MB
16	pixfuture.com served-by.pixfuture.com cdn.pixfuture.com prebidserver.pixfuture.com	948 KB
15	wp.com i0.wp.com i1.wp.com i2.wp.com stats.wp.com pixel.wp.com	90 KB
12	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	266 KB
12	criteo.com 4 redirects gum.criteo.com mug.criteo.com	5 KB
6	pubmatic.com ads.pubmatic.com hbopenbid.pubmatic.com	169 KB
5	doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net	194 KB
5	gstatic.com fonts.gstatic.com	94 KB
5	sharethis.com w.sharethis.com platform-api.sharethis.com buttons-config.sharethis.com l.sharethis.com	41 KB
4	openx.net pixfuture2-d.openx.net eu-u.openx.net	917 B
4	adnxs.com ib.adnxs.com acdn.adnxs.com	1 KB
4	googletagservices.com www.googletagservices.com	94 KB
4	google-analytics.com www.google-analytics.com google-analytics.com	37 KB
4	googleapis.com fonts.googleapis.com	5 KB
3	rlcdn.com api.rlcdn.com	527 B
2	adsrvr.org match.adsrvr.org	1 KB
2	google.com adservice.google.com	319 B
2	google.de adservice.google.de	296 B
2	googleadservices.com partner.googleadservices.com	1 KB
2	sonobi.com apex.go.sonobi.com	1 KB
2	facebook.net connect.facebook.net	62 KB
1	mgid.com 1 redirects cm.mgid.com	908 B
1	advertising.com adserver-us.adtech.advertising.com	194 B
1	w.org s.w.org	523 B
1	consensu.org c.sharethis.mgr.consensu.org
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	6 KB
215	27

	Domain	Requested by
42	securityaffairs.co	securityaffairs.co
35	contextual.media.net	1 redirects securityaffairs.co contextual.media.net
15	lg3.media.net	securityaffairs.co contextual.media.net
8	pagead2.googlesyndication.com	cdn.pixfuture.com pagead2.googlesyndication.com
7	served-by.pixfuture.com	securityaffairs.co served-by.pixfuture.com
6	navvy.media.net	contextual.media.net
6	mug.criteo.com	securityaffairs.co
6	gum.criteo.com	4 redirects
6	cdn.pixfuture.com	served-by.pixfuture.com cdn.pixfuture.com securityaffairs.co
5	fonts.gstatic.com	fonts.googleapis.com
5	i1.wp.com	securityaffairs.co
5	i0.wp.com	securityaffairs.co
4	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
4	cvision.media.net	securityaffairs.co
4	www.googletagservices.com	securityaffairs.co pagead2.googlesyndication.com
4	ads.pubmatic.com	securityaffairs.co cdn.pixfuture.com
4	fonts.googleapis.com	securityaffairs.co
3	api.rlcdn.com	cdn.pixfuture.com ads.pubmatic.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
3	prebidserver.pixfuture.com	cdn.pixfuture.com securityaffairs.co
3	i2.wp.com	securityaffairs.co
3	www.google-analytics.com	securityaffairs.co www.google-analytics.com
2	acdn.adnxs.com	cdn.pixfuture.com
2	eu-u.openx.net	cdn.pixfuture.com
2	match.adsrvr.org	cdn.pixfuture.com ads.pubmatic.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	partner.googleadservices.com	pagead2.googlesyndication.com
2	apex.go.sonobi.com	cdn.pixfuture.com
2	pixfuture2-d.openx.net	cdn.pixfuture.com
2	hbopenbid.pubmatic.com	cdn.pixfuture.com
2	ib.adnxs.com	cdn.pixfuture.com
2	securepubads.g.doubleclick.net	www.googletagservices.com
2	l.sharethis.com	w.sharethis.com securityaffairs.co
2	connect.facebook.net	securityaffairs.co connect.facebook.net
1	cm.mgid.com	1 redirects
1	adserver-us.adtech.advertising.com	cdn.pixfuture.com
1	pixel.wp.com	securityaffairs.co
1	s.w.org	securityaffairs.co
1	c.sharethis.mgr.consensu.org	w.sharethis.com
1	google-analytics.com	securityaffairs.co
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	stats.wp.com	securityaffairs.co
1	platform-api.sharethis.com	securityaffairs.co
1	w.sharethis.com	securityaffairs.co
1	maxcdn.bootstrapcdn.com	securityaffairs.co
215	46

This site contains links to these domains. Also see Links.

Domain
twitter.com
rewtin.blogspot.it
www.fireeye.com
i1.wp.com
www.mdsec.co.uk
blog.nviso.be
www.linkedin.com
www.facebook.com
reddit.com
www.pinterest.com
plus.google.com
www.tumblr.com
www.cssii.unifi.it

Subject Issuer	Validity	Valid
*.media.net DigiCert SHA2 Secure Server CA	`2020-02-25` - `2021-05-26`	a year	crt.sh
www.securityaffairs.co GeoTrust RSA CA 2018	`2020-03-08` - `2021-04-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-12-22` - `2021-03-21`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
sharethis.com Amazon	`2020-08-17` - `2021-09-16`	a year	crt.sh
sharethis.mgr.consensu.org Amazon	`2020-05-05` - `2021-06-05`	a year	crt.sh
*.w.org Sectigo RSA Domain Validation Secure Server CA	`2019-12-19` - `2021-12-18`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-18` - `2021-07-18`	a year	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2020-11-17` - `2021-02-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.pixfuture.com Sectigo RSA Domain Validation Secure Server CA	`2019-12-03` - `2021-12-02`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2019-02-01` - `2021-02-04`	2 years	crt.sh
*.googleadservices.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh

This page contains 32 frames:

Primary Page: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Frame ID: 47E6AD44DA4EE31B029360DE81C3BEA0
Requests: 97 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 6F6B1F1354F83C05DCC03FB6A0884A9C
Requests: 1 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/portal-v2.html
Frame ID: B816D828EDDBD6BB8F87BD7DCAC43E8A
Requests: 1 HTTP requests in this frame

Frame: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24272x320x50x4142x_ADSLOT1&flag=true
Frame ID: 838BB275D6A283FD09BA567249A075A7
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 633AF246ECF40C359691371D5743DD3B
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 1C96C724254736176DD5488D7442FFAF
Requests: 1 HTTP requests in this frame

Frame: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24272x320x50x4142x_ADSLOT1&flag=true
Frame ID: D322907473AF7B92F4FE2DD472825BB2
Requests: 1 HTTP requests in this frame

Frame: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24270x300x250x4142x_ADSLOT1&flag=true
Frame ID: 195E187AC8FD1D5BDB43E2135A01EC5F
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: E8074D464D5F075672ECC69614FC5554
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 969AE3A6735F310F51851F97CD32808E
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
Frame ID: 778C6E046B770BB216C99A0C480AB4E4
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pixfuture.com/djax_elastic.js
Frame ID: F3F66D03E12FAE3A27A29CDB1C3D0A92
Requests: 21 HTTP requests in this frame

Frame: https://cdn.pixfuture.com/djax_elastic.js
Frame ID: 0CF659205611E1C2A42C832BDE69AABF
Requests: 18 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV67306.js
Frame ID: 9398EB16134894A3C02782AE72063C6E
Requests: 7 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV67306.js
Frame ID: 008ACB6E8747E067605AC0586B5511F3
Requests: 6 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV67306.js
Frame ID: 94069E3F930126CF713705DCEBDEF743
Requests: 7 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV67306.js
Frame ID: 3BC1A2F52C3F3B75A82A02CB29AD6C82
Requests: 15 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV67306.js
Frame ID: 4E4D627ABCAD1F0D4C206C8AE48B6E20
Requests: 7 HTTP requests in this frame

Frame: https://contextual.media.net/4a/nrrV67306.js
Frame ID: F5FE44ED083971F2E315137F656CBED3
Requests: 7 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 6687FFA643EFD948A092013F040A31E2
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/zrt_lookup.html
Frame ID: EA02EDA39A72DCAB25BC64862DBB671A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1357492134&pi=t.ma~as.1139220782&w=320&lmt=1610175649&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&flash=0&wgl=1&dt=1610175649624&bpp=17&bdt=32&idt=61&shv=r20201203&cbv=r20190131&ptt=5&saldr=sa&correlator=4908924207289&frm=21&ife=1&pv=2&ga_vid=1361115776.1610175648&ga_sid=1610175650&ga_hid=773169837&ga_fc=1&nhd=3&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=1187&biw=1600&bih=1200&isw=320&ish=50&ifk=1421460154&scr_x=0&scr_y=0&eid=21066700%2C21066793%2C42530672%2C21068083%2C21068769%2C21068986%2C21069719&oid=3&pvsid=2783402013573676&pem=897&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=8196&bc=23&ifi=1&uci=1.yxtedamve753&fsb=1&xpc=4uSNUxpNkw&p=http%3A//securityaffairs.co&dtd=82
Frame ID: 10A9448586C2E8C16699BE1092EBFA0F
Requests: 1 HTTP requests in this frame

Frame: http://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: 603FA35521ABDD45D978BC242D5EB4A7
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1357492135&pi=t.ma~as.1680648786&w=300&lmt=1610175649&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&flash=0&wgl=1&dt=1610175649790&bpp=12&bdt=28&idt=57&shv=r20201203&cbv=r20190131&ptt=5&saldr=sa&cookie=ID%3D172b32b7c0df13e9-226a816b83b9009d%3AT%3D1610175649%3ART%3D1610175649%3AS%3DALNI_MaCZ8AC_FJuozyQnGmE0f2WR4gSVw&correlator=4908924207289&frm=21&ife=1&pv=1&ga_vid=1361115776.1610175648&ga_sid=1610175650&ga_hid=1638108203&ga_fc=1&nhd=3&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=8074&biw=1600&bih=1200&isw=300&ish=250&ifk=4293012932&scr_x=0&scr_y=0&eid=21066700%2C21066793%2C42530672%2C21068083%2C21068769&oid=3&pvsid=4355336010930332&pem=897&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=8196&bc=23&ifi=1&uci=1.l81hutyeddz&btvi=1&fsb=1&xpc=qlgoJayeVB&p=http%3A//securityaffairs.co&dtd=66
Frame ID: 158804E7D543E3EE9672E1D8C2D93AFA
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/220/runner.html
Frame ID: DECFC47E23167BC474F04187BD5256C2
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/220/runner.html
Frame ID: 4CC5D3BFC66106719DB604090EDBCEF9
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 299E77C46850D5EF329D3BCF7F069D19
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=1
Frame ID: 78E164247892AA117391E84469343469
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 67907449BBC9BD3C1EAE5E397ABFB986
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 75E9DA0F2DF283F5FB3D0E70502B1C8B
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=1
Frame ID: B55B36D10BA688E6B011477E1BBB631E
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: B95B721A9D1F67541AC8322874864E05
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

215
Requests

68 %
HTTPS

49 %
IPv6

27
Domains

46
Subdomains

39
IPs

7
Countries

3717 kB
Transfer

6273 kB
Size

14
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/Rewt_1
Title: @Rewt_1

Search URL Search Domain Scan URL

URL: http://rewtin.blogspot.it/2017/04/cve-2017-0199-practical-exploitation-poc.html
Title: a step by step procedure to exploit the recently patched cve-2017-0199 vulnerability

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Title: FireEye publication

Search URL Search Domain Scan URL

URL: https://i1.wp.com/4.bp.blogspot.com/-pEUJF2-17Ts/WPFFuo0Mn0I/AAAAAAAAADc/z4NUXKtXnFk3gO4wdYJvu_eVaKLIVWiBwCLcB/s1600/5.png?ssl=1

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
Title: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html

Search URL Search Domain Scan URL

URL: https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/
Title: https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/

Search URL Search Domain Scan URL

URL: https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/
Title: https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/pub/pierluigi-paganini/b/742/559
Title: Pierluigi Paganini

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer.php?u=https://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=https://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html&text=Windows%20attacks%20via%20CVE-2017-0199%20%E2%80%93%20Practical%20exploitation%21%20%28PoC%29%20
Title: Twitter

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Title: Linkedin

Search URL Search Domain Scan URL

URL: http://reddit.com/submit?url=https://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html&title=Windows%20attacks%20via%20CVE-2017-0199%20%E2%80%93%20Practical%20exploitation!%20(PoC)
Title: Reddit

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html

Search URL Search Domain Scan URL

URL: http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&media=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2Fwp-includes%2Fimages%2Fmedia%2Fdefault.png

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html

Search URL Search Domain Scan URL

URL: http://www.tumblr.com/share/link?url=https%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html

Search URL Search Domain Scan URL

URL: https://www.cssii.unifi.it/vp-89-il-center.html

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28

http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW HTTP 302
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Request Chain 31

http://connect.facebook.net/en_US/sdk.js HTTP 307
https://connect.facebook.net/en_US/sdk.js

Request Chain 32

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 82

http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW HTTP 307
https://contextual.media.net/nmedianet.js?cid=8CU5BD6EW

Request Chain 114

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=N-8Ipnw2S0tsUkhISDBGSjUyZXMxekt2REZ5WTY1OXFOMFFJeXFObVV2elRjZXZtb01VVXAyRzhOenVPbkNHNVF3SFpBV0RMTTg2T3h2bjZqckwrNDg2bC8vWG96VGs1em1NNGZYS2RhelFRRExOeHM5WTFTeE9JWXJpZGE0aEpRRXBlSU1oT052cnpHODN0RFdpdHhBYVYyb2F3STlFN1ZLOTdhNkk4S05Ja1RyUUtPVmVXZnpRejNXUngxeTNpUVJVbXZ4UFFNS2wzT3Vtd0RhSXZMV3RWU0xNMTdjZ3lNcnRKa1BEdkJoUUYrbEc4PXw&cppv=2

Request Chain 117

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=xw9d0HxVcjBNSG9aSHJMK0Vqbkc3aStZRG5FQnRYTC82aDhvdjBtNmk1ejhzdTFkUUpVTFRMM3NqYUlTL2hZRFBzdUYrRE1pdGlPcFo0R21MN1lOZ29FRUhsa3YwZFViZjJLQ2FYQVh2c0w5OElqT3JFRVdWNmJ3WW81TWxycytRSWZBdWt1eUlGOGNVVUV5dlNIUDkzZi9NUnBTazNnZ293TFhNY28yYXh4aUZOTi9kT05JVlU3SFNIVSt0SHcweFJROUF6enlVeWpHSC8zcUQzSHFFMDN5T2czMDNvYXduVlVYK0I1dmZXemdMcXdzPXw&cppv=2

Request Chain 148

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&bundle=52HTrV9WWkFTVzM5WXVXJTJGRWQyaHFnOHdsTCUyQmlVT2hYWmE0S010TklzNWtiSTkwNUtIT1ZabCUyRkF0bjFSZHNhZCUyQnFaMGtxMVpaSTViaVRpVnBvYnc3WW1hanV5OGllbmtyJTJGQTElMkJST3NTaFBQWCUyRkVRbzlGbVVsV0cxOHY4ZmlZcGtvT2Y1&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=9ItQdHwxUVNNb0UvMFdOWk1nUC9VMFA3blhPOUN5UHA0Z1RJNE9xSCtOQVV4MTVWdHRyUFMwMEpleis4V2g2VkYvVmdhVW9vUTdTYkhJenpGcmxYUTVEbzJCRTFqVml5UlFCRWp2bjRsQWp6alk5RGt2WlVIVGRXUmpIS2YzY3F3cUo4SU1RalJkVWptSGkyNHQ2OCtCd0t4a2hhTXRrcFgwNU1qMVBBeUtSQjRETk9TM1pGWDRpdEVRRU9OVEx2Q1NaaFZnL2x4bmJBNFF0My82czl5allLL1RmM0FhblV1RWRrbThjWVZJWXFRemlqTEtDazZJSkhzT2ZHNm15Yk9iMkd2fA&cppv=2

Request Chain 158

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&bundle=52HTrV9WWkFTVzM5WXVXJTJGRWQyaHFnOHdsTCUyQmlVT2hYWmE0S010TklzNWtiSTkwNUtIT1ZabCUyRkF0bjFSZHNhZCUyQnFaMGtxMVpaSTViaVRpVnBvYnc3WW1hanV5OGllbmtyJTJGQTElMkJST3NTaFBQWCUyRkVRbzlGbVVsV0cxOHY4ZmlZcGtvT2Y1&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=0QWgm3w3b1RWSWR4ektLTGw4UGdJRXVYMHJGTVFaRFI1Q21IckFIOTkwV1RmZEFIZmwwbHdMTlVHUngyaThGY3VpSUNxN05XOG1UWVNhQ3NlaFlYb3QvUTZyMHZvWHNOaTNKZTR1WmpsY0N4UmR2emVtdDI4ZmJCTGwvMTZmZ2pTK1NrMExDdXFNU21zNzlWTDFnZytuMFMzM3BsYkVNeUpSVG9KWFNFTmpoSzdKYU54TkJFeEkxRVdEZ05HLy9JUDM4SXdGL2k1ek5veS9LQUVlR0FTRW1aMWgxam5ienBoa09ucUFsOUs0Q2c2Q2wyMXl3SFh3ekU2c0RQTG5CWjNIS0g0fA&cppv=2

Request Chain 192

https://cm.mgid.com/m?cdsp=363893&adu=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Dmgid%26gdpr%3D1%26gdpr_consent%3D%26uid%3D%7Bmuidn%7D HTTP 301
https://prebidserver.pixfuture.com:8000/setuid?bidder=mgid&gdpr=1&gdpr_consent=&uid=l08NtRQuCp0n

215 HTTP transactions
13 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set cve-2017-0199-exploitation-poc.html Show response
securityaffairs.co/wordpress/58077/breaking-news/ 88 KB
26 KB 936ms
919ms Document
text/html 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache / PHP/7.2.34
Resource Hash: 8e2246dbbd785043d2b37afbaec7b42b63e0b09f6ae619a3033b4f3e08268321

Request headers

Host: securityaffairs.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Date: Sat, 09 Jan 2021 07:00:46 GMT
Server: Apache
X-Powered-By: PHP/7.2.34
Link: <https://securityaffairs.co/wordpress/wp-json/>; rel="https://api.w.org/", <https://securityaffairs.co/wordpress/wp-json/wp/v2/posts/58077>; rel="alternate"; type="application/json", <https://securityaffairs.co/wordpress/?p=58077>; rel=shortlink
Set-Cookie: cookielawinfo-checkbox-necessary=yes; expires=Sat, 09-Jan-2021 08:00:47 GMT; Max-Age=3600; path=/ cookielawinfo-checkbox-non-necessary=yes; expires=Sat, 09-Jan-2021 08:00:47 GMT; Max-Age=3600; path=/
Content-Encoding: gzip

GET
H/1.1 200
OK style.css
securityaffairs.co/wordpress/wp-includes/css/dist/block-library/ 61 KB
62 KB 23ms
15ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/css/dist/block-library/style.css?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 8c43e551763d3628fab88767caacb3188f69afa8d1290cf3f9d61ab09cb56073

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 09 Dec 2020 23:30:59 GMT
Server: Apache
ETag: "f520-5b61073a99e2a"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 62752

GET
H/1.1 200
OK cookie-law-info-public.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 3 KB
3 KB 27ms
14ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=1.9.5
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2020 23:05:49 GMT
Server: Apache
ETag: "c25-5b69cea81443a"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3109

GET
H/1.1 200
OK cookie-law-info-gdpr.css
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/ 27 KB
27 KB 29ms
15ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=1.9.5
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: d44b68c7b3e659196a6a72662f4e2e903044d6e64a6a5c0002602711cd68a8fa

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2020 23:05:49 GMT
Server: Apache
ETag: "6cdf-5b69cea81443a"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 27871

GET
H/1.1 200
OK font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 23 KB
6 KB 18ms
7ms Stylesheet
text/css 2001:4de0:ac19::1:b:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

http://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css?ver=835e6db0190dd68741a2c7df5755ec0c

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 12 Dec 2018 18:35:19 GMT
ETag: "1544639719"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
cache-control: public, max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Connection: Keep-Alive
Accept-Ranges: bytes
timing-allow-origin: *
Content-Length: 5442

GET
H/1.1 200
OK frontend.css
securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/css/ 7 KB
7 KB 28ms
15ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/css/frontend.css?ver=1610175647
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 24583638f8c4bd2d5dff22bddefbb24f8d047868e71ad2c029b1698b6926c85c

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2020 23:05:51 GMT
Server: Apache
ETag: "1c69-5b69ceaa65099"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 7273

GET
H/1.1 200
OK custom.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/ 19 KB
20 KB 29ms
16ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jqueryui/custom.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 13:54:59 GMT
Server: Apache
ETag: "4d92-52704407f72c0"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 19858

GET
H/1.1 200
OK tipsy.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 539 B
799 B 27ms
14ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/tipsy.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:04 GMT
Server: Apache
ETag: "21b-526fe6d7cd700"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 539

GET
H/1.1 200
OK flexslider.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 6 KB
6 KB 43ms
14ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/flexslider.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 13:55:09 GMT
Server: Apache
ETag: "1851-5270441180940"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 6225

GET
H/1.1 200
OK mediaelementplayer-legacy.min.css
securityaffairs.co/wordpress/wp-includes/js/mediaelement/ 11 KB
11 KB 44ms
15ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 09 Dec 2020 23:31:00 GMT
Server: Apache
ETag: "2bf8-5b61073af996a"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 11256

GET
H/1.1 200
OK animation.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 2 KB
2 KB 44ms
14ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/animation.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:02 GMT
Server: Apache
ETag: "6b4-526fe6d5e5280"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1716

GET
H/1.1 200
OK font-awesome.min.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 17 KB
18 KB 49ms
14ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:02 GMT
Server: Apache
ETag: "4574-526fe6d5e5280"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 17780

GET
H/1.1 200
OK swipebox.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 4 KB
5 KB 53ms
13ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/swipebox.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:18 GMT
Server: Apache
ETag: "118d-526fe6e527680"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4493

