www.zdnet.com Open in urlscan Pro
2a04:4e42:3::444  Public Scan

54 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

• https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pwk35pvi3 HTTP 302
• https://kjtbe4qccc5esx54axna-pwk35p-fa4ae76e3-clientnsv4-s.akamaihd.net/eum/results.txt

Request Chain 51

• https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pwk35pvi3 HTTP 302
• https://fiaqj6absjkbikqce3ygyaaaabp3ybo2-pwk35p-3e442bcc8-clienttons-s.akamaihd.net/eum/results.txt

Request Chain 107

• https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9= HTTP 302
• https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=&cs_ak_ss=1

Request Chain 108

• https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9= HTTP 302
• https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=&cs_ak_ss=1

Request Chain 132

• https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CIS4hoSsme0CFRHiuwgdKyYARQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 236

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 237

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 238

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 240

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

295 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
16 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/	529 KB 148 KB	152ms 131ms	Document text/html	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d7e73d50cf79d01c44008857e1260b4e7813b7c5d788fa333750a654be9dfa5f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority www.zdnet.com :scheme https :path /article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" last-modified Mon, 23 Nov 2020 18:21:30 GMT referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id cc4101d5-d8a4-4576-8bb7-7c330ce1064a x-xss-protection 1; mode=block date Mon, 23 Nov 2020 18:56:23 GMT cache-control max-age=5400, private expires Mon, 23 Nov 2020 19:51:30 GMT set-cookie fly_geo={"countryCode": "de"}; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_device=desktop; max-age=604800; path=/; domain=.zdnet.com; Secure; fly_preferred_edition=eu; path=/; domain=.zdnet.com; Secure; fly_default_edition=eu; path=/; domain=.zdnet.com; Secure; vary Accept-Encoding, User-Agent strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes content-length 150675
GET H2	200	main-af19460416-rev.css zdnet3.cbsistatic.com/fly/css/core/	352 KB 59 KB	24ms 7ms	Stylesheet text/css	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 52828dfa3529d1c9daeed4a0706834537478c13874b064e7a7671185bed9812f Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff age 33495 vary Accept-Encoding, Accept content-length 59542 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:09 GMT server ContentServer x-frame-options SAMEORIGIN etag "25db43778e7cc1c634f38ef4cb0318ea" strict-transport-security max-age=31536000 content-type text/css access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:06 GMT
GET H2	200	controls-6870d3c422-rev.css zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/	19 KB 4 KB	48ms 23ms	Stylesheet text/css	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet2.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-6870d3c422-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash dfeddecaf8089d4325e7579019de8adeff79055f53ae4eb91db12aa6003e4376 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff age 33490 vary Accept-Encoding, Accept content-length 3956 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:10 GMT server ContentServer x-frame-options SAMEORIGIN etag "2c3cebf7d623a21903ffd142870efa5d" strict-transport-security max-age=31536000 content-type text/css access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:10 GMT
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	13 KB 5 KB	31ms 13ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9d0d33ff3cbe6054d46a549c75a09323fc711113b82fde575003df837cb9f4e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jYDzNb7TDeiVgZ0wAySJVQ== age 3763 vary Accept-Encoding content-length 4134 cf-request-id 06980fe93f00000ea7e89ae000000001 x-ms-lease-status unlocked last-modified Mon, 23 Nov 2020 02:33:31 GMT server cloudflare etag 0x8D88F582ACD4707 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id a4b9b703-b01e-004f-1a4c-c11cfe000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c21fae80ea7-FRA
GET H2	200	optanon-v1.1.0.js Show response cmg1.cbsistatic.com/privacy/optanon/	36 KB 36 KB	11ms 6ms	Script text/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cmg1.cbsistatic.com/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Strict-Transport-Security max-age=900 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT referrer-policy no-referrer-when-downgrade last-modified Thu, 05 Nov 2020 17:51:25 GMT server ContentServer age 1558502 etag "46e2aa30cbebb708b5fc468d57d56d8b" x-frame-options SAMEORIGIN content-type text/javascript cache-control public, max-age=604800 x-content-type-options nosniff strict-transport-security max-age=900 accept-ranges bytes content-length 36582 x-xss-protection 1; mode=block expires Thu, 05 Nov 2020 19:01:20 GMT