GET
H/1.1 200
OK jquery.circliful.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 334 B
594 B 53ms
13ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/jquery.circliful.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:02 GMT
Server: Apache
ETag: "14e-526fe6d5e5280"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 334

GET
H/1.1 200
OK screen.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 110 KB
110 KB 60ms
16ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/screen.css?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:04 GMT
Server: Apache
ETag: "1b844-526fe6d7cd700"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 112708

GET
H/1.1 200
OK custom-css.php
securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/ 12 KB
12 KB 99ms
54ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/templates/custom-css.php?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache / PHP/7.2.34
Resource Hash: 18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Server: Apache
Connection: keep-alive
X-Powered-By: PHP/7.2.34
Transfer-Encoding: chunked
Keep-Alive: timeout=15
Content-Type: text/css; charset: UTF-8;charset=UTF-8

GET
H/1.1 200
OK css
fonts.googleapis.com/ 9 KB
1 KB 18ms
14ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Roboto+Condensed%3A400italic%2C700italic%2C400%2C700&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Cgreek%2Ccyrillic%2Clatin-ext%2Cvietnamese&ver=835e6db0190dd68741a2c7df5755ec0c

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0c52182f8e00c9bb8b8d38697c894144d4470ab9ccce7fc3b38e3a25873f01d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 09 Jan 2021 07:00:47 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:47 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 3 KB
1 KB 25ms
16ms Stylesheet
text/css 2a00:1450:4001:825::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6625aeb9828db5fb40690a208e5ff4cd48d90c00b5d8cd4462fb4d41f76cb89a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 09 Jan 2021 07:00:47 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:47 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 4 KB
1 KB 23ms
14ms Stylesheet
text/css 2a00:1450:4001:825::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=835e6db0190dd68741a2c7df5755ec0c

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c9490670cfbc3c585ad08b2ef0fbcdbd5dcc48704dfe5689e117dee3382cc5c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 09 Jan 2021 07:00:47 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:47 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 3 KB
1 KB 23ms
15ms Stylesheet
text/css 2a00:1450:4001:825::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=835e6db0190dd68741a2c7df5755ec0c

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d528130ac8be48ae8edf4b85131e7a81270216c59c0d0c1b564dd6c38741bf69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 09 Jan 2021 07:00:47 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:47 GMT

GET
H/1.1 200
OK grid.css
securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/ 49 KB
50 KB 59ms
15ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/grid.css?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:03 GMT
Server: Apache
ETag: "c5f2-526fe6d6d94c0"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 50674

GET
H/1.1 200
OK frontend.js Show response
securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/ 23 KB
23 KB 64ms
15ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/google-analytics-dashboard-for-wp/assets/js/frontend.js?ver=1610175647
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 9b5b9b8b1984a7b55656ca3d243deb436e049467353f6e61e73ac8bd0ab2a636

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2020 23:05:51 GMT
Server: Apache
ETag: "5b01-5b69ceaa6dd39"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 23297

GET
H/1.1 200
OK jquery.js Show response
securityaffairs.co/wordpress/wp-includes/js/jquery/ 281 KB
281 KB 70ms
18ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery.js?ver=3.5.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 86f937a29eaee70aaf9935799a414bea46c62fb136cc0465f63f9d6820cf4982

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 09 Dec 2020 23:31:00 GMT
Server: Apache
ETag: "463a2-5b61073af5aea"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 287650

GET
H/1.1 200
OK jquery-migrate.js Show response
securityaffairs.co/wordpress/wp-includes/js/jquery/ 25 KB
25 KB 66ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 09 Dec 2020 23:31:00 GMT
Server: Apache
ETag: "62d4-5b61073af5aea"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 25300

GET
H/1.1 200
OK cookie-law-info-public.js Show response
securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/ 33 KB
33 KB 81ms
15ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=1.9.5
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: a902ffc1c259dc54cb51d32618f4238568e5bcac3d32afc33e6729277f67dffb

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2020 23:05:49 GMT
Server: Apache
ETag: "8319-5b69cea81443a"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 33561

GET
H/1.1 200
OK medianetAdInjector.js Show response
securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/ 741 B
1015 B 85ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/media-net-ads-manager/js/medianetAdInjector.js?ver=2.10.9
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: c8817bacfc84fd39e4daec4096011ed3d117c7fe8b3c55fdd22af47c299099bc

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 09 Dec 2020 23:32:00 GMT
Server: Apache
ETag: "2e5-5b610774a540e"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 741

GET
H/1.1 200
OK st_insights.js Show response
w.sharethis.com/button/ 27 KB
8 KB 32ms
12ms Script
application/javascript 2600:9000:2190:f400:3:c04e:c780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://w.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2600:9000:2190:f400:3:c04e:c780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 2d5a9aa4eabdb58974140a8dfdacfe1ddb89ae27819ad19e8e148649936dac4a

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 08 Jan 2021 00:39:21 GMT
Content-Encoding: gzip
Age: 109286
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 7721
Server: nginx/1.16.1
ETag: W/"5fce7d95-6a23"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
Cache-Control: max-age=259200
X-Amz-Cf-Pop: ZRH50-C1
X-Robots-Tag: noindex, nofollow
X-Amz-Cf-Id: e_wbZgOThYuxsD68LlPtNEbKuJntOewOCLNR30cN3Tw6DpriymJqbw==
Expires: Mon, 11 Jan 2021 00:39:21 GMT

GET
H/1.1 200
OK sharethis.js Show response
platform-api.sharethis.com/js/ 100 KB
32 KB 25ms
11ms Script
text/javascript 2600:9000:2190:8600:1c:8a07:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://platform-api.sharethis.com/js/sharethis.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2600:9000:2190:8600:1c:8a07:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 47f5b2ba7dc4b1d498cf2f83bb1df236323a984a0d58e7a38e19951e39bd176f

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 06:51:50 GMT
Content-Encoding: gzip
Connection: keep-alive
Age: 537
ETag: W/"191a1-f+Ej8FZ9fSI4UoZYvR0ukXG/9to"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/javascript; charset=utf-8
Via: 1.1 7245e91891539560c1f484b1e46159c9.cloudfront.net (CloudFront)
Edge-control: cache-maxage=60m,downstream-ttl=60m
Cache-Control: max-age=600, public
Transfer-Encoding: chunked
X-Amz-Cf-Pop: ZRH50-C1
X-Amz-Cf-Id: PTR78WszK3O0hy8v9_I1wPsIogipNcrijS9LN5QvP5-F5KxGFDdkDA==

GET
H/1.1 200
OK shield-antibot.js Show response
securityaffairs.co/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/ 3 KB
3 KB 87ms
15ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/wp-simple-firewall/resources/js/shield-antibot.js?ver=10.1.5&mtime=1607550551
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: d24350e3a8c6e3963544189c3d0cfcd8c11e5dbac0de76aace83993b7d16dcf6

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 09 Dec 2020 21:49:11 GMT
Server: Apache
ETag: "c00-5b60f0797443f"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3072

GET
H2

200

dmedianet.js Show response
contextual.media.net/
Redirect Chain

http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

147 KB
50 KB

113ms
66ms

Script
text/javascript

2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

fb75a5747f9ec8d7051a06752ffb2b905e81fe3134379a54926d146dadf3b6bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-mnt-h: 10-4
content-encoding: gzip
server: Apache
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
etag: "235a6d3ef2c86a1cba608fe488687392"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:48 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-13
expires: Sat, 09 Jan 2021 07:05:48 GMT

Redirect headers

Location: https://contextual.media.net/dmedianet.js?cid=8CU5BD6EW
Date: Sat, 09 Jan 2021 07:00:47 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=604800

GET
H2 200 logo_SecurityAffairs.png
securityaffairs.co/wordpress/wp-content/uploads/2015/12/ 44 KB
44 KB 57ms
28ms Image
image/png 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securityaffairs.co/wordpress/wp-content/uploads/2015/12/logo_SecurityAffairs.png
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:48 GMT
last-modified: Wed, 16 Dec 2015 17:30:42 GMT
server: Apache
accept-ranges: bytes
etag: "b0e9-5270743f5f480"
content-length: 45289
content-type: image/png

GET
H/1.1 200
OK headerbid.js Show response
served-by.pixfuture.com/www/delivery/ 3 KB
4 KB 178ms
165ms Script
application/javascript 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://served-by.pixfuture.com/www/delivery/headerbid.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 177d76801bdbecdb0d27109e118ae54a929156deac8ca44b46924a5c0f43cd7a

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Last-Modified: Mon, 02 Nov 2020 17:46:21 GMT
Server: nginx/1.10.3 (Ubuntu)
ETag: "5fa045ed-d42"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length: 3394

GET
H2

200

sdk.js Show response
connect.facebook.net/en_US/
Redirect Chain

http://connect.facebook.net/en_US/sdk.js
https://connect.facebook.net/en_US/sdk.js

3 KB
2 KB

6ms
6ms

Script
application/x-javascript

2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2991b7d17a1c5edbab11290738d6a7694c008fd78dbd2f9a466bec7ba5920b00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 3yDTMRTvpVgiQFplw6kTuw==
cross-origin-resource-policy: cross-origin
expires: Sat, 09 Jan 2021 07:09:30 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1777
x-fb-rlafr: 0
x-fb-debug: wkfRbDrn0WPvNLRlPKqrEchF8iqkdo/nDotOWL2dwEatX0wS8zTpbAXlZsPwJxxtHER2OKbymelh+kcySA6KDw==
x-fb-trip-id: 1814657579
x-fb-content-md5: 43d55e740d2427d8dec37f6fe964b516
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 09 Jan 2021 07:00:48 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "92ad18c2b0b06284b712613b3e6b7fad"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

Redirect headers

Location: https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.6
Non-Authoritative-Reason: HSTS

GET
H2

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

46 KB
18 KB

6ms
6ms

Script
text/javascript

2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 6076
date: Sat, 09 Jan 2021 05:19:32 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Sat, 09 Jan 2021 07:19:32 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK twemoji.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 27 KB
28 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/twemoji.js?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e98cd00e7be004c4360ad0c38471911312d74a117babcc29f239935afc80c8cb

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Last-Modified: Wed, 09 Dec 2020 23:31:00 GMT
Server: Apache
ETag: "6d6a-5b61073b100ca"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 28010

GET
H/1.1 200
OK wp-emoji.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 9 KB
9 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/wp-emoji.js?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Last-Modified: Tue, 31 Mar 2020 22:49:14 GMT
Server: Apache
ETag: "231d-5a22e608152f1"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 8989

GET
H2 200 facebook.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 830 B
1 KB 46ms
14ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 5
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
x-bytes-saved: 290
last-modified: Sun, 09 Jun 2019 09:59:37 GMT
server: nginx
etag: "e076e158ac718305"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/facebook.png>; rel="canonical"
content-length: 830
expires: Tue, 08 Jun 2021 21:59:37 GMT

GET
H2 200 twitter.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 1 KB
1 KB 15ms
15ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

650868ebc4c00b2ea4ea72747f655f8a0552ba53c9b5b55defd9457be75f1aa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Jun 2020 20:55:30 GMT
server: nginx
etag: "5e9a88de44c47cf4"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/twitter.png>; rel="canonical"
content-length: 1082
expires: Sat, 11 Jun 2022 08:55:30 GMT

GET
H2 200 linkedin.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 1 KB
1 KB 15ms
15ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
x-bytes-saved: 442
last-modified: Tue, 05 Feb 2019 06:25:34 GMT
server: nginx
etag: "2a93de08dbecd1ae"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/linkedin.png>; rel="canonical"
content-length: 1182
expires: Thu, 04 Feb 2021 18:25:34 GMT

GET
H2 200 reddit.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 2 KB
2 KB 16ms
15ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

56159a7fa211c042c8da7005984653715f938917383f74292247f7b271469fb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 6
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Jun 2020 20:55:30 GMT
server: nginx
etag: "762664a32ff1b2a7"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/reddit.png>; rel="canonical"
content-length: 1566
expires: Sat, 11 Jun 2022 08:55:30 GMT

GET
H2 200 pinterest.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/ 1 KB
2 KB 17ms
15ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

936c3e0cfba7a07ab55be383aeca9d39dcde7b4e9cddbfd973f78e34d3cc7078

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Jun 2020 20:55:29 GMT
server: nginx
etag: "6ab724bd3ff52aaa"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/buttons/somacro/pinterest.png>; rel="canonical"
content-length: 1498
expires: Sat, 11 Jun 2022 08:55:29 GMT

GET
H2 200 north-korea-missile-launch.jpg
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/ 21 KB
21 KB 43ms
42ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/north-korea-missile-launch.jpg?resize=300%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

8366ed0ada18d2a7861821f7e0cf3b9f664887185f8318c7d849674a081cf055

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: MISS ams 8
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Sat, 09 Jan 2021 07:00:48 GMT
server: nginx
etag: "4e5a0e40733f91f2"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2017/04/north-korea-missile-launch.jpg>; rel="canonical"
content-length: 21188
expires: Mon, 09 Jan 2023 19:00:48 GMT

GET
H/1.1 200
OK ssba.css
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ 122 KB
122 KB 16ms
15ms Stylesheet
text/css 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/css/ssba.css?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: f4d4eda42f85c6ccbbb5de2aff596085b3b1d380c8585464f2e53df2cad66f8e

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Fri, 25 Dec 2020 23:58:53 GMT
Server: Apache
ETag: "1e76e-5b752b4e76df8"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 124782

GET
H/1.1 200
OK photon.js Show response
securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/ 2 KB
2 KB 16ms
16ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/jetpack/modules/photon/photon.js?ver=20191001
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Thu, 10 Dec 2020 23:15:29 GMT
Server: Apache
ETag: "6e0-5b6245a12c950"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1760

GET
H/1.1 200
OK jquery.adrotate.clicktracker.js Show response
securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/ 365 B
639 B 14ms
13ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Fri, 27 Nov 2020 22:56:17 GMT
Server: Apache
ETag: "16d-5b51e916e3b6e"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 365

GET
H/1.1 200
OK ssba.js Show response
securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ 2 KB
2 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/plugins/simple-share-buttons-adder/js/ssba.js?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Fri, 25 Dec 2020 23:58:53 GMT
Server: Apache
ETag: "792-5b752b4e7bc18"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 1938

GET
H/1.1 200
OK hint.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 987 B
1 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/hint.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "3db-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 987

GET
H/1.1 200
OK jquery.tipsy.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 4 KB
5 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.tipsy.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "1113-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 4371

GET
H/1.1 200
OK jquery.easing.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 8 KB
8 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.easing.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "1fa1-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 8097

GET
H/1.1 200
OK browser.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 3 KB
3 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/browser.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:16 GMT
Server: Apache
ETag: "a36-526fe6e33f200"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 2614

GET
H/1.1 200
OK jquery.flexslider-min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/ 21 KB
21 KB 15ms
15ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/flexslider/jquery.flexslider-min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 13:55:10 GMT
Server: Apache
ETag: "53ae-5270441274b80"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 21422

GET
H/1.1 200
OK waypoints.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 8 KB
8 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/waypoints.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:18 GMT
Server: Apache
ETag: "1f6c-526fe6e527680"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 8044

GET
H/1.1 200
OK mediaelement-and-player.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/ 69 KB
70 KB 15ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/mediaelement/mediaelement-and-player.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 13:55:14 GMT
Server: Apache
ETag: "11571-5270441645480"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 71025

GET
H/1.1 200
OK jquery.swipebox.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 11 KB
11 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.swipebox.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "2a67-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 10855

GET
H/1.1 200
OK jquery.circliful.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 3 KB
3 KB 15ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.circliful.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "c18-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3096

GET
H/1.1 200
OK jquery.smarticker.min.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 13 KB
13 KB 16ms
16ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/jquery.smarticker.min.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:17 GMT
Server: Apache
ETag: "3225-526fe6e433440"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 12837

GET
H/1.1 200
OK custom.js Show response
securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/ 12 KB
13 KB 15ms
15ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/js/custom.js?ver=1.4.1
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:16 GMT
Server: Apache
ETag: "31d4-526fe6e33f200"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 12756

GET
H/1.1 200
OK wp-embed.js Show response
securityaffairs.co/wordpress/wp-includes/js/ 3 KB
3 KB 14ms
14ms Script
application/javascript 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-includes/js/wp-embed.js?ver=835e6db0190dd68741a2c7df5755ec0c
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:47 GMT
Last-Modified: Thu, 21 Feb 2019 22:56:38 GMT
Server: Apache
ETag: "c8e-5826f6315ef61"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 3214

GET
H2 200 e-202101.js Show response
stats.wp.com/ 9 KB
3 KB 46ms
14ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202101.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams
date: Sat, 09 Jan 2021 07:00:48 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
expires: Sat, 01 Jan 2022 07:56:51 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 195 KB
59 KB 19ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a3fdf341e1eb9bcae0bf4aa500e0b8d0&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: http://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bcdd0df07b97be453ca5a77a1582ea69c99153acd15c1038b2c5c4d29ac1b8ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: AVCdR0iZlXVenfM0oJHdLA==
cross-origin-resource-policy: cross-origin
expires: Sun, 09 Jan 2022 05:59:50 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 60132
x-fb-rlafr: 0
x-fb-debug: 6/L+45etaA4HxKjGYQka0DIEe0DVbyGH8Au28w+rE8ZYKCYGU87vR9qgY51Y8Jd0GPZqox/Y9pugKXMOQNYujA==
x-fb-trip-id: 1814657579
x-fb-content-md5: 6ad80943a6d19d02d93cd905a62c0966
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 09 Jan 2021 07:00:48 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "dd46305c3f7633b81792117b014bcd98"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
127 B 13ms
12ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1023740176&t=pageview&_s=1&dl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&ul=en-us&de=UTF-8&dt=Windows%20attacks%20via%20CVE-2017-0199%20-%20Practical%20exploitation!%20(PoC)Security%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABCAAAAC~&jid=760738812&gjid=594973542&cid=1361115776.1610175648&tid=UA-59069958-1&_gid=1683456065.1610175648&_r=1&_slc=1&did=dNDMyYj&z=140310070

Requested by

Host: www.google-analytics.com
URL: http://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5b71b64b04b9a500117b1015.js Show response
buttons-config.sharethis.com/js/ 30 B
379 B 422ms
394ms Script
text/javascript 2600:9000:2190:3800:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons-config.sharethis.com/js/5b71b64b04b9a500117b1015.js
Requested by: Host: platform-api.sharethis.com
URL: http://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:3800:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
via: 1.1 e8a7e21f51478f02a6e51b69e3450928.cloudfront.net (CloudFront)
last-modified: Mon, 13 Aug 2018 16:48:12 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
etag: "e6e1643313740711175f51662a65b42f"
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: max-age=60,public
accept-ranges: bytes
content-length: 30
x-amz-cf-id: qG2pb6HZkjRnyL3uaaM12MffAHAXcL6L9-2yATkQvyUIfUDOeZdmMQ==

GET
H2 200 analytics.js Show response
google-analytics.com/ 46 KB
19 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://google-analytics.com/analytics.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 7144
date: Sat, 09 Jan 2021 05:01:44 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Sat, 09 Jan 2021 07:01:44 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
63 B 6ms
5ms Image
image/gif 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j87&a=1023740176&t=pageview&_s=2&dl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&ul=en-us&de=UTF-8&dt=Windows%20attacks%20via%20CVE-2017-0199%20-%20Practical%20exploitation!%20(PoC)Security%20Affairs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAUABCAAAAC~&jid=&gjid=&cid=1361115776.1610175648&tid=UA-59069958-1&_gid=1683456065.1610175648&did=dNDMyYj&z=1256603790

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Jan 2021 07:43:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 83846
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYjMdZwl.woff2
fonts.gstatic.com/s/oswald/v35/ 17 KB
18 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/oswald/v35/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYjMdZwl.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=835e6db0190dd68741a2c7df5755ec0c

Protocol

HTTP/1.1

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91f4f1aa2437cf886a484ac410eab84dfe059d24ec6249c52f50509e756b730c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Oswald%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=835e6db0190dd68741a2c7df5755ec0c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 07 Jan 2021 14:17:41 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Jul 2020 19:17:00 GMT
Server: sffe
Age: 146587
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 17540
X-XSS-Protection: 0
Expires: Fri, 07 Jan 2022 14:17:41 GMT

GET
H/1.1 200
OK S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v17/ 14 KB
14 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c

Protocol

HTTP/1.1

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 07 Jan 2021 20:19:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:12:59 GMT
Server: sffe
Age: 124888
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14044
X-XSS-Protection: 0
Expires: Fri, 07 Jan 2022 20:19:20 GMT

GET
H/1.1 200
OK fontawesome-webfont.woff
securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/ 43 KB
44 KB 16ms
15ms Font
application/font-woff 2001:8d8:100f:f000::289
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/fonts/fontawesome-webfont.woff?v=4.0.3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
Protocol: HTTP/1.1
Server: 2001:8d8:100f:f000::289 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/wp-content/themes/rigel_old/css/font-awesome.min.css?ver=1.4.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Last-Modified: Wed, 16 Dec 2015 06:58:09 GMT
Server: Apache
ETag: "ad90-526fe6dc92240"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 44432

GET
H/1.1 200
OK nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgEM86xQ.woff2
fonts.gstatic.com/s/playfairdisplay/v21/ 32 KB
33 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/playfairdisplay/v21/nuFiD-vYSZviVYUb_rj3ij__anPXDTzYgEM86xQ.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=835e6db0190dd68741a2c7df5755ec0c

Protocol

HTTP/1.1

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb7d97eb19604573681684dfe0fef40692a943c29f59d11e7ba9eb39242e4e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Playfair+Display%3A400%2C700%2C400italic&subset=latin%2Ccyrillic-ext%2Cgreek-ext%2Ccyrillic&ver=835e6db0190dd68741a2c7df5755ec0c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 07 Jan 2021 16:01:45 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 26 Jun 2020 02:30:35 GMT
Server: sffe
Age: 140343
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 33256
X-XSS-Protection: 0
Expires: Fri, 07 Jan 2022 16:01:45 GMT

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 69 KB
23 KB 560ms
560ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=829833831&size=300x250&cc=NL&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&nse=5&vi=1610175648177685265&lw=1&ugd=4&nb=1&cb=window._mNDetails.initAd

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

6f3590f88e220dd4f5f21e6b8846a01f54f4b3c3619c796c19f54425186a9c0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 12-1
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:49 GMT
x-mnt-w: 10-16, 10-2
content-length: 23534
expires: Sat, 09 Jan 2021 07:05:49 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 6F6B 0
0 46ms
46ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Tue, 13 Jul 2021 07:00:48 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=123035
expires: Sun, 10 Jan 2021 17:11:23 GMT
date: Sat, 09 Jan 2021 07:00:48 GMT
content-length: 5460

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 37ms
30ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=829833831&vi=1610175648177685265&ugd=4&lf=6&cc=NL&lper=100&wsip=2886781044&r=1610175648580&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001610175648575031177223685721&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:48 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 09 Jan 2021 07:00:48 GMT

GET
H2 200 portal-v2.html
c.sharethis.mgr.consensu.org/ Frame B816 0
0 38ms
11ms Document
text/html 2600:9000:2190:9e00:c:a9b7:ddc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/portal-v2.html
Requested by: Host: w.sharethis.com
URL: http://w.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:9e00:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: c.sharethis.mgr.consensu.org
:scheme: https
:path: /portal-v2.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

content-type: text/html; charset=utf-8
content-encoding: gzip
date: Sat, 09 Jan 2021 06:43:44 GMT
cache-control: max-age=3600, public
etag: W/"83a-K1Ex0xzH2LCxSyRnDnyZEg18N68"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9349ae4f82564896b96f5303b030d189.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: nqA6jzumSzWDMc-vwea3vmAnm5anfWyFpylMprmxYgA2FtSxmfTaYw==
age: 1024

GET
H/1.1 200
OK S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c

Protocol

HTTP/1.1

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 07 Jan 2021 21:18:59 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:12:25 GMT
Server: sffe
Age: 121309
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14176
X-XSS-Protection: 0
Expires: Fri, 07 Jan 2022 21:18:59 GMT

GET
H2 200 CVE-2017-0199-1.png
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/ 2 KB
2 KB 26ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/CVE-2017-0199-1.png?w=320&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

ba1efe6560ba6405f01d0afdadb2eeb510308eb853e4fec4250fe90b2895e21f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: MISS ams 7
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Sat, 09 Jan 2021 07:00:48 GMT
server: nginx
etag: "72aaba9681dbb32c"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2017/04/CVE-2017-0199-1.png>; rel="canonical"
content-length: 2128
expires: Mon, 09 Jan 2023 19:00:48 GMT

GET
H2 200 CVE-2017-0199-2.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/ 16 KB
16 KB 49ms
48ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/CVE-2017-0199-2.png?w=640&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

78b32fbe4d4a6f9102f2a00e58424686cf3b7a4f9aac9863fa6096b665338075

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: MISS ams 1
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Sat, 09 Jan 2021 07:00:48 GMT
server: nginx
etag: "7179196f32fcecf9"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2017/04/CVE-2017-0199-2.png>; rel="canonical"
content-length: 15958
expires: Mon, 09 Jan 2023 19:00:48 GMT

GET
H2 200 CVE-2017-0199-3.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/ 10 KB
10 KB 51ms
50ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2017/04/CVE-2017-0199-3.png?w=640&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

bebe7080e566832958db2d1ae0ac5cffcb6ee64ca4a5dda453e7bb5587779425

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: MISS ams 4
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Sat, 09 Jan 2021 07:00:48 GMT
server: nginx
etag: "a49c4664de7d5e33"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2017/04/CVE-2017-0199-3.png>; rel="canonical"
content-length: 10032
expires: Mon, 09 Jan 2023 19:00:48 GMT

GET headerbid_refresh_alex.php
served-by.pixfuture.com/www/delivery/ Frame 838B 0
0

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 72 KB
24 KB 552ms
551ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=NL&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&nse=5&vi=1610175648573539226&lw=1&ugd=4&nb=1&cb=window._mNDetails.initAd

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0af2ffd88a1103a78ab2f29b330595ecf02311fb4cacc702ef4b48e44157318e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 12-1
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:49 GMT
x-mnt-w: 10-3, 10-13
content-length: 23971
expires: Sat, 09 Jan 2021 07:05:49 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 633A 0
0 65ms
65ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Tue, 13 Jul 2021 07:00:48 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=123035
expires: Sun, 10 Jan 2021 17:11:23 GMT
date: Sat, 09 Jan 2021 07:00:48 GMT
content-length: 5460

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 36ms
36ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1610175648573539226&ugd=4&lf=6&cc=NL&lper=100&wsip=2886781044&r=1610175648638&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001610175648636031177223682373&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:48 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 09 Jan 2021 07:00:48 GMT

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 76 KB
27 KB 627ms
627ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=816788371&size=300x250&cc=NL&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&nse=5&vi=1610175648600405368&lw=1&ugd=4&nb=1&cb=window._mNDetails.initAd

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3c5aa35877bfa01198d2f3f27581c8547e6767c6ff155595d82b3073c7da1248

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 12-1
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:49 GMT
x-mnt-w: 8-18, 8-10
content-length: 27342
expires: Sat, 09 Jan 2021 07:05:49 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 1C96 0
0 63ms
62ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Tue, 13 Jul 2021 07:00:48 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=123035
expires: Sun, 10 Jan 2021 17:11:23 GMT
date: Sat, 09 Jan 2021 07:00:48 GMT
content-length: 5460

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 44ms
43ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=816788371&vi=1610175648600405368&ugd=4&lf=6&cc=NL&lper=100&wsip=2886781044&r=1610175648661&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001610175648636031177223682373&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:48 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 09 Jan 2021 07:00:48 GMT

GET
H2

200

nmedianet.js Show response
contextual.media.net/
Redirect Chain

http://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
https://contextual.media.net/nmedianet.js?cid=8CU5BD6EW

146 KB
50 KB

48ms
48ms

Script
text/javascript

2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/nmedianet.js?cid=8CU5BD6EW

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

5114d7ca3cfbfea81b689b0d8e018cc6365b09faa27cbe87dc441a642e4a68f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-mnt-h: 12-1
content-encoding: gzip
server: Apache
etag: "1502ae7d120ad9171ce7242f1fd8a604"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:48 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-18
expires: Sat, 09 Jan 2021 07:05:48 GMT

Redirect headers

Location: https://contextual.media.net/nmedianet.js?cid=8CU5BD6EW
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK S6u_w4BMUTPHjxsI5wq_Gwftx9897g.woff2
fonts.gstatic.com/s/lato/v17/ 14 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI5wq_Gwftx9897g.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c

Protocol

HTTP/1.1

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50f4eb73e4854117bf7bf9da7dc0c17740b03b5db6eb7ee6ffc20aeb35c1ea48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://securityaffairs.co
Referer: http://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic&ver=835e6db0190dd68741a2c7df5755ec0c
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 07 Jan 2021 15:34:37 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:10:38 GMT
Server: sffe
Age: 141971
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 14836
X-XSS-Protection: 0
Expires: Fri, 07 Jan 2022 15:34:37 GMT

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
339 B 90ms
23ms XHR
text/plain 3.127.132.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1610175648517.95288&hostname=securityaffairs.co&location=%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&bsamesite=true&consent_cookie_duration=174&consent_duration=174&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&gdpr_method=cookie&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&title=Windows%20attacks%20via%20CVE-2017-0199%20-%20Practical%20exploitation!%20(PoC)Security%20Affairs&sop=false&description=The%20Security%20expert%C2%A0David%20Routin%20(%40Rewt_1)%20has%20detailed%20a%20step%20by%20step%20procedure%20to%20exploit%20the%20recently%20patched%20cve-2017-0199%20vulnerability%20exploited%20in%20Windows%20attacks%20in%20the%20wild.%20Introduction%20Since%20several%20days%20the%20security%20community%20has%20been%20informed%20thanks%20to%C2%A0FireEye%20publication%C2%A0of%20different%20malware%20campaigns%20(Dridex%E2%80%A6)%20leveraging%20the%20CVE-2017-0199.%20Several%20other%20publications%20were%20related%20to%20this%20vulnerability%20but%20%5B%E2%80%A6%5D
Requested by: Host: w.sharethis.com
URL: http://w.sharethis.com/button/st_insights.js?publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&product=simpleshare
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.132.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-132-197.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: http://securityaffairs.co
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK headerbid_refresh_alex.php Show response
served-by.pixfuture.com/www/delivery/ Frame D322 10 KB
11 KB 222ms
209ms Script
text/javascript 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24272x320x50x4142x_ADSLOT1&flag=true
Requested by: Host: served-by.pixfuture.com
URL: http://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol: HTTP/1.1
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 44874bef62dddd5725fda1cd332c2a806eb0ec4526a9e4311e72a4914598f730

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:48 GMT
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H/1.1 200
OK headerbid_refresh_alex.php Show response
served-by.pixfuture.com/www/delivery/ Frame 195E 11 KB
11 KB 205ms
192ms Script
text/javascript 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24270x300x250x4142x_ADSLOT1&flag=true
Requested by: Host: served-by.pixfuture.com
URL: http://served-by.pixfuture.com/www/delivery/headerbid.js
Protocol: HTTP/1.1
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 05848a31b44a7d8adee51d4a583c006df6e096e2bc971ef88aeac32dc125122d

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:48 GMT
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 73 KB
24 KB 492ms
492ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=733976884&size=300x250&cc=NL&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&nse=5&vi=1610175648707783434&lw=1&ugd=4&nb=1&cb=window._mNDetails.initAd

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

33af102c76fdc1f99705d18595168fbb9e66e5d9f283fe258b2deab560374254

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 12-1
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:49 GMT
x-mnt-w: 10-4, 10-16
content-length: 24183
expires: Sat, 09 Jan 2021 07:05:49 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame E807 0
0 100ms
100ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Tue, 13 Jul 2021 07:00:48 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=123035
expires: Sun, 10 Jan 2021 17:11:23 GMT
date: Sat, 09 Jan 2021 07:00:48 GMT
content-length: 5460

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 50ms
49ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=733976884&vi=1610175648707783434&ugd=4&lf=6&cc=NL&wsip=2886781335&r=1610175648769&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001610175648766031177223689127&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:48 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 09 Jan 2021 07:00:48 GMT

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 52 KB
13 KB 554ms
554ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=184323154&size=300x250&cc=NL&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&nse=5&vi=1610175648156061806&lw=1&ugd=4&nb=1&cb=window._mNDetails.initAd

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e1ff8dee2622af6ca24da1d025aa91316b829006c44abf4fe27de5fe572f2633

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 12-1
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:49 GMT
x-mnt-w: 10-2, 10-15
content-length: 13100
expires: Sat, 09 Jan 2021 07:05:49 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 969A 0
0 86ms
86ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Tue, 13 Jul 2021 07:00:48 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=123035
expires: Sun, 10 Jan 2021 17:11:23 GMT
date: Sat, 09 Jan 2021 07:00:48 GMT
content-length: 5460

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 44ms
44ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&vi=1610175648156061806&ugd=4&lf=6&cc=NL&wsip=2886781335&r=1610175648795&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001610175648793031177223684485&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:48 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 09 Jan 2021 07:00:48 GMT

GET
H2 200 fcmain.js Show response
contextual.media.net/1017354394/ 76 KB
24 KB 676ms
676ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/1017354394/fcmain.js?&gdpr=1&cid=8CU5BD6EW&cpcd=RlAcVccC-RdUYIl-LjF9ag%3D%3D&crid=647633027&size=300x250&cc=NL&https=1&vif=1&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&nse=5&vi=1610175648905964403&lw=1&ugd=4&nb=1&cb=window._mNDetails.initAd

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e9ca730d43d9afa60d924da59c74c8fb3a380648a2f4286dee4b76c74676d868

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
x-mnt-hl2: 12-1
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=300
date: Sat, 09 Jan 2021 07:00:49 GMT
x-mnt-w: 8-1, 8-12
content-length: 24014
expires: Sat, 09 Jan 2021 07:05:49 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 778C 0
0 83ms
83ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&gdpr=1&usp_status=0&cs=2&cv=31&cid=8CU5BD6EW&https=1&itype=CM
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Tue, 13 Jul 2021 07:00:48 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=123035
expires: Sun, 10 Jan 2021 17:11:23 GMT
date: Sat, 09 Jan 2021 07:00:48 GMT
content-length: 5460

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 48ms
47ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&vi=1610175648905964403&ugd=4&lf=6&cc=NL&lper=100&wsip=2886781335&r=1610175648801&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vgd_l2type=setting&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=9009&vgd_uspa=0&hvsid=00001610175648800031177223685006&gdpr=1&vgd_end=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:48 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Sat, 09 Jan 2021 07:00:48 GMT

GET
H/1.1 204
No Content pview
l.sharethis.com/ 0
315 B 24ms
24ms Image
text/plain 3.127.132.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.sharethis.com/pview?event=pview&version=st_insights.js&lang=en&sessionID=1610175648517.95288&hostname=securityaffairs.co&location=%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&product=simpleshare&fcmp=false&fcmpv2=false&publisher=4d48b7c5-0ae3-43d4-bfbe-3ff8c17a8ae6&bsamesite=true&consent_cookie_duration=174&consent_duration=174&consentDomain=.consensu.org&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&gdpr_method=cookie&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&title=Windows%20attacks%20via%20CVE-2017-0199%20-%20Practical%20exploitation!%20(PoC)Security%20Affairs&sop=false&description=The%20Security%20expert%C2%A0David%20Routin%20(%40Rewt_1)%20has%20detailed%20a%20step%20by%20step%20procedure%20to%20exploit%20the%20recently%20patched%20cve-2017-0199%20vulnerability%20exploited%20in%20Windows%20attacks%20in%20the%20wild.%20Introduction%20Since%20several%20days%20the%20security%20community%20has%20been%20informed%20thanks%20to%C2%A0FireEye%20publication%C2%A0of%20different%20malware%20campaigns%20(Dridex%E2%80%A6)%20leveraging%20the%20CVE-2017-0199.%20Several%20other%20publications%20were%20related%20to%20this%20vulnerability%20but%20%5B%E2%80%A6%5D&gdpr_domain=.consensu.org&gdpr_domain_v1=.consensu.org&gdpr_method=cookie&description=The%20Security%20expert%C2%A0David%20Routin%20(%40Rewt_1)%20has%20detailed%20a%20step%20by%20step%20procedure%20to%20exploit%20the%20recently%20patched%20cve-2017-0199%20vulnerability%20exploited%20in%20Windows%20attacks%20in%20the%20wild.%20Introduction%20Since%20several%20days%20the%20security%20community%20has%20been%20informed%20thanks%20to%C2%A0FireEye%20publication%C2%A0of%20different%20malware%20campaigns%20(Dridex%E2%80%A6)%20leveraging%20the%20CVE-2017-0199.%20Several%20other%20publications%20were%20related%20to%20this%20vulnerability%20but%20%5B%E2%80%A6%5D&img_pview=true
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.132.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-132-197.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H2 200 Digging-The-Deep-Web.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/ 6 KB
6 KB 17ms
15ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png?resize=236%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

ba716187f8cc8c54806f5b9de46d1d94bec574ddf31c82f68532cd181e242b7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 6
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
x-bytes-saved: 46713
last-modified: Wed, 10 Jun 2020 20:34:29 GMT
server: nginx
etag: "012d3c7ccbeb8560"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2018/03/Digging-The-Deep-Web.png>; rel="canonical"
content-length: 6414
expires: Sat, 11 Jun 2022 08:34:29 GMT

GET
H2 200 securityaffairs-best-european-blog2.png
i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/ 10 KB
10 KB 18ms
16ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png?resize=300%2C217&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 7
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
x-bytes-saved: 103276
last-modified: Tue, 02 Jun 2020 21:29:55 GMT
server: nginx
etag: "c8c3d7b06b174426"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2020/06/securityaffairs-best-european-blog2.png>; rel="canonical"
content-length: 10314
expires: Fri, 03 Jun 2022 09:29:55 GMT

GET
H2 200 logo-center-for-cybersecurity.jpg
i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/ 7 KB
7 KB 18ms
17ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg?resize=290%2C300&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 6
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 26 Oct 2020 09:11:16 GMT
server: nginx
etag: "34ce616fe3b10b35"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2020/10/logo-center-for-cybersecurity.jpg>; rel="canonical"
content-length: 7482
expires: Wed, 26 Oct 2022 21:11:16 GMT

GET
H2 200 newsletter.png
i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/ 6 KB
6 KB 18ms
17ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png?resize=300%2C207&ssl=1

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

40bc46248d8f8d5fbea7678bd0c0031327e206daaf99f3bf6723b9a70f665f7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 8
date: Sat, 09 Jan 2021 07:00:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Dec 2020 07:42:49 GMT
server: nginx
etag: "87af94f3ac2df9da"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
link: <https://securityaffairs.co/wordpress/wp-content/uploads/2015/03/newsletter.png>; rel="canonical"
content-length: 6336
expires: Thu, 15 Dec 2022 19:42:49 GMT

GET
H2 200 1f642.svg
s.w.org/images/core/emoji/13.0.1/svg/ 525 B
523 B 46ms
15ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/13.0.1/svg/1f642.svg

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

943c44a0f3dc1aba84f5fbe8465baadbb90af66cd7be9f37ca07a39260357ad2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Sat, 09 Jan 2021 07:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 20 Oct 2020 16:13:31 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK g.gif
pixel.wp.com/ 50 B
215 B 28ms
15ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pixel.wp.com/g.gif?v=ext&j=1%3A9.2.1&blog=29506073&post=58077&tz=0&srv=securityaffairs.co&host=securityaffairs.co&ref=&fcp=1891&rand=0.7915719088771633
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:48 GMT
Cache-Control: no-cache
Server: nginx
Connection: keep-alive
Content-Length: 50
Content-Type: image/gif

GET
H2 200 djax_elastic.js Show response
cdn.pixfuture.com/ Frame F3F6 37 KB
37 KB 145ms
122ms Script
application/javascript 2606:4700:20::681a:a9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/djax_elastic.js
Requested by: Host: served-by.pixfuture.com
URL: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24270x300x250x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24270x300x250x4142x_ADSLOT1&flag=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d26e98e9600c9cea41a4f28dee915eedd266f450849d151a7f653d1738917de

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
last-modified: Mon, 23 Nov 2020 17:49:07 GMT
server: cloudflare
etag: "5fbbf613-9275"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Dnfixp8Apg7PK1XpKWqKljFOuOTjdFrsv55gHoi1RRM2IvlYirTrUt32Gw2pU9vhIKQhdUGXKMys8jQGbhxjvHBydADrGkmjAItR%2BaEVUm7U5g5fqzcvGEuiC7LpGg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public, no-transform
accept-ranges: bytes
cf-ray: 60ec488ded4497de-FRA
content-length: 37493
cf-request-id: 07878bacb1000097defc2fd000000001
expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H2 200 djax_elastic.js Show response
cdn.pixfuture.com/ Frame 0CF6 37 KB
37 KB 140ms
123ms Script
application/javascript 2606:4700:20::681a:a9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/djax_elastic.js
Requested by: Host: served-by.pixfuture.com
URL: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24272x320x50x4142x_ADSLOT1&flag=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d26e98e9600c9cea41a4f28dee915eedd266f450849d151a7f653d1738917de

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
last-modified: Mon, 23 Nov 2020 17:49:07 GMT
server: cloudflare
etag: "5fbbf613-9275"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XVVvcwx0mUOZEi5LBA8g4CxrK8DjGIegBuXD%2F119rRTVQU3V4fgTzGtPkU17FUa3Cy9J5utfNRoI%2F9cVMjl%2Bj3nQhzrpOCQWJbY9nrqZVdaGifVGWbs3O3edXXg1kA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public, no-transform
accept-ranges: bytes
cf-ray: 60ec488ded4597de-FRA
content-length: 37493
cf-request-id: 07878bacb2000097ded78e5000000001
expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H2 200 jquery3_5_1.min.js Show response
cdn.pixfuture.com/ Frame F3F6 87 KB
88 KB 126ms
125ms Script
application/javascript 2606:4700:20::681a:a9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/jquery3_5_1.min.js
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Aug 2020 15:41:27 GMT
server: cloudflare
etag: "5f4682a7-15d84"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nusbweSkTWzrJFuG0bEpeXdHOIzeZ11B5I6E0jU%2BARRspShD7AUPIydEZBlEiTsu57kGcpAFkk2zKVRJcjoz9z%2BpHDvCdkqvfNS6V6taCgR%2F1xemS4itxt2vNr9f0A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public, no-transform
accept-ranges: bytes
cf-ray: 60ec488ebd7b97de-FRA
content-length: 89476
cf-request-id: 07878bad34000097de15102000000001
expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H/1.1 200
OK pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/158127/2642/ Frame F3F6 275 KB
84 KB 43ms
29ms Script
text/javascript 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ads.pubmatic.com/AdServer/js/pwt/158127/2642/pwt.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e98e8d723dd2eaca28bade949628d27e81e6cf8c9b3e0fd8091fe4b3843f78ce

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Oct 2020 22:47:13 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "10c1257-44c71-5b2d70fa58647"
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: public, max-age=134769
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 85626
Expires: Sun, 10 Jan 2021 20:26:58 GMT

GET
H2 200 jquery3_5_1.min.js Show response
cdn.pixfuture.com/ Frame 0CF6 87 KB
88 KB 118ms
118ms Script
application/javascript 2606:4700:20::681a:a9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/jquery3_5_1.min.js
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Aug 2020 15:41:27 GMT
server: cloudflare
etag: "5f4682a7-15d84"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=32bv7ehwD1sdPSU1FlyHw%2Fk%2BFz%2Fqdagiyy8kSywqMdPTxVGi4PWauUpezee8N8X%2FtdvpU1DFwdwWwFJiq5N8iAJh9eTnklz%2FqZ8LCQXj9K1ljUDFASgxfARUdvS05Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public, no-transform
accept-ranges: bytes
cf-ray: 60ec488edd8297de-FRA
content-length: 89476
cf-request-id: 07878bad49000097defe871000000001
expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H/1.1 200
OK pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/158127/2642/ Frame 0CF6 275 KB
84 KB 43ms
30ms Script
text/javascript 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ads.pubmatic.com/AdServer/js/pwt/158127/2642/pwt.js
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e98e8d723dd2eaca28bade949628d27e81e6cf8c9b3e0fd8091fe4b3843f78ce

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Oct 2020 22:47:13 GMT
Server: Apache/2.2.15 (CentOS)
ETag: "10c1257-44c71-5b2d70fa58647"
Vary: Accept-Encoding
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: public, max-age=134769
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 85626
Expires: Sun, 10 Jan 2021 20:26:58 GMT

GET
H2 200 nrrV67306.js Show response
contextual.media.net/4a/ Frame 9398 93 KB
30 KB 43ms
42ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV67306.js

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "37d86d246a11feb96ff9459d78021a0b"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Sat, 09 Jan 2021 07:00:49 GMT
content-length: 30659
expires: Sat, 23 Jan 2021 07:00:49 GMT

GET
H2 200 1x1.gif
contextual.media.net/__media__/pics/800028474/ Frame 9398 42 B
205 B 30ms
30ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/pics/800028474/1x1.gif

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 04 Jun 2018 10:04:19 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/gif
cache-control: max-age=173545
accept-ranges: bytes
content-length: 42
expires: Mon, 11 Jan 2021 07:13:14 GMT

GET
DATA 200
OK truncated
/ Frame 9398 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9398 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bullet19.woff
contextual.media.net/__media__/fonts/bullet19/ Frame 9398 2 KB
2 KB 74ms
30ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/bullet19/bullet19.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

93326772c35f1eb84dce912da5bf0934aee2d22abdd94c35786bf4cc7e472822

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 1796
expires: Sun, 10 Jan 2021 07:00:49 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame F3F6
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1
https://mug.criteo.com/sid?cpp=N-8Ipnw2S0tsUkhISDBGSjUyZXMxekt2REZ5WTY1OXFOMFFJeXFObVV2elRjZXZtb01VVXAyRzhOenVPbkNHNVF3SFpBV0RMTTg2T3h2bjZqckwrNDg2bC8vWG96VGs1em1NNGZYS2RhelFRRExOeHM5WTFTeE9JWXJpZG...