GET H2	200	catalin-cimpanu.jpg zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/	909 B 1016 B	15ms 15ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7cd54b3c177c3f63dd51c2dae4ef7ca4e3cd938c1afb60e4b4e9d78df952ac75 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff age 1204878 vary Accept-Encoding, Accept content-length 871 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:49:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"eea6e0b6dedefcdd0e40680af3f9f5c0" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:00 GMT
GET H2	200	malware-skull.jpg zdnet1.cbsistatic.com/hub/i/2020/11/19/dd6e0927-2ea7-4769-b44c-8a9bc5ab94fa/	15 KB 15 KB	38ms 20ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/19/dd6e0927-2ea7-4769-b44c-8a9bc5ab94fa/malware-skull.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 441a1db23c72a2f88f2fafa329b534822f73b4abca19a0a9241a0708f747fca7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT x-content-type-options nosniff x-goog-meta-imagewidth 1000 age 306609 x-goog-meta-imageheight 530 x-goog-meta-imageformat jpeg vary Accept-Encoding, Accept content-length 15189 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 16:56:25 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1bb677708eff32499c43b0a5cef9c743" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 15189 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:45 GMT
GET H2	200	require-2.1.2.js Show response zdnet2.cbsistatic.com/fly/js/libs/	16 KB 6 KB	16ms 11ms	Script application/javascript	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff age 27471 vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:07 GMT server ContentServer x-frame-options SAMEORIGIN etag "4109329246fc0f80fed87303509bd457" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 11:18:31 GMT
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame 2139	202 KB 51 KB	48ms 17ms	Script application/javascript	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:23 GMT Content-Encoding br Last-Modified Tue, 10 Nov 2020 10:15:28 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 51580
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	917 B 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	2 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	4 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	mag-white01.png zdnet3.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/	1 KB 1 KB	8ms 7ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/mag-white01.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT x-content-type-options nosniff age 33489 vary Accept-Encoding, Accept content-length 1265 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:18 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:06 GMT
GET H2	200	logo.png zdnet1.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	11ms 9ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/fly/1606124051-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT x-content-type-options nosniff age 33489 vary Accept-Encoding, Accept content-length 4105 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:42 GMT server ContentServer x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:18:41 GMT
GET H2	200	Semibold.woff2 zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	26ms 7ms	Font font/woff2	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.zdnet.com Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT x-content-type-options nosniff age 1389272 vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Thu, 05 Nov 2020 17:19:14 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 07 Nov 2021 17:00:51 GMT
GET H2	200	Regular.woff2 zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	24ms 6ms	Font font/woff2	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Origin https://www.zdnet.com Referer https://zdnet3.cbsistatic.com/fly/css/core/main-af19460416-rev.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT x-content-type-options nosniff age 5168069 vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Thu, 24 Sep 2020 15:27:12 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 24 Sep 2021 23:15:07 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	38ms 23ms	XHR application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0844bd3c4baeabefa82df5e7dab5789c384a63f93799d25d325923c87941b79b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OEOyq06PFOqP2wdlgJHyA== age 1234 vary Accept-Encoding content-length 1219 cf-request-id 06980feb800000c2ef77836000000001 x-ms-lease-status unlocked last-modified Thu, 29 Oct 2020 19:43:56 GMT server cloudflare etag 0x8D87C42F9703542 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6713cf80-201e-010a-3869-b6873a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c259b5fc2ef-FRA
GET H2	200	nr-1184.min.js Show response js-agent.newrelic.com/	27 KB 10 KB	32ms 29ms	Script application/javascript	151.101.114.110 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1184.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 780861f2ab29c0144055244696561fb0306c8cb3cb7f548f9105c763b0e91f77 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-amz-request-id A21809B1C987C063 x-cache HIT content-length 10624 x-amz-id-2 5/0iWHe8AbcxZN6Jo3BmJ2Q+tztfRSNwr+lcNTrsM79nJm6KurTN6rNwf14f8ELquc1TIDOjlf4= x-served-by cache-hhn4055-HHN last-modified Mon, 28 Sep 2020 16:34:45 GMT server AmazonS3 x-timer S1606157784.995007,VS0,VE0 etag "3d7f312be60d08a2568e311e4762f3af" vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 10056
GET H2	200	main.default.js Show response zdnet3.cbsistatic.com/fly/e8033f-fly/js/	753 KB 227 KB	14ms 8ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 727e2cb4c77abe8c29b0e78cdc4413e85a27172a133d44a5e70c756564d7295f Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:23 GMT content-encoding gzip x-content-type-options nosniff age 33496 vary Accept-Encoding, Accept content-length 231709 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 09:37:01 GMT server ContentServer x-frame-options SAMEORIGIN etag "e6e8e2b437d3cea16fce3878347530f9" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 30 Nov 2020 09:38:06 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	164 B 515 B	63ms 35ms	Script text/javascript	2606:4700:10::6814:b844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0cc0930a1ab7e9ae754783576228f3c32caa07605236711cf81035f3f45f0ea Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 5f6d1c262e32d6f1-FRA cf-request-id 06980febd70000d6f15b1a6000000001
GET H/1.1	200 OK	NRJS-04e0f5db0886b3b33ff Show response bam-cell.nr-data.net/1/	57 B 646 B	163ms 154ms	Script text/javascript	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRJS-04e0f5db0886b3b33ff?a=450235099&v=1184.ab39b52&to=ZFMHbUMCXktYWxJZX10ZJFpFCl9WFlkURFlQWgBmQgpeX1Vd&rst=969&ck=1&ref=https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/&ap=230&be=197&fe=888&dc=665&perf=%7B%22timing%22:%7B%22of%22:1606157783088,%22n%22:0,%22f%22:0,%22dn%22:3,%22dne%22:7,%22c%22:7,%22s%22:14,%22ce%22:23,%22rq%22:23,%22rp%22:154,%22rpe%22:182,%22dl%22:159,%22di%22:665,%22ds%22:665,%22de%22:665,%22dc%22:887,%22l%22:888,%22le%22:892%7D,%22navigation%22:%7B%7D%7D&fp=626&fcp=626&at=SBQQGwsYTRQbWUQKS05L&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1184.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d10c94b6cdb747904baee9070f003bb45849da46f8100b1320f286c21cbcaaa1 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:24 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type text/javascript;charset=ISO-8859-1 Transfer-Encoding chunked Connection keep-alive CF-Ray 5f6d1c267dc132ab-CDG cf-request-id 06980fec0b000032abeaa54000000001 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.7.0/	338 KB 72 KB	16ms 15ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1e3d87e5966b1193f8e51bec035a9de6de1c02243deb8f2b9bd280a67715112 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 39GJ8QXxSjBaTmaIgt+tLg== age 3739 vary Accept-Encoding content-length 73268 cf-request-id 06980fec1500000ea72c015000000001 x-ms-lease-status unlocked last-modified Fri, 09 Oct 2020 06:35:45 GMT server cloudflare etag 0x8D86C1D8DA49AF8 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 1bed58e2-101e-0049-4551-b6eb86000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c268c9a0ea7-FRA
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame 2139	2 KB 1 KB	37ms 19ms	XHR application/json	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5353859&v=1.632.0&if=&sl=0&si=fipm20afcji-qk9j9z&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 36d21a1fee6d42103446fd58bc7f965fdfc14b24ba1424e9ca06ddbca318408a Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:24 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 849
OPTIONS H2	200	diff at.cbsi.com/lib/api/v1/zdnet/prod/config/ Frame	0 0	159ms 112ms	Other text/html	151.101.1.188 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.cbsi.com/lib/api/v1/zdnet/prod/config/diff Protocol H2 Server 151.101.1.188 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context 8b32ec04adb7f38d5e5c8b3df3db2089 server Google Frontend accept-ranges bytes date Mon, 23 Nov 2020 18:56:24 GMT via 1.1 varnish x-served-by cache-cdg20746-CDG x-cache MISS x-cache-hits 0 x-timer S1606157784.385716,VS0,VE93 vary Accept-Encoding x-abtest none strict-transport-security max-age=300 content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/	178 KB 40 KB	95ms 32ms	Script text/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/config.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 0b2be6f25da49422c74cd67a843121306ed24185dd09b4803971e83524c50284 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:24 GMT Content-Encoding gzip Age 787 X-Cache HIT Connection keep-alive Content-Length 39962 x-amz-id-2 SdEb1AdoLZVQclufmYosSQsVXGtxNWoyD1bmHr69M4ilV/3GzQ2oAx3+B2AD4Dv5nti5L6gmWoY= X-Served-By cache-fra19129-FRA Last-Modified Mon, 23 Nov 2020 18:10:00 GMT Server AmazonS3 X-Timer S1606157784.387382,VS0,VE0 ETag "cd3f49a4595b005f938e9dca016db662" x-amz-request-id 20A4B93D815FE67D Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 39