355 B
631 B

92ms
29ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=N-8Ipnw2S0tsUkhISDBGSjUyZXMxekt2REZ5WTY1OXFOMFFJeXFObVV2elRjZXZtb01VVXAyRzhOenVPbkNHNVF3SFpBV0RMTTg2T3h2bjZqckwrNDg2bC8vWG96VGs1em1NNGZYS2RhelFRRExOeHM5WTFTeE9JWXJpZGE0aEpRRXBlSU1oT052cnpHODN0RFdpdHhBYVYyb2F3STlFN1ZLOTdhNkk4S05Ja1RyUUtPVmVXZnpRejNXUngxeTNpUVJVbXZ4UFFNS2wzT3Vtd0RhSXZMV3RWU0xNMTdjZ3lNcnRKa1BEdkJoUUYrbEc4PXw&cppv=2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

126fc92e8bc0fd89582e64fe1bbb7d67c39db3ec3b95b2a69c9a510033390dc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 09 Jan 2021 07:00:48 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1728
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sat, 09 Jan 2021 07:00:48 GMT
location: https://mug.criteo.com/sid?cpp=N-8Ipnw2S0tsUkhISDBGSjUyZXMxekt2REZ5WTY1OXFOMFFJeXFObVV2elRjZXZtb01VVXAyRzhOenVPbkNHNVF3SFpBV0RMTTg2T3h2bjZqckwrNDg2bC8vWG96VGs1em1NNGZYS2RhelFRRExOeHM5WTFTeE9JWXJpZGE0aEpRRXBlSU1oT052cnpHODN0RFdpdHhBYVYyb2F3STlFN1ZLOTdhNkk4S05Ja1RyUUtPVmVXZnpRejNXUngxeTNpUVJVbXZ4UFFNS2wzT3Vtd0RhSXZMV3RWU0xNMTdjZ3lNcnRKa1BEdkJoUUYrbEc4PXw&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2077
content-length: 482
expires: 0

GET
H/1.1 200
OK gpt.js Show response
www.googletagservices.com/tag/js/ Frame F3F6 56 KB
19 KB 19ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdead639340cfc19516295d269984bea0253aa479d54b22c8d52a8a28f2d0d0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "749 / 851 of 1000 / last-modified: 1610154819"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin: *
Content-Length: 19025
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 prebid4.19.0.js Show response
cdn.pixfuture.com/ Frame F3F6 331 KB
331 KB 122ms
122ms Script
application/javascript 2606:4700:20::681a:a9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46db7a0a77511a777f77205b377cde8df6937dbde8a6e63441d7829d8f6ccfee

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 10 Dec 2020 17:32:50 GMT
server: cloudflare
etag: "5fd25bc2-52b1b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sMkJPETtGK5xF4HA9gFrgosDyag6xi8BGkdy5Zf0QZ9%2FBfI3EHwnkehSLLkFotUcPU3hQdI225VvhUK0bTjCGTguYBsOYdKgnsLVFoztPa4plaUCnm6DmdrZv27NDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public, no-transform
accept-ranges: bytes
cf-ray: 60ec488f7db397de-FRA
content-length: 338715
cf-request-id: 07878badae000097dede847000000001
expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 0CF6
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&cw=1
https://mug.criteo.com/sid?cpp=xw9d0HxVcjBNSG9aSHJMK0Vqbkc3aStZRG5FQnRYTC82aDhvdjBtNmk1ejhzdTFkUUpVTFRMM3NqYUlTL2hZRFBzdUYrRE1pdGlPcFo0R21MN1lOZ29FRUhsa3YwZFViZjJLQ2FYQVh2c0w5OElqT3JFRVdWNmJ3WW81TW...

342 B
626 B

92ms
28ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=xw9d0HxVcjBNSG9aSHJMK0Vqbkc3aStZRG5FQnRYTC82aDhvdjBtNmk1ejhzdTFkUUpVTFRMM3NqYUlTL2hZRFBzdUYrRE1pdGlPcFo0R21MN1lOZ29FRUhsa3YwZFViZjJLQ2FYQVh2c0w5OElqT3JFRVdWNmJ3WW81TWxycytRSWZBdWt1eUlGOGNVVUV5dlNIUDkzZi9NUnBTazNnZ293TFhNY28yYXh4aUZOTi9kT05JVlU3SFNIVSt0SHcweFJROUF6enlVeWpHSC8zcUQzSHFFMDN5T2czMDNvYXduVlVYK0I1dmZXemdMcXdzPXw&cppv=2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

8849db068242cce190602354fb438596fc537f5b0af3e5793949c2f2025338ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 09 Jan 2021 07:00:48 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1087
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sat, 09 Jan 2021 07:00:48 GMT
location: https://mug.criteo.com/sid?cpp=xw9d0HxVcjBNSG9aSHJMK0Vqbkc3aStZRG5FQnRYTC82aDhvdjBtNmk1ejhzdTFkUUpVTFRMM3NqYUlTL2hZRFBzdUYrRE1pdGlPcFo0R21MN1lOZ29FRUhsa3YwZFViZjJLQ2FYQVh2c0w5OElqT3JFRVdWNmJ3WW81TWxycytRSWZBdWt1eUlGOGNVVUV5dlNIUDkzZi9NUnBTazNnZ293TFhNY28yYXh4aUZOTi9kT05JVlU3SFNIVSt0SHcweFJROUF6enlVeWpHSC8zcUQzSHFFMDN5T2czMDNvYXduVlVYK0I1dmZXemdMcXdzPXw&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1200
content-length: 482
expires: 0

GET
H/1.1 200
OK gpt.js Show response
www.googletagservices.com/tag/js/ Frame 0CF6 56 KB
19 KB 19ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d927e4af917b3d3c3a5f7ef8108fa1b61f645e199cbe8c4be20c60c091bfd3da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: sffe
ETag: "749 / 586 of 1000 / last-modified: 1610154819"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Timing-Allow-Origin: *
Content-Length: 19001
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 prebid4.19.0.js Show response
cdn.pixfuture.com/ Frame 0CF6 331 KB
332 KB 111ms
110ms Script
application/javascript 2606:4700:20::681a:a9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46db7a0a77511a777f77205b377cde8df6937dbde8a6e63441d7829d8f6ccfee

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 10 Dec 2020 17:32:50 GMT
server: cloudflare
etag: "5fd25bc2-52b1b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=G69G2BaWpWqzp7u7wjRXL443v14G6VmD73hKrh9IJtEFdH1urg3tcAkFVI80AkjBrrQL%2BD3Rk6vaxEokNr70XX8hfofy8FEVWe8E7Dg9%2B%2Bmm%2BTBK3%2BrjQu0ixjVr%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public, no-transform
accept-ranges: bytes
cf-ray: 60ec488f9dc897de-FRA
content-length: 338715
cf-request-id: 07878badc4000097ded78ec000000001
expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H2 200 nrrV67306.js Show response
contextual.media.net/4a/ Frame 008A 93 KB
30 KB 34ms
33ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV67306.js

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "37d86d246a11feb96ff9459d78021a0b"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Sat, 09 Jan 2021 07:00:49 GMT
content-length: 30659
expires: Sat, 23 Jan 2021 07:00:49 GMT

GET
DATA 200
OK truncated
/ Frame 008A 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 008A 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bullet3.woff
contextual.media.net/__media__/fonts/bullet3/ Frame 008A 2 KB
2 KB 27ms
27ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/bullet3/bullet3.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0bf3f6e79af33723b0c1a822f59a484a35583303ab76fa9227b694b1e719364f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 1688
expires: Sun, 10 Jan 2021 07:00:49 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 9398 15 B
216 B 29ms
28ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001610175648575031177223685721&geo=52.35|4.92&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYM46ecsQs_mhJdHgUAIvd27jWjoVKFIEzr65VO1lypO_gD50101oP9a9oxMDTm0gwducODTSVKic&lpid=&tsid=1&q=&prv=&type=&ps=&cme=hbAA2rMEkLSKx09IMp143JL0V2hecdw0RQJq5ylNaINc1d1Dfa2NX03AgaoZyxzuz20KDwIUgKmWkeRhL6H04t5EPBa828_LloZPa8pMNzR-dgj83uO1x2PGH-AFjKAom0xfVj1-vD0GbiAnpa0Xi70o304yxNKi9ykOQ3dsqL_rxe9vnu3c_yRjLsJprKATEKSElTKtyJKg09Vnh8uEyQ%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CeWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA%3D%3D%7CN7fu2vKt8_s%3D%7CIAGT-eCIjPoDBLpySE_kVeyxEC6DVwtbmFjLkuKW714McxrQCYmtygdHJPDunxDSV1puDDGps1J53gfnOPiXC5_Lr7kKD_UgZi5yGlB2-_TgapfTNSFh6egg6kYTxognHQUyFGFH7tlmE1tl5cwmGV2FBnM0_hyd_YaUBYDeWFsVxRf8ccBDRMMXFn2wTI5tRAP3-7hWgd5R0zezgb9uJA%3D%3D%7C&hint=&td=&cc=NL&wsip=2887305298&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_setid=Nu9&&rc=0&ksu=224&fdkt=355&kwd[]=Real%20Working%20Credit%20Card%20Generator&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=1&kid[]=329866638&kbc2[]=ps%3D2.573%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=274894815488&kwd[]=Best%20Antivirus%20for%20Mac&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=2&kid[]=3455176&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D1.58%7C%7Clvl%3D1.89&ktd[]=274911658240&kwd[]=Reset%20My%20Password&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=3&kid[]=24298917&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=Best%20Freeware%20Antivirus%20for%20Windows&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=4&kid[]=330072754&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.31%7C%7Clvl%3D1.00&ktd[]=274894881024&rand=1610175649226&cid=8CU5BD6EW&vwid=1610175648177685265&vi=1610175648177685265&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_l1rakh=1610175648157038138&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1610175648575&upk=1610175649.1388&hvsid=00001610175648575031177223685721&verid=4121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&pid=8PO5M70HK&katen=1&pc=9&matm=1610175649232&vgd_ltime=686&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=806241105&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D9&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2887305228&vgd_nrrsf=nrr&vgd_nrrv=67306&vgd_nrrs=67306&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-829833831%7CDIV&vgd_x_pos=320&vgd_y_pos=518&vgd_ren_page_h=9162&vgd_cty=AMSTERDAM&vgd_l1hcsd=N4%7C111&vgd_sethcsd=C1%7C129&vgd_cfud=200203&vgd_is_amp=0&vgd_icat=379&vgd_spcat=500996&vgd_optout=0&vgd_ect=4g&vgd_rensize=630_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_l1rpth=%2Fdmedianet.js&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&oRurl=http%3A%2F%2Fcdn3e%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DNL%26isOffice%3D0%26fvips%3D0%26vi%3D1610175648177685265%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D829833831%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26gdpr%3D1%26cb%3Dwindow._mNDetails.initAd%26pid%3D8PO5M70HK%26requrl%3Dhttp%253a%252f%252fsecurityaffairs.co%252fwordpress%252f58077%252fbreaking-news%252fcve-2017-0199-exploitation-poc.html%26%26katid%3D806241105%26katen%3D1%26katbid%3D-21&tdAdd[]=uiparams%3D%3Brend_w%3A630%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A4&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:49 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H2 200 log
navvy.media.net/ Frame 9398 807 B
997 B 508ms
175ms Other
image/gif 52.52.52.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.52.5 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-52-5.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 pubads_impl_2021010709.js Show response
securepubads.g.doubleclick.net/gpt/ Frame F3F6 275 KB
97 KB 31ms
30ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021010709.js?21069770

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

6db457e858d57c8629255fcffd1d90780c1bd16c9141863b2f6fdcb96e3c3e56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 07 Jan 2021 21:13:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99264
x-xss-protection: 0
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 pubads_impl_2021010705.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 0CF6 274 KB
97 KB 35ms
35ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021010705.js?21069767

Requested by

Host: www.googletagservices.com
URL: http://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

sffe /

Resource Hash

49e0a45588654bdf62c81286a336f875b3858a2611b559c95ef3f8d267e1f2ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 07 Jan 2021 20:48:48 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99000
x-xss-protection: 0
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 008A 15 B
216 B 28ms
27ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001610175648636031177223682373&geo=52.35|4.92&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYM46ecsQs_mhJdHgUAIvd27jWjoVKFIEzr65VO1lypO_gD50101oP9alhU5fQ92GTQiGp-OsISI4&lpid=&tsid=1&q=&prv=&type=&ps=&cme=hbAA2rMEkLRsSqZi2Q4-nXZ2BUdzVSerTSX0sphkwDiQcx0OZt3Ev8mkWymMPiMDpnehvpE81RiczOtRGohQeOdPQ8Ge6EJLBVpsurpqwCKNZ9_wvRraUv_TJDiuOaUB-fUiM1cssWHoypKOuGUVhdVdiYHrhLMRVNdvEOTMejWeRlIIujRJtCnQ1w0tsy6PTitnpZX5zuZi-0lebPIc45q2KaqVuMSB%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CeWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA%3D%3D%7CN7fu2vKt8_s%3D%7C7gUR5MVisQvOE2AkS52nD4y9zPMcIMOLvYILPcRsWuAmNW8k5DNM5Zp0_hDLE_OboiwhnLwcZ6fBHcy6JyljgHzeVPn0m6ZG3WT2fIlHGtJew5Bef6eUAjuJEHpCzaJ-gs26PvRpKK_3fMW4rbUbxQrfuMW7IWoPk2dKjheXUeQ-eXUtfHsB-y1qKO2NSCfqWLgJXIbTuO4Z_TVF3lmfLg%3D%3D%7C&hint=&td=&cc=NL&wsip=2887305229&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_setid=Nu9&&rc=0&ksu=224&fdkt=355&kwd[]=Real%20Working%20Credit%20Card%20Generator&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=1&kid[]=329866638&kbc2[]=ps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.17&ktd[]=274894815488&kwd[]=Best%20Antivirus%20for%20Mac&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=2&kid[]=3455176&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D1.66%7C%7Clvl%3D1.89&ktd[]=274911658240&kwd[]=Reset%20My%20Password&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=3&kid[]=24298917&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=Best%20Freeware%20Antivirus%20for%20Windows&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=4&kid[]=330072754&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.31%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=My%20Gift%20Card&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=5&kid[]=127438261&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=274894881024&rand=1610175649303&cid=8CU5BD6EW&vwid=1610175648573539226&vi=1610175648573539226&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_l1rakh=1610175648157038138&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1610175648636&upk=1610175649.1388&hvsid=00001610175648636031177223682373&verid=4121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=16&matm=1610175649307&vgd_ltime=674&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=807056976&vgd_katbid=-21&vgd_kals=ttype%3D10007%7C%7Cpc%3D16&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2887305290&vgd_nrrsf=nrr&vgd_nrrv=67306&vgd_nrrs=67306&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-816788371%7CDIV&vgd_x_pos=327&vgd_y_pos=7458&vgd_ren_page_h=9162&vgd_cty=AMSTERDAM&vgd_l1hcsd=N4%7C111&vgd_sethcsd=C1%7C129&vgd_cfud=200131&vgd_is_amp=0&vgd_icat=379&vgd_spcat=500996&vgd_optout=0&vgd_ect=4g&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_l1rpth=%2Fdmedianet.js&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&oRurl=http%3A%2F%2Fcdn3e%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DNL%26isOffice%3D0%26fvips%3D0%26vi%3D1610175648573539226%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D816788371%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26gdpr%3D1%26cb%3Dwindow._mNDetails.initAd%26pid%3D8PO5M70HK%26requrl%3Dhttp%253a%252f%252fsecurityaffairs.co%252fwordpress%252f58077%252fbreaking-news%252fcve-2017-0199-exploitation-poc.html%26%26katid%3D807056976%26katen%3D1%26katbid%3D-21&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:49 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H2 200 log
navvy.media.net/ Frame 008A 807 B
998 B 453ms
174ms Other
image/gif 52.52.52.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.52.5 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-52-5.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 nrrV67306.js Show response
contextual.media.net/4a/ Frame 9406 93 KB
30 KB 43ms
43ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV67306.js

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "37d86d246a11feb96ff9459d78021a0b"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Sat, 09 Jan 2021 07:00:49 GMT
content-length: 30659
expires: Sat, 23 Jan 2021 07:00:49 GMT

GET
DATA 200
OK truncated
/ Frame 9406 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9406 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bullet11.woff
contextual.media.net/__media__/fonts/bullet11/ Frame 9406 2 KB
2 KB 37ms
36ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/bullet11/bullet11.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c300b6a2877bb5b77918987020634e2c4981146589638e918bc4de730d19df90

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 1748
expires: Sun, 10 Jan 2021 07:00:49 GMT

GET
H2 200 bullet13.woff
contextual.media.net/__media__/fonts/bullet13/ Frame 9406 2 KB
2 KB 79ms
78ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/bullet13/bullet13.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

6139b4d0af528ec1d0e26ae865c1ca04ac061d844ffa6ccc9e4adaa3af93a2f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 1692
expires: Sun, 10 Jan 2021 07:00:49 GMT

GET
H2 200 nrrV67306.js Show response
contextual.media.net/4a/ Frame 3BC1 93 KB
30 KB 82ms
81ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV67306.js

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "37d86d246a11feb96ff9459d78021a0b"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Sat, 09 Jan 2021 07:00:49 GMT
content-length: 30659
expires: Sat, 23 Jan 2021 07:00:49 GMT

GET
H2 200 1.jpg
contextual.media.net/__media__/pics/800060599/ Frame 3BC1 5 KB
5 KB 38ms
37ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/pics/800060599/1.jpg

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

05999befd49ad70a0d0648a08d12fa80206fa88822a907ff426f0eadcc437c1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Tue, 29 May 2018 12:36:32 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/jpeg
cache-control: max-age=156878
accept-ranges: bytes
content-length: 4781
expires: Mon, 11 Jan 2021 02:35:27 GMT

GET
H2 200 2.jpg
contextual.media.net/__media__/pics/800060599/ Frame 3BC1 4 KB
4 KB 43ms
42ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/pics/800060599/2.jpg

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0758ad694d2f74d096d49d79e32cb100eeb38dc6ff11c2f9a870de5eb5a35b5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Tue, 29 May 2018 12:36:32 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/jpeg
cache-control: max-age=299889
accept-ranges: bytes
content-length: 3740
expires: Tue, 12 Jan 2021 18:18:58 GMT

GET
H2 200 3.jpg
contextual.media.net/__media__/pics/800060599/ Frame 3BC1 3 KB
3 KB 48ms
47ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/pics/800060599/3.jpg

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0bdb519e9746b7b770969e860e0bbf41606bc4b814479ddd4f8688f2cafcc01a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Tue, 29 May 2018 12:36:32 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/jpeg
cache-control: max-age=153547
accept-ranges: bytes
content-length: 3376
expires: Mon, 11 Jan 2021 01:39:56 GMT

GET
H2 200 4.jpg
contextual.media.net/__media__/pics/800060599/ Frame 3BC1 5 KB
5 KB 53ms
51ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/pics/800060599/4.jpg

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9282ea078a317f764d3883e732d14a2e80575e437b710144396d453f5a19139a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Tue, 29 May 2018 12:36:32 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/jpeg
cache-control: max-age=175597
accept-ranges: bytes
content-length: 5051
expires: Mon, 11 Jan 2021 07:47:26 GMT

GET
DATA 200
OK truncated
/ Frame 3BC1 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf9b76f5559de92c2cc7df8fa751c09d9a3bbfada6123d975c75c4a093f8cfeb

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3BC1 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3BC1 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 OpenSans-Regular.woff
contextual.media.net/__media__/fonts/OpenSans-Regular/ Frame 3BC1 66 KB
66 KB 30ms
30ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/OpenSans-Regular/OpenSans-Regular.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

5256d55a499ecb71f04dd716cfdf75bf9fe5f863620ec6634e3b43b4e6b11fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 67528
expires: Sun, 10 Jan 2021 07:00:49 GMT

GET
H2 200 nrrV67306.js Show response
contextual.media.net/4a/ Frame 4E4D 93 KB
30 KB 48ms
47ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV67306.js

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "37d86d246a11feb96ff9459d78021a0b"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Sat, 09 Jan 2021 07:00:49 GMT
content-length: 30659
expires: Sat, 23 Jan 2021 07:00:49 GMT

GET
H2 200 1x1.gif
contextual.media.net/__media__/pics/800028474/ Frame 4E4D 42 B
205 B 29ms
28ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/pics/800028474/1x1.gif

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 04 Jun 2018 10:04:19 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/gif
cache-control: max-age=173545
accept-ranges: bytes
content-length: 42
expires: Mon, 11 Jan 2021 07:13:14 GMT

GET
H2 200 10124_505bb4db55aaa1165fa3b242bf39701b.png
contextual.media.net/__media__/images/800000006/ Frame 4E4D 4 KB
4 KB 33ms
33ms Image
image/png 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/__media__/images/800000006/10124_505bb4db55aaa1165fa3b242bf39701b.png

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Tue, 03 Oct 2017 12:52:51 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/png
cache-control: max-age=135052
accept-ranges: bytes
content-length: 4097
expires: Sun, 10 Jan 2021 20:31:41 GMT

GET
H2 200 bullet6.woff
contextual.media.net/__media__/fonts/bullet6/ Frame 4E4D 2 KB
2 KB 38ms
38ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/bullet6/bullet6.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

5c7be85bfd10439dc176766f9692295f27f8e91eac21b5801f89320ae0c82f04

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 1704
expires: Sun, 10 Jan 2021 07:00:49 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame F3F6
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&bundle=52HTrV9WWkFTVzM5WXVXJTJGRWQyaHFnOHdsTCUyQmlVT2hYWmE0S010TklzNWtiSTkwNUtIT1Za...
https://mug.criteo.com/sid?cpp=9ItQdHwxUVNNb0UvMFdOWk1nUC9VMFA3blhPOUN5UHA0Z1RJNE9xSCtOQVV4MTVWdHRyUFMwMEpleis4V2g2VkYvVmdhVW9vUTdTYkhJenpGcmxYUTVEbzJCRTFqVml5UlFCRWp2bjRsQWp6alk5RGt2WlVIVGRXUmpIS2...

344 B
628 B

90ms
30ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=9ItQdHwxUVNNb0UvMFdOWk1nUC9VMFA3blhPOUN5UHA0Z1RJNE9xSCtOQVV4MTVWdHRyUFMwMEpleis4V2g2VkYvVmdhVW9vUTdTYkhJenpGcmxYUTVEbzJCRTFqVml5UlFCRWp2bjRsQWp6alk5RGt2WlVIVGRXUmpIS2YzY3F3cUo4SU1RalJkVWptSGkyNHQ2OCtCd0t4a2hhTXRrcFgwNU1qMVBBeUtSQjRETk9TM1pGWDRpdEVRRU9OVEx2Q1NaaFZnL2x4bmJBNFF0My82czl5allLL1RmM0FhblV1RWRrbThjWVZJWXFRemlqTEtDazZJSkhzT2ZHNm15Yk9iMkd2fA&cppv=2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

b91c47b0c2394e1841ad77242ebe5f351046a41d071e4007eec98adf4cee1de6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 09 Jan 2021 07:00:48 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1062
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sat, 09 Jan 2021 07:00:48 GMT
location: https://mug.criteo.com/sid?cpp=9ItQdHwxUVNNb0UvMFdOWk1nUC9VMFA3blhPOUN5UHA0Z1RJNE9xSCtOQVV4MTVWdHRyUFMwMEpleis4V2g2VkYvVmdhVW9vUTdTYkhJenpGcmxYUTVEbzJCRTFqVml5UlFCRWp2bjRsQWp6alk5RGt2WlVIVGRXUmpIS2YzY3F3cUo4SU1RalJkVWptSGkyNHQ2OCtCd0t4a2hhTXRrcFgwNU1qMVBBeUtSQjRETk9TM1pGWDRpdEVRRU9OVEx2Q1NaaFZnL2x4bmJBNFF0My82czl5allLL1RmM0FhblV1RWRrbThjWVZJWXFRemlqTEtDazZJSkhzT2ZHNm15Yk9iMkd2fA&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1808
content-length: 509
expires: 0

POST
H/1.1 200
OK cookie_sync Show response
prebidserver.pixfuture.com/ Frame F3F6 275 B
646 B 321ms
133ms XHR
application/json 157.245.94.128
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebidserver.pixfuture.com/cookie_sync
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.245.94.128 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 6a99e7d178fd19b946a936a0f64d31a1af2e843b889ab515ada00d38622c5d67

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: http://securityaffairs.co
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 275
Expires: 0

POST
H/1.1 200
OK auction Show response
prebidserver.pixfuture.com/openrtb2/ Frame F3F6 105 B
461 B 325ms
123ms XHR
application/json 157.245.94.128
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://prebidserver.pixfuture.com/openrtb2/auction
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.245.94.128 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 9c58ac806463ce6a16f4cb2a9c5bebd5acf61bb801bfe552aa2028f7deee1e9a

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: http://securityaffairs.co
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 105
Expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame F3F6 19 B
715 B 59ms
15ms XHR
application/json 185.33.221.14
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.14 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 730.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.135:80
AN-X-Request-Uuid: d4ef6a61-ea8d-42ad-8f95-6a6fbb9d1080
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: http://securityaffairs.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 ADTECH;v=2;cmd=bid;cors=yes;alias=132319173d65c0b;misc=1610175649433; Show response
adserver-us.adtech.advertising.com/pubapi/3.0/9834/NaN/0/0/ Frame F3F6 0
194 B 131ms
98ms XHR
text/plain 2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/9834/NaN/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=132319173d65c0b;misc=1610175649433;
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: nginx
access-control-allow-methods: POST,GET,HEAD,OPTIONS
access-control-allow-origin: http://securityaffairs.co
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame F3F6 0
61 B 150ms
110ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://securityaffairs.co
date: Sat, 09 Jan 2021 07:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H2 200 arj Show response
pixfuture2-d.openx.net/w/1.0/ Frame F3F6 173 B
561 B 112ms
73ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pixfuture2-d.openx.net/w/1.0/arj?ju=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=ab740f83-fd22-4db6-b5bd-383848d4abe7&nocache=1610175649436&criteoid=fPp3rl84bWFmbE51SWkxT293UTRUMjB4ckZhYU8zWXU4cTlTT0t0OFcwcDF3M01ieGFSZUdmdUJuYmp0b2ZvQWd0dGQlMkZ6RSUyQllmYkhOMGVHc3VMM0JFQ2ZRZUElM0QlM0Q&pubcid=36fad51c-1368-4a29-8398-b97b7811ea01&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=300x250&divIds=24270x300x250x4142x_ADSLOT1&auid=540580840&tps=bXlrZXl3b3JkPXdpbmRvd3MsYXR0YWNrcyx2aWEsY3ZlMjAxNzAxOTkscHJhY3RpY2FsLGV4cGxvaXRhdGlvbixwb2NzZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPXdpbmRvd3MsYXR0YWNrcyx2aWEsY3ZlMjAxNzAxOTkscHJhY3RpY2FsLGV4cGxvaXRhdGlvbixwb2NzZWN1cml0eSxhZmZhaXJz
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.200.0 /
Resource Hash: 8ba12716d220a67a1c9f17aacbb8f47f2a4adc12573748980942c5e73e161398

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
server: OXGW/16.200.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: http://securityaffairs.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 164
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame F3F6 95 B
736 B 81ms
30ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22124c2a6d5d65d9b%22%3A%22833199e4bd4003904bc3%7C300x250%7Cf%3D0.1%22%7D&ref=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&s=462c7e09-7430-44f7-8924-11c43a514ae6&pv=0764c6ba-650b-4ebe-b745-7b697429d73d&vp=mobile&lib_name=prebid&lib_v=4.19.0&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22criteoId%22%3A%22fPp3rl84bWFmbE51SWkxT293UTRUMjB4ckZhYU8zWXU4cTlTT0t0OFcwcDF3M01ieGFSZUdmdUJuYmp0b2ZvQWd0dGQlMkZ6RSUyQllmYkhOMGVHc3VMM0JFQ2ZRZUElM0QlM0Q%22%2C%22pubcid%22%3A%2236fad51c-1368-4a29-8398-b97b7811ea01%22%7D&kw=windows%2Cattacks%2Cvia%2Ccve20170199%2Cpractical%2Cexploitation%2Cpocsecurity%2Caffairs

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

d5c42a9ec301b30dbbf78acd3b3e1c8706d58a1bca7d5fe369cbd5ef16d874a3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-132
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: http://securityaffairs.co
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 120
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 9406 15 B
216 B 29ms
29ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001610175648766031177223689127&geo=52.35|4.92&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYM46ecsQs_mhzjxRGJaz7v49bqFb2x5F9JLIaOg4bu7MczcDt4hC2h1mQI_RZqngJHhl8IDtUhb8&lpid=&tsid=1&q=&prv=&type=&ps=&cme=hbAA2rMEkLSMBTefCPGWPcv1vtiE2brOhuEj5hy5Lvg3byHGAkOIH3W76k1zRcV0_ecAQx4SECwNl1ScaUv-jW7pvZXfAuaMzOcxYfWmbw8xRkFw1tJEHPmFE6wviSrGIPnhQoS54poEZ59SRsvWAVO5a6TPYK_BekIGZQm5vx0qhQ8eXetixEEw34SQMGLBI6xRgio68SYZz3SkqloJbY_WcMzdDInR%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CeWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA%3D%3D%7CN7fu2vKt8_s%3D%7C5n5u4pio-WipJNubf0KbswqPDkmxl1_sme7HyCac2_j9U0Ix_uIeMTsGgRCm1J-uhYZeq--quYOP4n4-tvy7pSwjYb7zD0VQUEh-3dQspxeMvYQnAoR4pKgeYvJeh2GYp5U1V2w8gFavQiPHruGlQm0r19kbtOvviz3dQ3jvgrPoAPd_Z8yERLSYuIj_FDLty-6Uc0NXeV2Tsyx3_v_7mg%3D%3D%7C&hint=&td=&cc=NL&wsip=2887305230&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_setid=Nu9&&rc=0&ksu=224&fdkt=355&kwd[]=Real%20Working%20Credit%20Card%20Generator&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=1&kid[]=329866638&kbc2[]=ps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.17&ktd[]=274894815488&kwd[]=Best%20Antivirus%20for%20Mac&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=2&kid[]=3455176&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D1.66%7C%7Clvl%3D1.89&ktd[]=274911658240&kwd[]=Reset%20My%20Password&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=3&kid[]=24298917&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=Best%20Freeware%20Antivirus%20for%20Windows&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=4&kid[]=330072754&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.31%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=My%20Gift%20Card&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=5&kid[]=127438261&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=274894881024&rand=1610175649459&cid=8CU5BD6EW&vwid=1610175648707783434&vi=1610175648707783434&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_l1rakh=1610175648182857618&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1610175648766&upk=1610175649.1388&hvsid=00001610175648766031177223689127&verid=111299&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=30&matm=1610175649464&vgd_ltime=726&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=800621998&vgd_katbid=-21&vgd_kals=ttype%3D10011%7C%7Cpc%3D30&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2887305298&vgd_nrrsf=nrr&vgd_nrrv=67306&vgd_nrrs=67306&vgd_nrrmf=4a&vgd_cntrdt=S%7CDIV&vgd_x_pos=320&vgd_y_pos=8324&vgd_ren_page_h=9676&vgd_cty=AMSTERDAM&vgd_l1hcsd=C1%7C106&vgd_sethcsd=C1%7C129&vgd_cfud=200214&vgd_is_amp=0&vgd_icat=379&vgd_spcat=500996&vgd_optout=0&vgd_ect=4g&vgd_rensize=630_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_l1rpth=%2Fnmedianet.js&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&oRurl=http%3A%2F%2Fcdn3e%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DNL%26isOffice%3D0%26fvips%3D0%26vi%3D1610175648707783434%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D733976884%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26gdpr%3D1%26cb%3Dwindow._mNDetails.initAd%26pid%3D8PO5M70HK%26requrl%3Dhttp%253a%252f%252fsecurityaffairs.co%252fwordpress%252f58077%252fbreaking-news%252fcve-2017-0199-exploitation-poc.html%26%26katid%3D800621998%26katen%3D1%26katbid%3D-21&tdAdd[]=uiparams%3D%3Brend_w%3A630%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:49 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H2 200 log
navvy.media.net/ Frame 9406 807 B
997 B 403ms
305ms Other
image/gif 52.52.52.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.52.5 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-52-5.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 0CF6
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&bundle=52HTrV9WWkFTVzM5WXVXJTJGRWQyaHFnOHdsTCUyQmlVT2hYWmE0S010TklzNWtiSTkwNUtIT1Za...
https://mug.criteo.com/sid?cpp=0QWgm3w3b1RWSWR4ektLTGw4UGdJRXVYMHJGTVFaRFI1Q21IckFIOTkwV1RmZEFIZmwwbHdMTlVHUngyaThGY3VpSUNxN05XOG1UWVNhQ3NlaFlYb3QvUTZyMHZvWHNOaTNKZTR1WmpsY0N4UmR2emVtdDI4ZmJCTGwvMT...

355 B
631 B

65ms
31ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=0QWgm3w3b1RWSWR4ektLTGw4UGdJRXVYMHJGTVFaRFI1Q21IckFIOTkwV1RmZEFIZmwwbHdMTlVHUngyaThGY3VpSUNxN05XOG1UWVNhQ3NlaFlYb3QvUTZyMHZvWHNOaTNKZTR1WmpsY0N4UmR2emVtdDI4ZmJCTGwvMTZmZ2pTK1NrMExDdXFNU21zNzlWTDFnZytuMFMzM3BsYkVNeUpSVG9KWFNFTmpoSzdKYU54TkJFeEkxRVdEZ05HLy9JUDM4SXdGL2k1ek5veS9LQUVlR0FTRW1aMWgxam5ienBoa09ucUFsOUs0Q2c2Q2wyMXl3SFh3ekU2c0RQTG5CWjNIS0g0fA&cppv=2

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

b884f703a391d10cfd72e4ab3676234d1608193283e42df9dd78cc1a21a33140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 09 Jan 2021 07:00:48 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1221
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Sat, 09 Jan 2021 07:00:49 GMT
location: https://mug.criteo.com/sid?cpp=0QWgm3w3b1RWSWR4ektLTGw4UGdJRXVYMHJGTVFaRFI1Q21IckFIOTkwV1RmZEFIZmwwbHdMTlVHUngyaThGY3VpSUNxN05XOG1UWVNhQ3NlaFlYb3QvUTZyMHZvWHNOaTNKZTR1WmpsY0N4UmR2emVtdDI4ZmJCTGwvMTZmZ2pTK1NrMExDdXFNU21zNzlWTDFnZytuMFMzM3BsYkVNeUpSVG9KWFNFTmpoSzdKYU54TkJFeEkxRVdEZ05HLy9JUDM4SXdGL2k1ek5veS9LQUVlR0FTRW1aMWgxam5ienBoa09ucUFsOUs0Q2c2Q2wyMXl3SFh3ekU2c0RQTG5CWjNIS0g0fA&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2277
content-length: 509
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 0CF6 19 B
715 B 18ms
17ms XHR
application/json 185.33.221.14
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.14 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

730.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 730.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.117:80
AN-X-Request-Uuid: 6f35f1ac-1530-4597-b3c1-4bc2c23e48c2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: http://securityaffairs.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 arj Show response
pixfuture2-d.openx.net/w/1.0/ Frame 0CF6 173 B
356 B 51ms
51ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pixfuture2-d.openx.net/w/1.0/arj?ju=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=17b4c126-2add-4703-8859-d8549ded0a4a&nocache=1610175649512&criteoid=fPp3rl84bWFmbE51SWkxT293UTRUMjB4ckZhYU8zWXU4cTlTT0t0OFcwcDF3M01ieGFSZUdmdUJuYmp0b2ZvQWd0dGQlMkZ6RSUyQllmYkhOMGVHc3VMM0JFQ2ZRZUElM0QlM0Q&pubcid=36fad51c-1368-4a29-8398-b97b7811ea01&schain=1.0%2C1!pixfuture.com%2C4142%2C1%2C%2C%2C&aus=320x50&divIds=24272x320x50x4142x_ADSLOT1&auid=540580841&tps=bXlrZXl3b3JkPXdpbmRvd3MsYXR0YWNrcyx2aWEsY3ZlMjAxNzAxOTkscHJhY3RpY2FsLGV4cGxvaXRhdGlvbixwb2NzZWN1cml0eSxhZmZhaXJzJm15b3RoZXJrZXl3b3JkPXdpbmRvd3MsYXR0YWNrcyx2aWEsY3ZlMjAxNzAxOTkscHJhY3RpY2FsLGV4cGxvaXRhdGlvbixwb2NzZWN1cml0eSxhZmZhaXJz
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.200.0 /
Resource Hash: bbd04d05057d75f9d9012aef276c8e4fa94f6e3e99e84bad86c87824a9cf10af

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
server: OXGW/16.200.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: http://securityaffairs.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 164
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 0CF6 0
117 B 50ms
50ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: http://securityaffairs.co
date: Sat, 09 Jan 2021 07:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ Frame 0CF6 94 B
735 B 73ms
65ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2289874ccf7167f9%22%3A%22277a716b3c3b01668abf%7C320x50%7Cf%3D0.1%22%7D&ref=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&s=64804150-3e4d-4391-9d54-0acac16ce179&pv=33831a1f-eb15-4c78-bc8a-0a1c08a78a50&vp=mobile&lib_name=prebid&lib_v=4.19.0&us=0&ius=1&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22pixfuture.com%22%2C%22sid%22%3A%224142%22%2C%22hp%22%3A1%7D%5D%7D&userid=%7B%22criteoId%22%3A%22fPp3rl84bWFmbE51SWkxT293UTRUMjB4ckZhYU8zWXU4cTlTT0t0OFcwcDF3M01ieGFSZUdmdUJuYmp0b2ZvQWd0dGQlMkZ6RSUyQllmYkhOMGVHc3VMM0JFQ2ZRZUElM0QlM0Q%22%2C%22pubcid%22%3A%2236fad51c-1368-4a29-8398-b97b7811ea01%22%7D&kw=windows%2Cattacks%2Cvia%2Ccve20170199%2Cpractical%2Cexploitation%2Cpocsecurity%2Caffairs

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

75efdb5205ce720413bc9275c222ad30f9a9bdccfc05e9d585832fe6b2dcf2e1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: http://securityaffairs.co
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 119
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 22ms
22ms Other
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=http%3A%2F%2Fsecurityaffairs.co%2F&domain=securityaffairs.co&bundle=52HTrV9WWkFTVzM5WXVXJTJGRWQyaHFnOHdsTCUyQmlVT2hYWmE0S010TklzNWtiSTkwNUtIT1ZabCUyRkF0bjFSZHNhZCUyQnFaMGtxMVpaSTViaVRpVnBvYnc3WW1hanV5OGllbmtyJTJGQTElMkJST3NTaFBQWCUyRkVRbzlGbVVsV0cxOHY4ZmlZcGtvT2Y1&cw=1&lsw=1

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: http://securityaffairs.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: http://securityaffairs.co
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1283
date: Sat, 09 Jan 2021 07:00:48 GMT
content-encoding: gzip
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 22ms
21ms Other
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: http://securityaffairs.co
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: http://securityaffairs.co
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 812
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 883aaddb-5797-4375-aa64-684df4ad2c33.jpg
cvision.media.net/new/100x75/2/26/92/94/ Frame 3BC1 7 KB
7 KB 41ms
33ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cvision.media.net/new/100x75/2/26/92/94/883aaddb-5797-4375-aa64-684df4ad2c33.jpg?v=9
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-93.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c6dd64d2907400de9370602149661f286e840556b9e7a397b55f0961e88b41eb

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 19 Mar 2018 16:51:48 GMT
server: nginx
accept-ranges: bytes
etag: "5aafeaa4-1ba7"
content-length: 7079
content-type: image/jpeg

GET
H2 200 0a9c42d3-ce38-4bc5-8fec-e6e1e5e14cd6.jpg
cvision.media.net/new/100x75/2/3/5/13/ Frame 3BC1 3 KB
3 KB 169ms
161ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cvision.media.net/new/100x75/2/3/5/13/0a9c42d3-ce38-4bc5-8fec-e6e1e5e14cd6.jpg?v=9
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-93.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 56adbe005fec98d625f094696217e24e3accadd033243c479a4ffc208b972626

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Wed, 21 Mar 2018 03:46:17 GMT
server: nginx
accept-ranges: bytes
etag: "5ab1d589-c81"
content-length: 3201
content-type: image/jpeg

GET
H2 200 d99958f9-d84c-4408-8864-832e0a0307f6.jpg
cvision.media.net/new/100x75/2/242/237/152/ Frame 3BC1 5 KB
5 KB 44ms
35ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cvision.media.net/new/100x75/2/242/237/152/d99958f9-d84c-4408-8864-832e0a0307f6.jpg?v=9
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-93.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 30bda439e9b01f68a5ed937b24b7c8bec19aad7d58f899d42ab077a7bdc9ed7f