GET H2	200	diff Show response at.cbsi.com/lib/api/v1/zdnet/prod/config/	17 KB 4 KB	25ms 19ms	Fetch application/json	151.101.1.188 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.cbsi.com/lib/api/v1/zdnet/prod/config/diff Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.188 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash e3689639e8feff607d84663ebcbcf834cdebc11ec9129345587086a28eeb88de Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json cat FaINTTd9d Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ version v2.19.2 variant core User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers x-abtest none date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip x-content-type-options nosniff age 772 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 3743 x-xss-protection 1; mode=block x-served-by cache-cdg20746-CDG access-control-allow-origin https://www.zdnet.com server Google Frontend x-timer S1606157785.503888,VS0,VE1 x-frame-options SAMEORIGIN etag W/3bfd888ba928bf90a2b6f643b16288bcbbacb75a x-download-options noopen vary Accept-Encoding, Origin strict-transport-security max-age=300 content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context 85451a2bd696951695cb3d80c8359be7 cache-control max-age=900 accept-ranges bytes access-control-allow-headers * x-cache-hits 1
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/a652efb7-f570-4ba9-a221-2753b7eb30e8/	60 KB 14 KB	14ms 14ms	Fetch application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/a652efb7-f570-4ba9-a221-2753b7eb30e8/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9ce8d3bfed7339952b7f3a4143df2e3867ab6ea6555d95d3bd44087d4f672bd1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zmR4HzWDnD/K8NKWX2k29A== age 7068 vary Accept-Encoding content-length 14179 cf-request-id 06980fed310000c2efb12b3000000001 x-ms-lease-status unlocked last-modified Thu, 29 Oct 2020 19:43:59 GMT server cloudflare etag 0x8D87C42FB4B3E93 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 49f866d8-c01e-0144-5e0a-b442df000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c284831c2ef-FRA
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	54 KB 18 KB	3163ms 280ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash b67517e58ec0d3cb2494f23f887fe90af1f8fb538740bb07ae4b9c95af3763f3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "702 / 182 of 1000 / last-modified: 1606134076" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18520 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:27 GMT
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	178ms 128ms	Script application/javascript	34.102.213.242 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.102.213.242 , United States, ASN15169 (GOOGLE, US), Reverse DNS 242.213.102.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:24 GMT via 1.1 google last-modified Mon, 13 Apr 2020 17:57:02 GMT etag "5e94a7ee-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.7.0/assets/	12 KB 4 KB	11ms 11ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.7.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 06b10167b8d0ac41c1b681a2cce2977f08c4bb49f3261d7ff2fce60b0e59f7c0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 6g5s6eICehvPXWb9nycIcQ== age 6926 vary Accept-Encoding content-length 3328 cf-request-id 06980fedbc0000c2ef8f097000000001 x-ms-lease-status unlocked last-modified Fri, 09 Oct 2020 06:35:38 GMT server cloudflare etag 0x8D86C1D890DBAF3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 6f0ee0a3-601e-0046-6d17-b30670000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c2929c9c2ef-FRA
GET H2	200	otPcPanel.json Show response cdn.cookielaw.org/scripttemplates/6.7.0/assets/v2/	45 KB 11 KB	15ms 15ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.7.0/assets/v2/otPcPanel.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c269c820bb1f57a535cbc2b61ddbd902ef33364e5fd1f827ecaccbd1831c1d42 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 VdPW9mUL+ZgJ7oO59gDKyw== age 2507 vary Accept-Encoding content-length 11094 cf-request-id 06980fedbe0000c2efa7be7000000001 x-ms-lease-status unlocked last-modified Fri, 09 Oct 2020 06:35:40 GMT server cloudflare etag 0x8D86C1D8A75F320 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 743ef2b2-401e-0037-71d4-b47449000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 5f6d1c2929cfc2ef-FRA
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gpt/202011171659/	164 KB 53 KB	33ms 32ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 565987a1d366f4f97f9fc987a96d6ef3db20bed171589a03968bded4bd38a41a Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:24 GMT Content-Encoding gzip Age 435 X-Cache HIT Connection keep-alive Content-Length 53538 x-amz-id-2 f+VFIpbT0vyzLAsCl6Cq3TudJvb78FwA/+AmxZDp+6KnMPlPQJiIplJ8bRkB/z30vf6bQwOSi8Q= X-Served-By cache-fra19129-FRA Last-Modified Wed, 18 Nov 2020 17:03:05 GMT Server AmazonS3 X-Timer S1606157785.546883,VS0,VE0 ETag "53928e26336f384df2d32f911e88a0da" x-amz-request-id 14CE28B8D447706F Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 379