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Sun, 11 Mar 2018 03:46:41 GMT
server: nginx
accept-ranges: bytes
etag: "5aa4a6a1-1507"
content-length: 5383
content-type: image/jpeg

GET
H2 200 91bd2471-c434-415d-9e72-42f49305d93f.jpg
cvision.media.net/new/100x75/3/157/126/140/ Frame 3BC1 7 KB
8 KB 171ms
162ms Image
image/jpeg 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cvision.media.net/new/100x75/3/157/126/140/91bd2471-c434-415d-9e72-42f49305d93f.jpg?v=9
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-93.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 40eca045fa7b87f3a451a385520d4e46e5326febf0ad5a64a762b2492c32bb78

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Thu, 22 Mar 2018 02:19:51 GMT
server: nginx
accept-ranges: bytes
etag: "5ab312c7-1dd7"
content-length: 7639
content-type: image/jpeg

GET
H2 200 OpenSans_Semibold.woff
contextual.media.net/__media__/fonts/OpenSans_Semibold/ Frame 4E4D 21 KB
21 KB 71ms
69ms Font
application/font-woff 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/OpenSans_Semibold/OpenSans_Semibold.woff

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Origin: http://securityaffairs.co
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 21704
expires: Sun, 10 Jan 2021 07:00:49 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 29ms
28ms Other
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 635
date: Sat, 09 Jan 2021 07:00:48 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 nrrV67306.js Show response
contextual.media.net/4a/ Frame F5FE 93 KB
30 KB 31ms
30ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/4a/nrrV67306.js

Requested by

Host: contextual.media.net
URL: http://contextual.media.net/dmedianet.js?cid=8CU5BD6EW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: max-age=2592000
strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
etag: "37d86d246a11feb96ff9459d78021a0b"
vary: Accept-Encoding
x-mnet-h: 8-11
content-type: text/javascript; charset=utf-8
cache-control: max-age=1209600
date: Sat, 09 Jan 2021 07:00:49 GMT
content-length: 30659
expires: Sat, 23 Jan 2021 07:00:49 GMT

GET
DATA 200
OK truncated
/ Frame F5FE 256 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d94bb0e95ef200f1b8f6c00b1d40a694201da59079c73371a6d9963a16195ab1

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame F5FE 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame F5FE 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame F5FE 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 28ms
28ms Other
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 670
date: Sat, 09 Jan 2021 07:00:48 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H/1.1 200
OK show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 6687 91 KB
33 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0d5f39020fd89e95f190ba687cc7fccd10d833f20a8aefe6f3b1a17fc4178d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 5755674588201438140
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 33069
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H/1.1 200
OK demo_track.js Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame 0CF6 3 KB
3 KB 266ms
89ms Script
application/javascript 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v964
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 7b420ad439dadbbbc88cef506a6e2ea73c331178f08f984c6b230cec7ac66a04

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:49 GMT
Last-Modified: Mon, 06 Jul 2020 13:30:16 GMT
Server: nginx/1.10.3 (Ubuntu)
ETag: "5f032768-a4e"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length: 2638
Expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame F5FE 15 B
216 B 33ms
32ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001610175648800031177223685006&geo=52.35|4.92&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYM46ecsQs_mhzjxRGJaz7v49bqFb2x5F9JLIaOg4bu7MczcDt4hC2h3OIQKf4np3nXI36KtHV7vm&lpid=&tsid=1&q=&prv=&type=&ps=&cme=7dPTaC80jmMh3VV-IoHVUaA5e9n6fK9SledfdZOvOI7-NFAXV3HwjLuyjba-U6DysgJpZIRb_Iwk6TuXmmpXTXUNvthNS4w1pBDofVRClVdJRQUcgBpuDsUnCPUKOdBAR251O6YwXG3LBYSZLk0aeyFa2FY6h1mUqtiCQuyA1kV9N-beDPkK9YKBTP49yIR6tz-52xsRNx5PXrg7WOrewOLmPu-l9m6p%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CeWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA%3D%3D%7CN7fu2vKt8_s%3D%7CarxRGMpJWtIwNlyrBpQxscZcPuJJ43fiONHy68soVzItALLXMcCTdPZheHjy-R9sC3w9iNuQSYiiPdF_XsByteJEbH_vjphj2Ei6dvm7tDsk_kvLty5G06nTmKJWfnr_ANzUKd1EZMtc77LugiMkajpaWMj4yac6BgqFGryGyEBH4opl7Lwd9sBqauzIfoWweOpbqALQyRoFV2-YO8fuvg%3D%3D%7C&hint=&td=&cc=NL&wsip=2886780935&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_setid=NW&&rc=0&ksu=224&fdkt=355&kwd[]=Real%20Working%20Credit%20Card%20Generator&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=1&kid[]=329866638&kbc2[]=ps%3D2.573%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=274894815488&kwd[]=Best%20Antivirus%20for%20Mac&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=2&kid[]=3455176&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D1.58%7C%7Clvl%3D1.89&ktd[]=274911658240&kwd[]=Reset%20My%20Password&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=3&kid[]=24298917&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=Best%20Freeware%20Antivirus%20for%20Windows&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=4&kid[]=330072754&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.31%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=My%20Gift%20Card&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=5&kid[]=127438261&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=274894881024&rand=1610175649607&cid=8CU5BD6EW&vwid=1610175648905964403&vi=1610175648905964403&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_l1rakh=1610175648157038138&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1610175648800&upk=1610175649.1388&hvsid=00001610175648800031177223685006&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=41&matm=1610175649611&vgd_ltime=813&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=807619800&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D41&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886781043&vgd_nrrsf=nrr&vgd_nrrv=67306&vgd_nrrs=67306&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-647633027%7CDIV&vgd_x_pos=980&vgd_y_pos=723&vgd_ren_page_h=9676&vgd_cty=AMSTERDAM&vgd_l1hcsd=N4%7C111&vgd_sethcsd=C1%7C129&vgd_cfud=200306&vgd_is_amp=0&vgd_icat=379&vgd_spcat=500996&vgd_optout=0&vgd_ect=4g&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_l1rpth=%2Fdmedianet.js&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&oRurl=http%3A%2F%2Fcdn3%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DNL%26isOffice%3D0%26fvips%3D0%26vi%3D1610175648905964403%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D647633027%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26gdpr%3D1%26cb%3Dwindow._mNDetails.initAd%26pid%3D8PO5M70HK%26requrl%3Dhttp%253a%252f%252fsecurityaffairs.co%252fwordpress%252f58077%252fbreaking-news%252fcve-2017-0199-exploitation-poc.html%26%26katid%3D807619800%26katen%3D1%26katbid%3D-21&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:49 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H2 200 log
navvy.media.net/ Frame F5FE 807 B
997 B 284ms
284ms Other
image/gif 52.52.52.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.52.5 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-52-5.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 4E4D 15 B
216 B 31ms
31ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001610175648793031177223684485&geo=52.35|4.92&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYM46ecsQs_mhzjxRGJaz7v49bqFb2x5F9JLIaOg4bu7MczcDt4hC2h3Jvci_F_sVPpo_N7WbnZTf&lpid=&tsid=1&q=&prv=&type=&ps=&cme=-d4X23YyCQZe0LROC9-GSrJndEk2yP29TzciXXj8oV-a6Xi1pzeVtyGH73VAtG3_Z09Q9eC4iP6PqiHrTjA4CgYk6BFViPREYcqlICY0mla8IN0KXFL_9W9kWZYNIbAQTuy9WyI34DYO9_lsfJu0COiocAJeeihZET3tUqAcWepFle3MtDg8pzFByr-LkxI8YJilBEh8omftRoPCtxDt4w%3D%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CeWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA%3D%3D%7CN7fu2vKt8_s%3D%7CAOOnKKKt2kF7qFUw9-yaahs1nlfP9kb6_RYsP2j76_VN05onNx9S1p2Y3utUqPvhcqxjMGJ9w3ssN5yWwCYdouzlWFlWjkMdXNmhPogm6Sn1hD_8Vdc47JeQfwtyGqfLTCfEMybMYtrSnGOMhH4v5uvDjzkwtPaNxDYkrhbTJ6mbtR2tl_rverQud9mrzttHjAICIqtYMH8WlHgzPDWTzw%3D%3D%7C&hint=&td=&cc=NL&wsip=2887305228&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_setid=Nu9&&rc=0&ksu=224&fdkt=355&kwd[]=Real%20Working%20Credit%20Card%20Generator&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=1&kid[]=329866638&kbc2[]=ps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.17&ktd[]=274894815488&kwd[]=Best%20Antivirus%20for%20Mac&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=2&kid[]=3455176&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D1.66%7C%7Clvl%3D1.89&ktd[]=274911658240&kwd[]=Reset%20My%20Password&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=3&kid[]=24298917&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=Best%20Freeware%20Antivirus%20for%20Windows&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=4&kid[]=330072754&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.31%7C%7Clvl%3D1.00&ktd[]=274894881024&kwd[]=My%20Gift%20Card&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=5&kid[]=127438261&kbc2[]=0%7C%7Cps%3D2.573%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=274894881024&rand=1610175649529&cid=8CU5BD6EW&vwid=1610175648156061806&vi=1610175648156061806&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_l1rakh=1610175648157038138&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1610175648793&upk=1610175649.1388&hvsid=00001610175648793031177223684485&verid=3121199&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=5&matm=1610175649536&vgd_ltime=822&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=801835331&vgd_katbid=-21&vgd_kals=ttype%3D10002%7C%7Cpc%3D5&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2887305297&vgd_nrrsf=nrr&vgd_nrrv=67306&vgd_nrrs=67306&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-184323154%7CDIV&vgd_x_pos=980&vgd_y_pos=413&vgd_ren_page_h=9676&vgd_cty=AMSTERDAM&vgd_l1hcsd=N4%7C111&vgd_sethcsd=C1%7C129&vgd_cfud=200409&vgd_is_amp=0&vgd_icat=379&vgd_spcat=500996&vgd_optout=0&vgd_ect=4g&vgd_rensize=300_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_l1rpth=%2Fdmedianet.js&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&oRurl=http%3A%2F%2Fcdn3e%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DNL%26isOffice%3D0%26fvips%3D0%26vi%3D1610175648156061806%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D184323154%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26gdpr%3D1%26cb%3Dwindow._mNDetails.initAd%26pid%3D8PO5M70HK%26requrl%3Dhttp%253a%252f%252fsecurityaffairs.co%252fwordpress%252f58077%252fbreaking-news%252fcve-2017-0199-exploitation-poc.html%26%26katid%3D801835331%26katen%3D1%26katbid%3D-21&tdAdd[]=uiparams%3D%3Brend_w%3A300%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A5&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:49 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H2 200 log
navvy.media.net/ Frame 4E4D 807 B
997 B 293ms
293ms Other
image/gif 52.52.52.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.52.5 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-52-5.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/ Frame 6687 234 KB
88 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b6b975bd4630bc5d6e825c009212b09810f07ed7159bcee6df5568b0a49173e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 89528
x-xss-protection: 0
server: cafe
etag: 1324544567662719642
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/ Frame EA02 0
0 6ms
5ms Document
text/html 2a00:1450:4001:819::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20201203/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 08 Jan 2021 12:24:21 GMT
expires: Fri, 22 Jan 2021 12:24:21 GMT
content-type: text/html; charset=UTF-8
etag: 10723747146953794269
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4923
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 66988
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 6687 208 B
648 B 80ms
29ms Script
text/javascript 216.58.205.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s24-in-f226.1e100.net

Software

cafe /

Resource Hash

12d63fae6a59ff402d23324b08985f0b460e40bb76bcb6c3a80b6256a71edb05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 6687 109 B
169 B 14ms
14ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 6687 109 B
169 B 15ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 10A9 0
0 264ms
264ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1357492134&pi=t.ma~as.1139220782&w=320&lmt=1610175649&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&flash=0&wgl=1&dt=1610175649624&bpp=17&bdt=32&idt=61&shv=r20201203&cbv=r20190131&ptt=5&saldr=sa&correlator=4908924207289&frm=21&ife=1&pv=2&ga_vid=1361115776.1610175648&ga_sid=1610175650&ga_hid=773169837&ga_fc=1&nhd=3&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=1187&biw=1600&bih=1200&isw=320&ish=50&ifk=1421460154&scr_x=0&scr_y=0&eid=21066700%2C21066793%2C42530672%2C21068083%2C21068769%2C21068986%2C21069719&oid=3&pvsid=2783402013573676&pem=897&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=8196&bc=23&ifi=1&uci=1.yxtedamve753&fsb=1&xpc=4uSNUxpNkw&p=http%3A//securityaffairs.co&dtd=82

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13017347969563832498/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13017347969563832498/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP28g92jju4CFdPO1Qod8zoFAA&gqi=oVT5X4uBLIiVtgfSsoXADQ&layout=/sadbundle/%24csp%253Der3%24/13017347969563832498/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1575911585432548&output=html&h=50&slotname=1139220782&adk=2470624294&adf=1357492134&pi=t.ma~as.1139220782&w=320&lmt=1610175649&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&flash=0&wgl=1&dt=1610175649624&bpp=17&bdt=32&idt=61&shv=r20201203&cbv=r20190131&ptt=5&saldr=sa&correlator=4908924207289&frm=21&ife=1&pv=2&ga_vid=1361115776.1610175648&ga_sid=1610175650&ga_hid=773169837&ga_fc=1&nhd=3&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=1187&biw=1600&bih=1200&isw=320&ish=50&ifk=1421460154&scr_x=0&scr_y=0&eid=21066700%2C21066793%2C42530672%2C21068083%2C21068769%2C21068986%2C21069719&oid=3&pvsid=2783402013573676&pem=897&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C50&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=8196&bc=23&ifi=1&uci=1.yxtedamve753&fsb=1&xpc=4uSNUxpNkw&p=http%3A//securityaffairs.co&dtd=82
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13017347969563832498/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13017347969563832498/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP28g92jju4CFdPO1Qod8zoFAA&gqi=oVT5X4uBLIiVtgfSsoXADQ&layout=/sadbundle/%24csp%253Der3%24/13017347969563832498/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 09 Jan 2021 07:00:49 GMT
server: cafe
content-length: 29360
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 09-Jan-2021 07:15:49 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Sat, 09 Jan 2021 07:00:49 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6687 74 KB
28 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a2c24123bf9e2d278064a1c1596653f626b24deeda2c4422de8882840f82e83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1609936916402840"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28340
x-xss-protection: 0
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 3BC1 15 B
216 B 25ms
24ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&vgd_l2type=setting&v=1&gdpr=1&hvsid=00001610175648636031177223682373&geo=52.35|4.92&dlper=25&lper=100&fp=EIMN-ehR7Pps_CSyS_Yzo-2i1OixKc5bW9c2mufwmM6qC9U44Q2KYM46ecsQs_mhzjxRGJaz7v49bqFb2x5F9JLIaOg4bu7MczcDt4hC2h0Xi7KN1n2jivII6zZa4yyZ&lpid=&tsid=1&q=&prv=&type=&ps=&cme=7dPTaC80jmONe_0Uk-RLLH8GSMDOKT4KmlTIf0kY-Ggcu1UyI0LVc4db1mydz-lsd75HkSZVGwFodFgJWJ1YvKT5c4fX1zsC6m1nuIYvdJn1iP04xRVUdnkIpl5mmN3dgFiRLp7XtXJ_5ZUVHAP7h9gND79hDQlTDvZcxqATq7fNxCYex7A5TIFrKZRGEhgOLr7_akyyon3ysuxFxJ1p88xZmk1tSrVA%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7C5gDUJdTGiJzedmq9hanWYg%3D%3D%7CsRBSg3CPSiQ%3D%7CeWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA%3D%3D%7CN7fu2vKt8_s%3D%7C-pGhp3PZbe631BIrocFzWjhbMjgCexO-TsfHLo1DrO9xIZVc3i-R8bwiEJA2ssVWAmi5pqW3CGt0q5svpnAapCzuV1WQZIPBYX7W86mcyNaFs0GD-qUruQB_f1pTQdmB1deUz9cxc94i1ZlM-i7LSd2vCT33fRth4flJ2pjh5fF4MDWWwbbDj3VJbYvWXiIfSRlWRlI-RXgiXyBOuNsLlg%3D%3D%7C&hint=&td=&cc=NL&wsip=2886781335&bca=0&ugd=4&vgd_chost=contextual.media.net&vgd_fcic=1&vgde_setid=NW&&rc=0&ksu=224&fdkt=355&kwd[]=Real%20Working%20Credit%20Card%20Generator&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=1&kid[]=329866638&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D4919121%7C%7Cps%3D2.573%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=275700322560&kwd[]=Reset%20My%20Password&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=2&kid[]=24298917&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D3177199%7C%7Cps%3D2.573%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=277042499840&kwd[]=Tracking%20Cell%20Phone%20Numbers&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=3&kid[]=28781155&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D1708911%7C%7Cps%3D2.573%7C%7Crpc%3D0.17%7C%7Clvl%3D1.00&ktd[]=275717099776&kwd[]=Best%20Freeware%20Antivirus%20for%20Windows&kwt[]=355&kbc[]=66c34d22d50ae4786c1f78718a8660c6.d2s&kwp[]=4&kid[]=330072754&kbc2[]=0%7C%7Cir%3D1%7C%7Ciid%3D2235754%7C%7Cps%3D2.573%7C%7Crpc%3D0.31%7C%7Clvl%3D1.00&ktd[]=277310935296&rand=1610175649520&cid=8CU5BD6EW&vwid=1610175648600405368&vi=1610175648600405368&l3ch=0&slnkp=no&tdAdd[]=ib=0&vgd_uspa=0&vgd_l1rakh=1610175648157038138&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D2%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&sttm=1610175648645&upk=1610175649.1388&hvsid=00001610175648636031177223682373&verid=4121199&kbbq=%26sde%3D1%26adepth%3D2%26ddepth%3D1%26asn%3D9009&vgd_isiolc=1&npgv=1&pid=8PO5M70HK&katen=1&pc=4&matm=1610175649524&vgd_ltime=1079&vgd_ltimesrc=2&abpl=2&tdAdd[]=nw%3DNone&tdAdd[]=nwType%3DNone&tdAdd[]=asnum%3D9009&tdAdd[]=proxy%3DNone&tdAdd[]=comp%3DNone&vgd_l2ch=0&vgd_l1ch=1&vgd_katid=807056983&vgd_katbid=-21&vgd_kals=ttype%3D10007%7C%7Cpc%3D4&vgd_kasts=tstype%3D-10408%7C%7Cgbid%3D-1&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_sbSup=1&vgd_l2wsip=2886781041&vgd_nrrsf=nrr&vgd_nrrv=67306&vgd_nrrs=67306&vgd_nrrmf=4a&vgd_cntrdt=AS%7CDIV-816788371%7CDIV&vgd_x_pos=327&vgd_y_pos=7715&vgd_ren_page_h=9676&vgd_cty=AMSTERDAM&vgd_l1hcsd=N4%7C111&vgd_sethcsd=C1%7C129&vgd_cfud=200312&vgd_is_amp=0&vgd_icat=379&vgd_spcat=500996&vgd_optout=0&vgd_ect=4g&vgd_rensize=600_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_l1rpth=%2Fdmedianet.js&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&oRurl=http%3A%2F%2Fcdn3%2Fmediamain.html%3F%26nb%3D1%26settings%3D1%26%26cc%3DNL%26isOffice%3D0%26fvips%3D0%26vi%3D1610175648600405368%26lw%3D1%26esi%3D1%26size%3D300x250%26crid%3D816788371%26vpf%3D000%26cid%3D8CU5BD6EW%26ugd%3D4%26chost%3Dcontextual.media.net%26vif%3D1%26blacpfl%3D1%26https%3D1%26blapd%3D0%26nse%3D5%26baeFlag%3D0%26cpcd%3DRlAcVccC-RdUYIl-LjF9ag%253d%253d%26nb%3D1%26gdpr%3D1%26cb%3Dwindow._mNDetails.initAd%26pid%3D8PO5M70HK%26requrl%3Dhttp%253a%252f%252fsecurityaffairs.co%252fwordpress%252f58077%252fbreaking-news%252fcve-2017-0199-exploitation-poc.html%26%26katid%3D807056983%26katen%3D1%26katbid%3D-21&tdAdd[]=uiparams%3D%3Brend_w%3A600%3Brend_h%3A250%3Bwin_w%3A1600%3Bwin_h%3A1200%3Bkwd_scnt%3A4&vgd_end=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:49 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H2 200 log
navvy.media.net/ Frame 3BC1 807 B
997 B 195ms
195ms Other
image/gif 52.52.52.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://navvy.media.net/log
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/4a/nrrV67306.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.52.52.5 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-52-52-5.us-west-1.compute.amazonaws.com
Software: Jetty(9.4.7.v20170914) /
Resource Hash: 0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
server: Jetty(9.4.7.v20170914)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache,no-store
content-length: 807
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H/1.1

400
Bad Request

setuid
prebidserver.pixfuture.com/ Frame F3F6
Redirect Chain

https://cm.mgid.com/m?cdsp=363893&adu=https%3A%2F%2Fprebidserver.pixfuture.com%3A8000%2Fsetuid%3Fbidder%3Dmgid%26gdpr%3D1%26gdpr_consent%3D%26uid%3D%7Bmuidn%7D
https://prebidserver.pixfuture.com:8000/setuid?bidder=mgid&gdpr=1&gdpr_consent=&uid=l08NtRQuCp0n

36 B
36 B

314ms
121ms

Image
text/plain

157.245.94.128
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebidserver.pixfuture.com:8000/setuid?bidder=mgid&gdpr=1&gdpr_consent=&uid=l08NtRQuCp0n
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 157.245.94.128 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 248c5c260b8061ece6b0d78fb45760c32e728018cd13b8e44557f9de44d3ebb0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:50 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: text/plain; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 36
Expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:49 GMT
cf-cache-status: DYNAMIC
x-mg-request-uuid: ebae7e8d-56ed-4e50-b0e5-20d3e842f3f1
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
location: https://prebidserver.pixfuture.com:8000/setuid?bidder=mgid&gdpr=1&gdpr_consent=&uid=l08NtRQuCp0n
cache-control: max-age=0, no-store, no-cache, must-revalidate
access-control-allow-credentials: true
cf-ray: 60ec48934f58c83b-AMS
content-type: image/gif
cf-request-id: 07878bb00a0000c83b2f0f7000000001
server: cloudflare

GET
H/1.1 200
OK show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 603F 91 KB
33 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/djax_elastic.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c034ae9048b3bf355ad9acf408321d67ebe7cdfb49f26f7a472df5b7cd95e59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 10461119156362163573
Vary: Accept-Encoding
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 33076
X-XSS-Protection: 0
Expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H/1.1 200
OK demo_track.js Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame F3F6 3 KB
3 KB 188ms
89ms Script
application/javascript 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v893
Requested by: Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 7b420ad439dadbbbc88cef506a6e2ea73c331178f08f984c6b230cec7ac66a04

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 09 Jan 2021 07:00:49 GMT
Last-Modified: Mon, 06 Jul 2020 13:30:16 GMT
Server: nginx/1.10.3 (Ubuntu)
ETag: "5f032768-a4e"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=172800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Content-Length: 2638
Expires: Mon, 11 Jan 2021 07:00:49 GMT

GET
H3-Q050 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/ Frame 603F 234 KB
88 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1575911585432548&plah=securityaffairs.co&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b6b975bd4630bc5d6e825c009212b09810f07ed7159bcee6df5568b0a49173e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 89528
x-xss-protection: 0
server: cafe
etag: 1324544567662719642
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 09 Jan 2021 07:00:49 GMT

GET
H3-Q050 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 603F 12 B
458 B 107ms
78ms Script
text/javascript 216.58.205.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=securityaffairs.co&callback=_gfp_s_&client=ca-pub-1575911585432548&cookie=ID%3D172b32b7c0df13e9-226a816b83b9009d%3AT%3D1610175649%3ART%3D1610175649%3AS%3DALNI_MaCZ8AC_FJuozyQnGmE0f2WR4gSVw

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s24-in-f226.1e100.net

Software

cafe /

Resource Hash

daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.de/adsid/ Frame 603F 109 B
127 B 16ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=securityaffairs.co

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ Frame 603F 109 B
150 B 15ms
14ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=securityaffairs.co

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 1588 0
0 320ms
319ms Document
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1357492135&pi=t.ma~as.1680648786&w=300&lmt=1610175649&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&flash=0&wgl=1&dt=1610175649790&bpp=12&bdt=28&idt=57&shv=r20201203&cbv=r20190131&ptt=5&saldr=sa&cookie=ID%3D172b32b7c0df13e9-226a816b83b9009d%3AT%3D1610175649%3ART%3D1610175649%3AS%3DALNI_MaCZ8AC_FJuozyQnGmE0f2WR4gSVw&correlator=4908924207289&frm=21&ife=1&pv=1&ga_vid=1361115776.1610175648&ga_sid=1610175650&ga_hid=1638108203&ga_fc=1&nhd=3&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=8074&biw=1600&bih=1200&isw=300&ish=250&ifk=4293012932&scr_x=0&scr_y=0&eid=21066700%2C21066793%2C42530672%2C21068083%2C21068769&oid=3&pvsid=4355336010930332&pem=897&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=8196&bc=23&ifi=1&uci=1.l81hutyeddz&btvi=1&fsb=1&xpc=qlgoJayeVB&p=http%3A//securityaffairs.co&dtd=66

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-1575911585432548&output=html&h=250&slotname=1680648786&adk=1022037533&adf=1357492135&pi=t.ma~as.1680648786&w=300&lmt=1610175649&url=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&flash=0&wgl=1&dt=1610175649790&bpp=12&bdt=28&idt=57&shv=r20201203&cbv=r20190131&ptt=5&saldr=sa&cookie=ID%3D172b32b7c0df13e9-226a816b83b9009d%3AT%3D1610175649%3ART%3D1610175649%3AS%3DALNI_MaCZ8AC_FJuozyQnGmE0f2WR4gSVw&correlator=4908924207289&frm=21&ife=1&pv=1&ga_vid=1361115776.1610175648&ga_sid=1610175650&ga_hid=1638108203&ga_fc=1&nhd=3&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=320&ady=8074&biw=1600&bih=1200&isw=300&ish=250&ifk=4293012932&scr_x=0&scr_y=0&eid=21066700%2C21066793%2C42530672%2C21068083%2C21068769&oid=3&pvsid=4355336010930332&pem=897&rx=0&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C250&vis=1&rsz=%7C%7CEbr%7C&abl=CS&pfx=0&fu=8196&bc=23&ifi=1&uci=1.l81hutyeddz&btvi=1&fsb=1&xpc=qlgoJayeVB&p=http%3A//securityaffairs.co&dtd=66
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 09 Jan 2021 07:00:50 GMT
server: cafe
content-length: 20830
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 09-Jan-2021 07:15:49 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Sat, 09 Jan 2021 07:00:50 GMT
cache-control: private

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 603F 74 KB
28 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a2c24123bf9e2d278064a1c1596653f626b24deeda2c4422de8882840f82e83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1609936916402840"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28340
x-xss-protection: 0
expires: Sat, 09 Jan 2021 07:00:49 GMT

POST
H/1.1 200
OK demo_track.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame 0CF6 36 B
652 B 179ms
165ms XHR
text/html 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.php
Requested by: Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v964
Protocol: HTTP/1.1
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e70696531ebef4e25c157f95ad6730a529ac4df922aa285b3d6e9236007e8820

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:49 GMT
Content-Encoding: gzip
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=172800, public, no-transform
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires: Mon, 11 Jan 2021 07:00:49 GMT

POST
H/1.1 200
OK demo_track.php Show response
served-by.pixfuture.com/www/headerbid/library/tracking/ Frame F3F6 36 B
652 B 195ms
182ms XHR
text/html 68.183.31.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: http://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.php
Requested by: Host: served-by.pixfuture.com
URL: https://served-by.pixfuture.com/www/headerbid/library/tracking/demo_track.js?v893
Protocol: HTTP/1.1
Server: 68.183.31.14 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e70696531ebef4e25c157f95ad6730a529ac4df922aa285b3d6e9236007e8820

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Sat, 09 Jan 2021 07:00:50 GMT
Content-Encoding: gzip
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=172800, public, no-transform
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Expires: Mon, 11 Jan 2021 07:00:50 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6687 8 KB
6 KB 18ms
18ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201203&st=env

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ba0cc3db07118a80d8b0e9e56bc9de340ab275ecdb2a8fea2ecb4e17f24bdcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 09 Jan 2021 07:00:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6404
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6687 16 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

baf04ff369a96d4bb7228e99a65163de20845bf23826295dd3471afd3cee9ee5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1607463675096825"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6146
x-xss-protection: 0
expires: Sat, 09 Jan 2021 07:00:50 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/220/ Frame DECF 0
0 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/220/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/220/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4868
date: Fri, 08 Jan 2021 16:36:26 GMT
expires: Sat, 08 Jan 2022 16:36:26 GMT
last-modified: Tue, 27 Oct 2020 18:37:37 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 51864
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 23ms
23ms Image
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8PO5M70HK&vgd_viab=1&katid=806241105&kals=ttype%3D10002%7C%7Cpc%3D9&katen=1&pc=9&kata=aton&katbid=-21&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&cme=hbAA2rMEkLSKx09IMp143JL0V2hecdw0RQJq5ylNaINc1d1Dfa2NX03AgaoZyxzuz20KDwIUgKmWkeRhL6H04t5EPBa828_LloZPa8pMNzR-dgj83uO1x2PGH-AFjKAom0xfVj1-vD0GbiAnpa0Xi70o304yxNKi9ykOQ3dsqL_rxe9vnu3c_yRjLsJprKATEKSElTKtyJKg09Vnh8uEyQ==||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|eWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA==|N7fu2vKt8_s=|IAGT-eCIjPoDBLpySE_kVeyxEC6DVwtbmFjLkuKW714McxrQCYmtygdHJPDunxDSV1puDDGps1J53gfnOPiXC5_Lr7kKD_UgZi5yGlB2-_TgapfTNSFh6egg6kYTxognHQUyFGFH7tlmE1tl5cwmGV2FBnM0_hyd_YaUBYDeWFsVxRf8ccBDRMMXFn2wTI5tRAP3-7hWgd5R0zezgb9uJA==|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=829833831&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vi=1610175648177685265&ugd=4&cc=NL&startTime=1610175648567&l2type=setting&vgd_l1rakh=1610175648157038138&l1ch=1&sttm=1610175648575&upk=1610175649.1388&hvsid=00001610175648575031177223685721&verid=4121199&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!N4|111&vgd_uspa=0&vgd_isiolc=1&clp=%7B%7D&l2ch=0&l2wsip=2887305228

Requested by

Host: securityaffairs.co
URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:50 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:50 GMT

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 603F 9 KB
7 KB 17ms
17ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201203&st=env

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44bc454680b79053af9a1ab20f60b78959317df05e0ce4eb7fed014bbb43d331

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 09 Jan 2021 07:00:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6645
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 603F 16 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

baf04ff369a96d4bb7228e99a65163de20845bf23826295dd3471afd3cee9ee5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 09 Jan 2021 07:00:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1607463675096825"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6146
x-xss-protection: 0
expires: Sat, 09 Jan 2021 07:00:50 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/220/ Frame 4CC5 0
0 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/220/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/220/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4868
date: Fri, 08 Jan 2021 16:36:26 GMT
expires: Sat, 08 Jan 2022 16:36:26 GMT
last-modified: Tue, 27 Oct 2020 18:37:37 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 51864
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6687 0
175 B 16ms
15ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=220&t=2&li=gda_r20201203&jk=2783402013573676&bg=!wMOlw-PNAAXKjztByliocyPClMicIgIAAABuUgAAABFoAQcKAPnYwnNrafGoAdQw-yrjtHkauUc-XfG2eSct-bAizHuC0R8wdXCjN-ndqmQYKfjgSi9tHD5NMC_-wwT6gxnjtJggbpIId15Ph9UhLxoyC7aEXkQA8UgQiBKGOfsa7XljpKB0wTx2cjfnDkqEZxQZ3nIYjYk9eDc2cF--x6XsmZRKDRRkEO1TyX14fV20ShiDoxokq69eINuQ6aFOoQT0Vg50Fomfn2s1aWfbWXIGdmSinpGkGG9rMhcglwQTEJ5VVE3vcYA5G0zKRQeEQNuZL-YNZ2ocKI1u-KAxYJPgp3NZz3nQ33DSkpK4sPdtPqG-lNmDQwj4tTqwbO2ZAgtBGKJUJJiCUgkhASgyAwAuq7udrMttoFYcoNSqSY2rXlj1BYht-kIQm3DVCifB1KHB3O-9SMt73oGJ2eoq65D-QBTLTRUu0Ne2eTCX_IyRm8cRCfAoAMrMordEgIHK3TDXfuIATJcjbKcOMZT_BP0tVog9QvaZdqF63kDRXdpNW9bIfrT6YGAxXjIbCtOMbEPadPMWMkxCmnNZsL_YKSJsjftIhoQCps6-D10GXSXMUguucFWYFlp1EVP6vm6ubKq7aat_WSCpetq43sQln0EGBnZPfZ3TpuXnbFf7ggszbKuSrqItRTmXHESg6-c4ARsEHrZswpdhStYbF1zayo95nE9Q-LQ9xeQ257I_mPwPFkbRq31ORIvQr3ehD2SsvgMlQjcJ-zMpe6sKMAJ7zgfyXhWGDshIB7sPSClSeSejsGB0tV5h1vHf1Uk1OtZjvmbEfQ4rOYatYRCjf-fqfJ0SfA-Jxv1YTtTcpuvGiujvoCOBlET4okKkRTQXas8pdA1NwmYCM5hcMDE2q_vIHhnMyWqlFeEKigV6TTRCbEXfgQ2NaxPO76un8U7K_qw5f9ccohYgFerKZCAQjhg4T1tdOuO7K1XpzvFLtOJ4fdS1tDOMvJabcOxICZtyUcKgcXMBJ8tKOezEznp_sf5wnROnAULcOamZWqStSmptw53440bkKkppUyC96yMN

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 603F 0
23 B 15ms
14ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=220&t=2&li=gda_r20201203&jk=4355336010930332&bg=!NjWlNRXNAAXKjztBylgExp9aDm6UtwIAAAB0UgAAABJoAQcKAQbhNc2TkOzYDGVJZo9so7saKKj3rhod9-yRBR1mnn7bCN1FitX2oKUP77lbZtdgg55_-Z4gMFqk1-qmD89hw88vu9Wv6cFMBJHZPFT6yRgMvaJsmtkQ31rioXQiM8ypvQ-DLZESb0vfx6IBiDn5G7vnswbkxxnOKftPjPMpklAi16oCV1dxZTH8Hs09e_E-9NZb5y2MKQBSnYRIwOzmiRy3GxOkjxQEIhAvOYY7GztIi4ndCXtIEl8ICBEwBpYCcucC7_veMg2L87t129qGUalzpg7v_PExTrS21n7Teo3cMl2PDuGmsvk3osE3CHws20BK8jNiFyXZMS8q-cpB-l0oRkNKc6yImQIq84Y2MwJqodapHGzuOSjYKw1ep4albEo219MFwVGtgecZf-cQ_oTxfNMLQiY0kUWFX1dcyiW0V_452milJNkfcPXseH0-iDbCQ8se1y4ckhbV42coIa01PK86cLDZ5cAq80Q20lXpLIZrhwJ-EmHWVTvOMwhqmsbPFNpnBT4ilqtC25Q36oR30fzup7y7BBpptqqAYHU6KIgrkdiSNK7w73SIKAEAE0sbU8fXJu7sgoBgPu82Hg8tBeyhWaNs_JQYwizivDiu76EayazjmupWAHurhwNSHx_jIYb0MXwcaNr_KNoTgc7LgbNTChgePFfSKwMCPCEhbNydfinTS1GA_FRR6BCSjXJNSQpZWvc-ZlbV_m27lmTkJyPdBF_YLPE3mpHS6SUvmHA5ZZ1x0y6Hya1rIzwIzm8bk0xupx375ggLWQfhhpUoEO-D4r7VoyNRYVxhy1-tHhOnXqWBeYdnKVi4Z-VL-rrfCG-YyuCWMCi8VgnTIYlU7dFGSFhRUSghgUDsbbK1GTWLyO_0HYDLJDZU4whcC9KU1i4AKqnX56_L5g7XrERQw6wuJQmWnwih9zWGzzfauUGYnjtjc8Uo4iRXgJuTklQ3E26sOwRo7zsO391txERJkAU_jny2cVGvxz4T1CBOTJIkjyft5xEVu2ywtSATxzBWCJf0dC-R_T4cRIvQbZG_9qhA9cabuovgxwMVCd2zFT-b8Z22uML8IezP4QwqICcvIxU

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Jan 2021 07:00:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 29ms
29ms Image
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8PO5M70HK&vgd_viab=1&katid=801835331&kals=ttype%3D10002%7C%7Cpc%3D5&katen=1&pc=5&kata=aton&katbid=-21&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&cme=-d4X23YyCQZe0LROC9-GSrJndEk2yP29TzciXXj8oV-a6Xi1pzeVtyGH73VAtG3_Z09Q9eC4iP6PqiHrTjA4CgYk6BFViPREYcqlICY0mla8IN0KXFL_9W9kWZYNIbAQTuy9WyI34DYO9_lsfJu0COiocAJeeihZET3tUqAcWepFle3MtDg8pzFByr-LkxI8YJilBEh8omftRoPCtxDt4w==||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|eWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA==|N7fu2vKt8_s=|AOOnKKKt2kF7qFUw9-yaahs1nlfP9kb6_RYsP2j76_VN05onNx9S1p2Y3utUqPvhcqxjMGJ9w3ssN5yWwCYdouzlWFlWjkMdXNmhPogm6Sn1hD_8Vdc47JeQfwtyGqfLTCfEMybMYtrSnGOMhH4v5uvDjzkwtPaNxDYkrhbTJ6mbtR2tl_rverQud9mrzttHjAICIqtYMH8WlHgzPDWTzw==|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=184323154&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vi=1610175648156061806&ugd=4&cc=NL&startTime=1610175648792&l2type=setting&vgd_l1rakh=1610175648157038138&l1ch=1&sttm=1610175648793&upk=1610175649.1388&hvsid=00001610175648793031177223684485&verid=3121199&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!N4|111&vgd_uspa=0&vgd_isiolc=1&npgv=1&clp=%7B%7D&l2ch=0&l2wsip=2887305297

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:50 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:50 GMT

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 24ms
24ms Image
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=setting&pid=8PO5M70HK&vgd_viab=1&katid=807619800&kals=ttype%3D10002%7C%7Cpc%3D41&katen=1&pc=41&kata=aton&katbid=-21&kasts=tstype%3D-10408%7C%7Cgbid%3D-1&cme=7dPTaC80jmMh3VV-IoHVUaA5e9n6fK9SledfdZOvOI7-NFAXV3HwjLuyjba-U6DysgJpZIRb_Iwk6TuXmmpXTXUNvthNS4w1pBDofVRClVdJRQUcgBpuDsUnCPUKOdBAR251O6YwXG3LBYSZLk0aeyFa2FY6h1mUqtiCQuyA1kV9N-beDPkK9YKBTP49yIR6tz-52xsRNx5PXrg7WOrewOLmPu-l9m6p||NDHRnZ9Gz3KXlI-i9OnZqQ==|5gDUJdTGiJzedmq9hanWYg==|sRBSg3CPSiQ=|eWkTMtlkczdb_gT2L0rFaTJNW5yD_Jncs8J3Jdb6OofZazkVsv3oRNGnp7eZi_tu_KTZ6gUO7HHbAFFdaI-pZPx-NC8DBoZXmkBdPyRaBfwZ0T3GATFbiA==|N7fu2vKt8_s=|arxRGMpJWtIwNlyrBpQxscZcPuJJ43fiONHy68soVzItALLXMcCTdPZheHjy-R9sC3w9iNuQSYiiPdF_XsByteJEbH_vjphj2Ei6dvm7tDsk_kvLty5G06nTmKJWfnr_ANzUKd1EZMtc77LugiMkajpaWMj4yac6BgqFGryGyEBH4opl7Lwd9sBqauzIfoWweOpbqALQyRoFV2-YO8fuvg==|&gdpr=1&prid=8PRHGG6T9&cid=8CU5BD6EW&crid=647633027&requrl=http%3A%2F%2Fsecurityaffairs.co%2Fwordpress%2F58077%2Fbreaking-news%2Fcve-2017-0199-exploitation-poc.html&vi=1610175648905964403&ugd=4&cc=NL&startTime=1610175648799&l2type=setting&vgd_l1rakh=1610175648157038138&l1ch=1&sttm=1610175648800&upk=1610175649.1388&hvsid=00001610175648800031177223685006&verid=3121199&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&l1hcsd=l1!N4|111&vgd_uspa=0&vgd_isiolc=1&npgv=1&clp=%7B%7D&l2ch=0&l2wsip=2886781043

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Sat, 09 Jan 2021 07:00:50 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Sat, 09 Jan 2021 07:00:50 GMT

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ Frame 0CF6 44 B
307 B 21ms
20ms XHR
text/plain 34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity/envelope?pid=1258

Requested by

Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.207.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

148.207.120.34.bc.googleusercontent.com

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 09 Jan 2021 07:00:50 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
access-control-allow-credentials: true
alt-svc: clear
content-length: 44

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame 0CF6 109 B
544 B 34ms
33ms XHR
application/json 63.33.218.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.33.218.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-218-134.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b3ee222b5092f2fe3391adf61714e5a080519c7e2e314f4b7c27b5ca1dc4e3e3

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 09 Jan 2021 07:00:50 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Mon, 08 Feb 2021 07:00:50 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 299E 0
0 69ms
24ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=144535
Expires: Sun, 10 Jan 2021 23:09:45 GMT
Date: Sat, 09 Jan 2021 07:00:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame 78E1 0
0 24ms
22ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=1
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.200.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=36fad51c-1368-4a29-8398-b97b7811ea01|1610175649
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=36fad51c-1368-4a29-8398-b97b7811ea01|1610175649; Version=1; Expires=Sun, 09-Jan-2022 07:00:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1610175650|gekin0vNiygu; Version=1; Expires=Sun, 24-Jan-2021 07:00:50 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.200.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 09 Jan 2021 07:00:50 GMT
content-type: text/html
content-length: 418
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 6790 0
0 71ms
26ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sun, 10 Jan 2021 07:00:52 GMT
Date: Sat, 09 Jan 2021 07:00:50 GMT
Connection: keep-alive

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame F3F6 108 B
543 B 34ms
34ms XHR
application/json 63.33.218.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.33.218.134 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-218-134.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 17c9355147f6f72c52b6b97c79ed2726d26ef19a6ef6f693d647254b75721a24

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 09 Jan 2021 07:00:50 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Mon, 08 Feb 2021 07:00:50 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 75E9 0
0 32ms
31ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=158127:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=144535
Expires: Sun, 10 Jan 2021 23:09:45 GMT
Date: Sat, 09 Jan 2021 07:00:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame B55B 0
0 23ms
23ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=1
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.200.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=9d434638-ce6f-418d-ac16-6301775de208&gdpr=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=36fad51c-1368-4a29-8398-b97b7811ea01|1610175649; pd=v2|1610175650|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=36fad51c-1368-4a29-8398-b97b7811ea01|1610175649; Version=1; Expires=Sun, 09-Jan-2022 07:00:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1610175650|mWkigqiysLommOgevNgunsn0; Version=1; Expires=Sun, 24-Jan-2021 07:00:50 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.200.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 09 Jan 2021 07:00:50 GMT
content-type: text/html
content-length: 317
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame B95B 0
0 26ms
26ms Document
text/html 2.18.232.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.pixfuture.com
URL: https://cdn.pixfuture.com/prebid4.19.0.js?v=3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.130 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-130.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sun, 10 Jan 2021 07:00:52 GMT
Date: Sat, 09 Jan 2021 07:00:50 GMT
Connection: keep-alive