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/prebid/202011171659/	68 KB 23 KB	77ms 28ms	Script application/javascript	151.101.13.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/prebid/202011171659/wrap.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/6NAGEHPQTIMciZyoLrUIDQZlmus/gpt_and_prebid/config.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 487c0c467355b47e27c90679fdb5d43d7b90d6ae36b7b95ec0e31f5c3a17f950 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:24 GMT Content-Encoding gzip Age 430 X-Cache HIT Connection keep-alive Content-Length 23314 x-amz-id-2 kKNjpnK2y+bf67VbDe5WkUehSPTe46kzKi6wOpUQPTckgA9u0x/h0vDoENpoSowPwxI39FQZZMs= X-Served-By cache-fra19129-FRA Last-Modified Wed, 18 Nov 2020 17:03:07 GMT Server AmazonS3 X-Timer S1606157785.594992,VS0,VE0 ETag "4d29cae717c1d46d24406f839d5c5fea" x-amz-request-id 768D31CBEF61C7AC Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 391
GET H2	200	mpulse-1.0.2.js Show response zdnet1.cbsistatic.com/fly/js/libs/	61 KB 12 KB	7ms 7ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip x-content-type-options nosniff age 292606 vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:31 GMT server ContentServer x-frame-options SAMEORIGIN etag "466cc1a6673c4cdbd42589de01cfe450" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 27 Nov 2020 09:39:38 GMT
GET H2	200	moatheader.js Show response z.moatads.com/cbsprebidheader506831276743/	227 KB 78 KB	102ms 34ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 602fab312dd82ffb14508d0e186e809e1e27c55a6e62adf5769a9318dc84ce2f Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:24 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:33:52 GMT server AmazonS3 x-amz-request-id A116A0BCFEB1ED44 etag "6854e8f5c7ee7172d6d2fe20d9d27f10" vary Accept-Encoding content-type application/x-javascript cache-control max-age=39118 accept-ranges bytes content-length 79827 x-amz-id-2 LrxYof5YTsukS1I7ly5TdwlPH99cfVt8CYvHzVznL7pj2PV98+XZEE53Pk1mD0xi4vrfs+IGyw4=
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	95 KB 29 KB	44ms 7ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.7.0/otBannerSdk.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40FD) / Resource Hash 2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:25 GMT Content-Encoding gzip Vary Accept-Encoding Age 790 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Content-Length 28698 x-tw-cdn VZ Last-Modified Thu, 01 Oct 2020 21:52:09 GMT Server ECS (fcn/40FD) Etag "a671d4d584ef50954e5cebb21da17065+gzip" Access-Control-Max-Age 3000 Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control public, max-age=1800
GET H2	200	;ord=1606157785008 ad.doubleclick.net/ddm/ad/gopbk/vzdolr/tsxdxanl/	43 B 213 B	309ms 308ms	Image image/gif	216.58.210.6 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/ad/gopbk/vzdolr/tsxdxanl/;ord=1606157785008? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f6.1e100.net Software cafe / Resource Hash 9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:25 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 43 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	17ms 15ms	XHR application/json	2a02:26f0:6c00:192::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1606157785359&s=cd672b2ee9713f2d14fc515864c87f08a0b36d492ff57433addd72ca62b40bf0 Requested by Host: zdnet1.cbsistatic.com URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:192::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 5f3ffdc7890d469816b442686d7fca0d116602cf46a4f73b8b6055464972178a Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:25 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 856
GET H/1.1	204 No Content	/ Show response 685d5b19.akstat.io/	0 354 B	42ms 22ms	XHR image/gif	2a02:26f0:6c00:291::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://685d5b19.akstat.io/?h.pg=article&when=1606157785444&cdim.Site_View=desktop&t_other=custom4%7C183&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=6ccd443d28824f0b2dc56b519801286f7c7cc441&h.t=1606157785372&http.initiator=api&rt.start=api&rt.si=736221d6-7716-4cbd-8892-c0681d4a79aa&rt.ss=1606157787629&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: zdnet1.cbsistatic.com URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:291::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:25 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 23 Nov 2020 18:56:25 GMT
GET H/1.1	200 OK	widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html platform.twitter.com/widgets/ Frame 1FC9	0 0	17ms 11ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fwww.zdnet.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40D7) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 205911 Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Mon, 23 Nov 2020 18:56:25 GMT Etag "9fa476ae827f556d5b037fe43632370d+gzip" Last-Modified Thu, 01 Oct 2020 21:50:01 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40D7) Vary Accept-Encoding X-Cache HIT x-tw-cdn VZ Content-Length 5825
GET H2	200	v2 Show response mb.moatads.com/yi/	293 B 468 B	150ms 43ms	Script text/html	99.80.114.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&callback=MoatNadoAllJsonpRequest_35511327 Requested by Host: z.moatads.com URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.114.7 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-114-7.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 63998cd44cc938f5e6ff1724dbc646774881c92bf9ad27e9ceba4a8357597441 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:25 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "b96374c900b6a57924486db88c195da8c248e7a5" content-length 293 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	126 B 301 B	156ms 45ms	Script text/html	99.80.114.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBS_PREBID_HEADER1&hp=1&wf=1&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1606157785741&de=374150659004&rx=76501015798&m=0&ar=a63e245-clean&iw=b2c8261&q=1&cb=0&cu=1606157785741&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=undefined&bd=undefined&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A627%3A627%3A892%3A665&fs=186589&na=2062819014&cs=0&callback=DOMlessLLDcallback_35511327 Requested by Host: z.moatads.com URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.114.7 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-114-7.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 5a82b0f6f818bb5d16c4efebf2cd824f7beb7eb5a2355cfa139302e7974c9021 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "865d6afe1eb844a269e66c3ce3c95ff758ef29f4" content-length 126 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	128 B 302 B	155ms 46ms	Script text/html	99.80.114.7 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&i=CBS_PREBID_HEADER1&hp=1&wf=1&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1606157785741&de=374150659004&rx=76501015798&m=0&ar=a63e245-clean&iw=b2c8261&q=2&cb=0&cu=1606157785741&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=undefined&bd=undefined&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A627%3A627%3A892%3A665&fs=186589&na=1541244313&cs=0&callback=MoatDataJsonpRequest_35511327 Requested by Host: z.moatads.com URL: https://z.moatads.com/cbsprebidheader506831276743/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.114.7 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-80-114-7.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 2d7a238e6ff939f120bda74bc47d7e64bbe3fc4eb6a688b79c8a91ee792cdc40 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "754e7b598b2d194b2c4c00fc30d7cf84947a200f" content-length 128 content-type text/html; charset=UTF-8
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	36ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&t=1606157785741&de=10132488593&d=CBS_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=a63e245-clean&iw=b2c8261&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=zdnet.com&bd=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&ac=1&bq=11&f=0&na=87467100&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:25 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:25 GMT
GET H2	200	article-ea6d078f02-rev.js Show response zdnet4.cbsistatic.com/fly/js/pages/	145 KB 38 KB	13ms 6ms	Script application/javascript	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet4.cbsistatic.com/fly/js/pages/article-ea6d078f02-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash e6e583553cbb5a7bdf3446558cdf29802cda247ce1d63693633b3d74eb749d8e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 519711 vary Accept-Encoding, Accept content-length 39119 x-xss-protection 1; mode=block last-modified Mon, 16 Nov 2020 17:08:33 GMT server ContentServer x-frame-options SAMEORIGIN etag "25a4da7bfdd253db9556ff2c6030da84" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 24 Nov 2020 18:34:34 GMT
GET H/1.1	200 OK	horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js Show response platform.twitter.com/js/	6 KB 3 KB	9ms 6ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/js/horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/4188) / Resource Hash b8e8fe9b8ca280dc3c982691064e62ba97c8f2c192a17dfe74430c7cf73cb4de Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:26 GMT Content-Encoding gzip Last-Modified Thu, 01 Oct 2020 21:49:51 GMT Server ECS (fcn/4188) Age 421696 Etag "15d6bf68a8d65b293e52ddc833724ed4+gzip" Vary Accept-Encoding x-tw-cdn VZ P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=315360000 X-Cache HIT Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Content-Length 2195