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ Frame F3F6 44 B
110 B 21ms
20ms XHR
text/plain 34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity/envelope?pid=1258

Requested by

Host: ads.pubmatic.com
URL: http://ads.pubmatic.com/AdServer/js/pwt/158127/2642/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.207.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

148.207.120.34.bc.googleusercontent.com

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 09 Jan 2021 07:00:51 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
access-control-allow-credentials: true
alt-svc: clear
content-length: 44

GET rid
match.adsrvr.org/track/ Frame F3F6 0
0

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ Frame 0CF6 44 B
110 B 21ms
19ms XHR
text/plain 34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity/envelope?pid=1258

Requested by

Host: ads.pubmatic.com
URL: http://ads.pubmatic.com/AdServer/js/pwt/158127/2642/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.207.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

148.207.120.34.bc.googleusercontent.com

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 09 Jan 2021 07:00:51 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: http://securityaffairs.co
access-control-allow-credentials: true
alt-svc: clear
content-length: 44

GET rid
match.adsrvr.org/track/ Frame 0CF6 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: served-by.pixfuture.com
URL: http://served-by.pixfuture.com/www/delivery/headerbid_refresh_alex.php?dat=24272x320x50x4142x_ADSLOT1&keywords=windows,attacks,via,cve20170199,practical,exploitation,pocsecurity,affairs&refUrl=&refresh=false&innerWidth=1600&mainDiv=24272x320x50x4142x_ADSLOT1&flag=true

Domain: match.adsrvr.org
URL: http://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json

Domain: match.adsrvr.org
URL: http://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json

Verdicts & Comments Add Verdict or Comment

115 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 15:16:19	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-19 15:16:16	Name: test_cookie Value: CheckForPermission
.securityaffairs.co/	1970-01-20 00:37:51	Name: __gads Value: ID=172b32b7c0df13e9-226a816b83b9009d:T=1610175649:RT=1610175649:S=ALNI_MaCZ8AC_FJuozyQnGmE0f2WR4gSVw
.media.net/	1970-01-19 19:42:39	Name: gdpr_status Value: 1
.securityaffairs.co/	1970-01-19 19:35:27	Name: _pubcid Value: 36fad51c-1368-4a29-8398-b97b7811ea01
securityaffairs.co/	1970-01-20 00:37:55	Name: cto_bundle Value: 3TnOGV9WWkFTVzM5WXVXJTJGRWQyaHFnOHdsTDBNJTJCeHNiJTJCZTdPZWNOaXFEMHA4T0QyQ2dMZHBneFU3eUl3JTJCUDJOaU5BJTJGZ3FwUiUyRmdrJTJGJTJGRXpyM1o4UVlvSEdLNmJIcURGQm5VVTVBSWZUcURWSmpEd2pQWlJqNmFFMk9wZmhWTVBsMUZEeVI
.securityaffairs.co/	1970-01-19 15:16:15	Name: _gat Value: 1
securityaffairs.co/	1970-01-19 15:59:27	Name: _pbjs_userid_consent_data Value: 3524755945110770
securityaffairs.co/	1970-01-19 15:16:17	Name: session_depth Value: securityaffairs.co%3D1%7C829833831%3D1%7C816788371%3D2%7C733976884%3D1%7C184323154%3D1%7C647633027%3D1
securityaffairs.co/	1970-01-20 00:37:55	Name: cto_bidid Value: V3rq8F84bWFmbE51SWkxT293UTRUMjB4ckZhYU8zWXU4cTlTT0t0OFcwcDF3M01ieGFSZUdmdUJuYmp0b2ZvQWd0dGQlMkY2RkVzZ3RFT0pEa0h0eXRGTnZrM3ZBJTNEJTNE
.securityaffairs.co/	1970-01-20 08:47:27	Name: _ga Value: GA1.2.1361115776.1610175648
.securityaffairs.co/	1970-01-19 15:17:42	Name: _gid Value: GA1.2.1683456065.1610175648
securityaffairs.co/	1970-01-19 15:16:19	Name: cookielawinfo-checkbox-non-necessary Value: yes
securityaffairs.co/	1970-01-19 15:16:19	Name: cookielawinfo-checkbox-necessary Value: yes

37 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 69) Message: JQMIGRATE: Migrate is installed with logging active, version 3.3.2
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.blur() event shorthand is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.focus() event shorthand is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.load() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.click() event shorthand is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.hover() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.isArray is deprecated; use Array.isArray
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.submit() event shorthand is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.unload() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.scroll() event shorthand is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.trim is deprecated; use String.prototype.trim
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: 'jQuery.easing.swing' should use only one argument
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://ads.pubmatic.com/AdServer/js/pwt/158127/2642/pwt.js(Line 1) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	warning	URL: http://ads.pubmatic.com/AdServer/js/pwt/158127/2642/pwt.js(Line 1) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html(Line 101) Message: CMP IS NOT FOUND!!!
console-api	log	URL: http://securityaffairs.co/wordpress/58077/breaking-news/cve-2017-0199-exploitation-poc.html(Line 91) Message: CMP IS NOT FOUND!!!
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.isFunction() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.isWindow() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.bind() is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.offset() requires a valid DOM element
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace
console-api	warning	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 100) Message: JQMIGRATE: jQuery.fn.change() event shorthand is deprecated
console-api	log	URL: http://securityaffairs.co/wordpress/wp-includes/js/jquery/jquery-migrate.js?ver=3.3.2(Line 102) Message: console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acdn.adnxs.com
ads.pubmatic.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
apex.go.sonobi.com
api.rlcdn.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cdn.pixfuture.com
cm.mgid.com
connect.facebook.net
contextual.media.net
cvision.media.net
eu-u.openx.net
fonts.googleapis.com
fonts.gstatic.com
google-analytics.com
googleads.g.doubleclick.net
gum.criteo.com
hbopenbid.pubmatic.com
i0.wp.com
i1.wp.com
i2.wp.com
ib.adnxs.com
l.sharethis.com
lg3.media.net
match.adsrvr.org
maxcdn.bootstrapcdn.com
mug.criteo.com
navvy.media.net
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.wp.com
pixfuture2-d.openx.net
platform-api.sharethis.com
prebidserver.pixfuture.com
s.w.org
securepubads.g.doubleclick.net
securityaffairs.co
served-by.pixfuture.com
stats.wp.com
tpc.googlesyndication.com
w.sharethis.com
www.google-analytics.com
www.googletagservices.com
match.adsrvr.org
served-by.pixfuture.com
104.19.134.78
157.245.94.128
172.217.16.194
178.162.133.150
178.250.0.157
185.33.221.14
185.64.189.112
192.0.76.3
192.0.77.2
192.0.77.48
2.18.232.130
2.18.233.180
2.18.235.93
2001:4de0:ac19::1:b:3b
2001:8d8:100f:f000::289
216.58.205.226
2600:9000:2190:3800:c:abe:f440:93a1
2600:9000:2190:8600:1c:8a07:5e80:93a1
2600:9000:2190:9e00:c:a9b7:ddc0:93a1
2600:9000:2190:f400:3:c04e:c780:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:20::681a:a9c
2a00:1450:4001:800::2001
2a00:1450:4001:801::2003
2a00:1450:4001:801::200e
2a00:1450:4001:808::2002
2a00:1450:4001:814::200a
2a00:1450:4001:814::200e
2a00:1450:4001:819::2002
2a00:1450:4001:81c::2004
2a00:1450:4001:825::200a
2a02:2638::1c
2a03:2880:f02d:12:face:b00c:0:3
3.127.132.197
34.120.207.148
34.98.64.218
52.52.52.5
63.33.218.134
68.183.31.14
00a4c9aeb6f61ae7f260eea51d5d19a651544c01d202363463375992ef021960
00d534b6d1d7adf2faa7861ce9557403c3c08304e2791fd4301029b0e142c286
00f28fdb987ce0f9edc935ffe381123a2e1f79fcc0f55759a7bb4a83b4a88584
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05848a31b44a7d8adee51d4a583c006df6e096e2bc971ef88aeac32dc125122d
05999befd49ad70a0d0648a08d12fa80206fa88822a907ff426f0eadcc437c1a
0757f7ff6e5f6a581922a5e2d42c5e0cf7475d880885a9802e8bdd5e4188dd34
0758ad694d2f74d096d49d79e32cb100eeb38dc6ff11c2f9a870de5eb5a35b5f
0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9
0a4c16b7f5c1b1ecefc9ffb4fcf1b457f9282d0863fa61d4dd32ad98dafa9a60
0af2ffd88a1103a78ab2f29b330595ecf02311fb4cacc702ef4b48e44157318e
0bdb519e9746b7b770969e860e0bbf41606bc4b814479ddd4f8688f2cafcc01a
0bf3f6e79af33723b0c1a822f59a484a35583303ab76fa9227b694b1e719364f
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0c27a9c1aee9eacb73655f930a6bbf9ec721006695e5c38405296081cdbcb878
0c52182f8e00c9bb8b8d38697c894144d4470ab9ccce7fc3b38e3a25873f01d1
0e53466218d7ff174e0a083ecce89b1c090c67ccbe55775eddca03e930ff9e35
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
126fc92e8bc0fd89582e64fe1bbb7d67c39db3ec3b95b2a69c9a510033390dc3
12d63fae6a59ff402d23324b08985f0b460e40bb76bcb6c3a80b6256a71edb05
13b61826fde5b78966364a0bfe1f2309da1f0ccd75923528a5014978b7276742
177d76801bdbecdb0d27109e118ae54a929156deac8ca44b46924a5c0f43cd7a
17c9355147f6f72c52b6b97c79ed2726d26ef19a6ef6f693d647254b75721a24
1832a6ee34745b08b1fcae42c24468086358b43071d7679a738951aa7dc243ea
18d61b5ee68a57bd7a4733f776f9f8aa5c353e7f35a420881523b6edbf7c6b19
1aaab3c3d6f974416ae34893cebe3a544aea17931439b2449ec392061d11ec82
1e9a9ba24042f2effe58a5d585f70a7bc4b917e60ddcb9a780ad03817a78381f
2199990352edbb7ec586e01d26e2f6a7010a2fce1517711019b614dcec353ba3
2333802e4a0c86b4cc4c71b376fc0aedc3b03039bfc777d96105f82231215732
24583638f8c4bd2d5dff22bddefbb24f8d047868e71ad2c029b1698b6926c85c
248c5c260b8061ece6b0d78fb45760c32e728018cd13b8e44557f9de44d3ebb0
2991b7d17a1c5edbab11290738d6a7694c008fd78dbd2f9a466bec7ba5920b00
2a354649f57a81405daccfd6b5785da5f73ba638f2db591992cb7b739dac3135
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2d5a9aa4eabdb58974140a8dfdacfe1ddb89ae27819ad19e8e148649936dac4a
30bda439e9b01f68a5ed937b24b7c8bec19aad7d58f899d42ab077a7bdc9ed7f
326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347
33af102c76fdc1f99705d18595168fbb9e66e5d9f283fe258b2deab560374254
3c5aa35877bfa01198d2f3f27581c8547e6767c6ff155595d82b3073c7da1248
40bc46248d8f8d5fbea7678bd0c0031327e206daaf99f3bf6723b9a70f665f7f
40eca045fa7b87f3a451a385520d4e46e5326febf0ad5a64a762b2492c32bb78
44874bef62dddd5725fda1cd332c2a806eb0ec4526a9e4311e72a4914598f730
44bc454680b79053af9a1ab20f60b78959317df05e0ce4eb7fed014bbb43d331
45185c8f6cd2f9b42e3a02b78af40edc7d61328fac3167a0490c9c69bbecaaa6
46db7a0a77511a777f77205b377cde8df6937dbde8a6e63441d7829d8f6ccfee
47f5b2ba7dc4b1d498cf2f83bb1df236323a984a0d58e7a38e19951e39bd176f
49e0a45588654bdf62c81286a336f875b3858a2611b559c95ef3f8d267e1f2ad
4b6b975bd4630bc5d6e825c009212b09810f07ed7159bcee6df5568b0a49173e
50f4eb73e4854117bf7bf9da7dc0c17740b03b5db6eb7ee6ffc20aeb35c1ea48
5114d7ca3cfbfea81b689b0d8e018cc6365b09faa27cbe87dc441a642e4a68f3
5256d55a499ecb71f04dd716cfdf75bf9fe5f863620ec6634e3b43b4e6b11fd8
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
5525d57ced576560de8777ea78e4bc0c9d55396c0b668a7563b354de9c165aee
56159a7fa211c042c8da7005984653715f938917383f74292247f7b271469fb6
56adbe005fec98d625f094696217e24e3accadd033243c479a4ffc208b972626
5c7be85bfd10439dc176766f9692295f27f8e91eac21b5801f89320ae0c82f04
5d26e98e9600c9cea41a4f28dee915eedd266f450849d151a7f653d1738917de
6139b4d0af528ec1d0e26ae865c1ca04ac061d844ffa6ccc9e4adaa3af93a2f7
64f988d716443cf2b32e01fd9ec3937018a487abfc0c4d6c997c85d23de09c56
650868ebc4c00b2ea4ea72747f655f8a0552ba53c9b5b55defd9457be75f1aa9
65cfa6801a0886fab249b224e8a6982b4740fe7879fce99ff13ddaac9aaca01a
6625aeb9828db5fb40690a208e5ff4cd48d90c00b5d8cd4462fb4d41f76cb89a
6a99e7d178fd19b946a936a0f64d31a1af2e843b889ab515ada00d38622c5d67
6db457e858d57c8629255fcffd1d90780c1bd16c9141863b2f6fdcb96e3c3e56
6f3590f88e220dd4f5f21e6b8846a01f54f4b3c3619c796c19f54425186a9c0a
73cadf4725483d9a9290b8ea3ad87fe2afc746de5f70e89f088a3df9996bd8dd
7478123ab457a28ecf9df78f2832fbdbefc205eaef0930b4f6666903e756be46
759949fb0ffaa47eb3755d704adfee7be3ab4fd3d3fa2f37381ca6ea8b9506b1
75efdb5205ce720413bc9275c222ad30f9a9bdccfc05e9d585832fe6b2dcf2e1
76a18f5f0637e0d73ce1afece898ce8b0fa75bb6b1c1990ae4a7ac6b083045ce
78b32fbe4d4a6f9102f2a00e58424686cf3b7a4f9aac9863fa6096b665338075
7a2c24123bf9e2d278064a1c1596653f626b24deeda2c4422de8882840f82e83
7b420ad439dadbbbc88cef506a6e2ea73c331178f08f984c6b230cec7ac66a04
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8366ed0ada18d2a7861821f7e0cf3b9f664887185f8318c7d849674a081cf055
86f937a29eaee70aaf9935799a414bea46c62fb136cc0465f63f9d6820cf4982
8849db068242cce190602354fb438596fc537f5b0af3e5793949c2f2025338ec
8ba12716d220a67a1c9f17aacbb8f47f2a4adc12573748980942c5e73e161398
8c43e551763d3628fab88767caacb3188f69afa8d1290cf3f9d61ab09cb56073
8d732b3483eb44546a848a82cc9d6a584c81860aae7255f7ac589dcb3f130535
8e2246dbbd785043d2b37afbaec7b42b63e0b09f6ae619a3033b4f3e08268321
91f4f1aa2437cf886a484ac410eab84dfe059d24ec6249c52f50509e756b730c
9282ea078a317f764d3883e732d14a2e80575e437b710144396d453f5a19139a
93326772c35f1eb84dce912da5bf0934aee2d22abdd94c35786bf4cc7e472822
936c3e0cfba7a07ab55be383aeca9d39dcde7b4e9cddbfd973f78e34d3cc7078
943c44a0f3dc1aba84f5fbe8465baadbb90af66cd7be9f37ca07a39260357ad2
9a47abcc220084cd32dd51bd76f84ff7839e2dbf1a132fb970e8a1437f03726b
9b5b9b8b1984a7b55656ca3d243deb436e049467353f6e61e73ac8bd0ab2a636
9ba0cc3db07118a80d8b0e9e56bc9de340ab275ecdb2a8fea2ecb4e17f24bdcf
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
9c034ae9048b3bf355ad9acf408321d67ebe7cdfb49f26f7a472df5b7cd95e59
9c062d10663416484b5a59bb47a0308526bec56cc69e9f3499fa087d8eae5c7a
9c58ac806463ce6a16f4cb2a9c5bebd5acf61bb801bfe552aa2028f7deee1e9a
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0fded691aed767f851011cd3185b928619298a21a0fbdad4808a9e88b490833
a902ffc1c259dc54cb51d32618f4238568e5bcac3d32afc33e6729277f67dffb
b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc
b12c1cd811f54d11bfdcb5e235e73934a8b8a7a85eafb8529117f9a5bb64ccf8
b3ee222b5092f2fe3391adf61714e5a080519c7e2e314f4b7c27b5ca1dc4e3e3
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b884f703a391d10cfd72e4ab3676234d1608193283e42df9dd78cc1a21a33140
b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80
b91c47b0c2394e1841ad77242ebe5f351046a41d071e4007eec98adf4cee1de6
ba1efe6560ba6405f01d0afdadb2eeb510308eb853e4fec4250fe90b2895e21f
ba716187f8cc8c54806f5b9de46d1d94bec574ddf31c82f68532cd181e242b7f
baf04ff369a96d4bb7228e99a65163de20845bf23826295dd3471afd3cee9ee5
bb7d97eb19604573681684dfe0fef40692a943c29f59d11e7ba9eb39242e4e3b
bbd04d05057d75f9d9012aef276c8e4fa94f6e3e99e84bad86c87824a9cf10af
bcdd0df07b97be453ca5a77a1582ea69c99153acd15c1038b2c5c4d29ac1b8ab
bebe7080e566832958db2d1ae0ac5cffcb6ee64ca4a5dda453e7bb5587779425
c067a7d5bc50ed4ba554421966d6c4b0140ff2ed4574640fd5abcfa1ab35be11
c300b6a2877bb5b77918987020634e2c4981146589638e918bc4de730d19df90
c6dd64d2907400de9370602149661f286e840556b9e7a397b55f0961e88b41eb
c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24
c8817bacfc84fd39e4daec4096011ed3d117c7fe8b3c55fdd22af47c299099bc
c9490670cfbc3c585ad08b2ef0fbcdbd5dcc48704dfe5689e117dee3382cc5c2
cdead639340cfc19516295d269984bea0253aa479d54b22c8d52a8a28f2d0d0b
cf9b76f5559de92c2cc7df8fa751c09d9a3bbfada6123d975c75c4a093f8cfeb
d24350e3a8c6e3963544189c3d0cfcd8c11e5dbac0de76aace83993b7d16dcf6
d44b68c7b3e659196a6a72662f4e2e903044d6e64a6a5c0002602711cd68a8fa
d528130ac8be48ae8edf4b85131e7a81270216c59c0d0c1b564dd6c38741bf69
d5c42a9ec301b30dbbf78acd3b3e1c8706d58a1bca7d5fe369cbd5ef16d874a3
d927e4af917b3d3c3a5f7ef8108fa1b61f645e199cbe8c4be20c60c091bfd3da
d931ba2089021a1357761939c18bcc09aa856d39be2a707ea450333f5b3443c4
d94bb0e95ef200f1b8f6c00b1d40a694201da59079c73371a6d9963a16195ab1
d99ea9db1da8549489666d36c9e3fb717842550eed1554e96860af8d30c3b008
da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c
daa795332e5dbcf893adf2d5f3349f02b8c1cb957ff3b5f4c11b742e33c3376f
dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26
e0d5f39020fd89e95f190ba687cc7fccd10d833f20a8aefe6f3b1a17fc4178d6
e1ff8dee2622af6ca24da1d025aa91316b829006c44abf4fe27de5fe572f2633
e2dc35b0dbaa16b45d96eb3691927df48e091f4983ed2cc079568b789f9559da
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e503c59c36fc19803b2e9572b10e7c06236bda692aebd97f29e2a5a96f9aa5b6
e70696531ebef4e25c157f95ad6730a529ac4df922aa285b3d6e9236007e8820
e89bbc7723c5114f9cf138c6019bbca4e4f5e13f6b9febaa38c92c4c3584a964
e8caad51a19c5667e4fc7ae6a3b9bf8a23559bb64b09b0c6e90cad6d24083ea6
e98cd00e7be004c4360ad0c38471911312d74a117babcc29f239935afc80c8cb
e98e8d723dd2eaca28bade949628d27e81e6cf8c9b3e0fd8091fe4b3843f78ce
e9ca730d43d9afa60d924da59c74c8fb3a380648a2f4286dee4b76c74676d868
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0c6d2d27de284102b03e30cd74be808801ec53ca49f30b4d15620ee84ea39f5
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4d4eda42f85c6ccbbb5de2aff596085b3b1d380c8585464f2e53df2cad66f8e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb75a5747f9ec8d7051a06752ffb2b905e81fe3134379a54926d146dadf3b6bd

securityaffairs.co Open in urlscan Pro 2001:8d8:100f:f000::289 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

215 Requests

68 %HTTPS

49 %IPv6

27 Domains

46 Subdomains

39 IPs

7 Countries

3717 kBTransfer

6273 kBSize

14 Cookies

19 Outgoing links

Redirected requests

215 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289 Public Scan

Screenshot
Live screenshot

Full Image

215
Requests

68 %
HTTPS

49 %
IPv6

27
Domains

46
Subdomains

39
IPs

7
Countries

3717 kB
Transfer

6273 kB
Size

14
Cookies

215 HTTP transactions
13 data transactions