GET H/1.1	200 OK	results.txt Show response kjtbe4qccc5esx54axna-pwk35p-fa4ae76e3-clientnsv4-s.akamaihd.net/eum/ Frame 2139 Redirect Chain https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pwk35pvi3 https://kjtbe4qccc5esx54axna-pwk35p-fa4ae76e3-clientnsv4-s.akamaihd.net/eum/results.txt	8 B 312 B	136ms 26ms	XHR text/plain	23.55.110.17 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://kjtbe4qccc5esx54axna-pwk35p-fa4ae76e3-clientnsv4-s.akamaihd.net/eum/results.txt Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 23.55.110.17 , United States, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-55-110-17.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:26 GMT Last-Modified Wed, 08 May 2013 07:51:12 GMT Server AkamaiNetStorage ETag "402e7a087747cb56c718bde84651f96a:1367999472" Content-Type text/plain Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 8 Redirect headers Location https://kjtbe4qccc5esx54axna-pwk35p-fa4ae76e3-clientnsv4-s.akamaihd.net/eum/results.txt Date Mon, 23 Nov 2020 18:56:26 GMT Server AkamaiGHost Connection keep-alive Access-Control-Allow-Origin * Content-Length 0
GET H/1.1	200 OK	results.txt Show response fiaqj6absjkbikqce3ygyaaaabp3ybo2-pwk35p-3e442bcc8-clienttons-s.akamaihd.net/eum/ Frame 2139 Redirect Chain https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pwk35pvi3 https://fiaqj6absjkbikqce3ygyaaaabp3ybo2-pwk35p-3e442bcc8-clienttons-s.akamaihd.net/eum/results.txt	8 B 312 B	79ms 6ms	XHR text/plain	2a02:26f0:6c00::210:ba19 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://fiaqj6absjkbikqce3ygyaaaabp3ybo2-pwk35p-3e442bcc8-clienttons-s.akamaihd.net/eum/results.txt Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2a02:26f0:6c00::210:ba19 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AkamaiNetStorage / Resource Hash 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:26 GMT Last-Modified Wed, 08 May 2013 07:51:12 GMT Server AkamaiNetStorage ETag "402e7a087747cb56c718bde84651f96a:1367999472" Content-Type text/plain Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 8 Redirect headers Location https://fiaqj6absjkbikqce3ygyaaaabp3ybo2-pwk35p-3e442bcc8-clienttons-s.akamaihd.net/eum/results.txt Date Mon, 23 Nov 2020 18:56:26 GMT Server AkamaiGHost Connection keep-alive Access-Control-Allow-Origin * Content-Length 0
GET H/1.1	200 OK	index.html platform.twitter.com/embed/ Frame 8978	0 0	14ms 13ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/index.html?creatorScreenName=ZDNet&dnt=false&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1327309590736883712&lang=en&origin=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&siteScreenName=ZDNet&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=550px Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40FD) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 818 Cache-Control public, max-age=1800 Content-Type text/html; charset=utf-8 Date Mon, 23 Nov 2020 18:56:26 GMT Etag "18c1cbad7a89225239c4963d441ca471" Last-Modified Wed, 18 Nov 2020 21:46:10 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40FD) X-Cache HIT x-tw-cdn VZ Content-Length 577
GET H/1.1	200 OK	index.html platform.twitter.com/embed/ Frame 957B	0 0	19ms 8ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/index.html?creatorScreenName=ZDNet&dnt=false&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1270245608452788224&lang=en&origin=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&siteScreenName=ZDNet&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=550px Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40FD) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 818 Cache-Control public, max-age=1800 Content-Type text/html; charset=utf-8 Date Mon, 23 Nov 2020 18:56:26 GMT Etag "18c1cbad7a89225239c4963d441ca471" Last-Modified Wed, 18 Nov 2020 21:46:10 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40FD) X-Cache HIT x-tw-cdn VZ Content-Length 577
GET H2	200	CBSI-PLAYER.js Show response vidtech.cbsinteractive.com/uvpjs/0.42.297/	1 MB 281 KB	50ms 18ms	Script application/javascript	2a04:4e42:1b::645 FASTLY
General Check archive.org Show headers Download Go to Full URL https://vidtech.cbsinteractive.com/uvpjs/0.42.297/CBSI-PLAYER.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::645 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 1df152c5f79010dd701eceeabbf5fae49f8b375b625f2a5d7f8a8fbe11b92f2b Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT via 1.1 varnish, 1.1 varnish age 2804430 x-cache HIT, HIT content-encoding gzip content-length 286838 x-amz-id-2 n53ElNB5hVnkR9qh4cUlg2SOjOhm/ieDwTiWMKEbKvjjvzF40ZAJ27jUeh6G5dcSTKOWVVqV9Rw= x-served-by cache-dca17777-DCA, cache-hhn4074-HHN last-modified Fri, 01 Feb 2019 18:20:56 GMT server AmazonS3 x-timer S1606157786.239406,VS0,VE1 etag "eb5dd4ed3dcb7641ebbcb604d7ddb038" vary Accept-Encoding x-amz-request-id 798034E8713D8B8D cache-control public, max-age=2592000 accept-ranges bytes content-type application/javascript x-cache-hits 1, 1
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 637 B	156ms 156ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3a4a0cd9fba1b85eaa8fc1222f0965fd563dd5631a07ab1c2dff170f1d0bc6e8 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 23 Nov 2020 18:56:26 GMT x-frame-options SAMEORIGIN date Mon, 23 Nov 2020 18:56:26 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" vary Accept-Encoding, User-Agent x-tx-id 95b0461b-37bc-4b08-8e3d-fa46ef78d30c content-type application/json cache-control max-age=5400, private accept-ranges bytes expires Mon, 23 Nov 2020 20:26:26 GMT
GET H2	200	r-emotet.png zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/	12 KB 12 KB	7ms 6ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/r-emotet.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash fd5f254160734cb504a726cc3fd8b534191a507bfc62d1ea5b8e399abd2f0c24 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306674 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 11921 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:27:37 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"ad7329ed69a1cd18d06ba2e1fc73532e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 11921 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-trickbot.png zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/	6 KB 7 KB	10ms 8ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/r-trickbot.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0852a03789c2c216174ddae0a69503ff7f97fdf7d0675977ed4fd5f38473178e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306675 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6410 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:35:41 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1984faad0c4fabe5ffd0f5973c29bfd3" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6410 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-bazar.png zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/	7 KB 7 KB	9ms 7ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/r-bazar.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 282464f343a1ed2c3e0b4a5a6e0e4bc752c5a720f98bd8211c918450f028adb4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306607 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7082 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:40:48 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"4f79134d3332607173f5665af3387d8d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7082 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-qbot.png zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/	16 KB 17 KB	12ms 11ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/r-qbot.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6066b15b5a8a1ec97658e0bb7a8485fef03d833c3d3c813843ffb912ee960794 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306638 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 16783 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:46:23 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"090c34f18ab19c990a2b3815d3b9696e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 16783 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 02:25:18 GMT
GET H2	200	r-sdbbot.png zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/	6 KB 6 KB	7ms 6ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/r-sdbbot.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 04d8bd36ba34b7709873296c02eb9cc09cb1709a168fbde7c6f3d28cae4cce29 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306639 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6490 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:56:50 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"882f7af6a82b1cd0a0bb02d1ac73267d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6490 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-dridex.png zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/	6 KB 6 KB	13ms 11ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/r-dridex.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 61f390f09e05236631b453b30c48c58a630c1bc8501e397edfd80de4b19e66f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306639 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 5894 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:57:02 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1de527d7269606586163e568cdf3889b" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 5894 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-zloader.png zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/	6 KB 6 KB	10ms 9ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/r-zloader.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f65b40035a6fb820501c15c8cdff5fc437ea0f4c71125ba572de42a6324cc1f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306639 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6049 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:02:00 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"dab2d159d7b0fbeca3dd6fd0ef81f5b1" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6049 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-buer.png zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/	7 KB 7 KB	11ms 9ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/r-buer.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 62772634c444620fcdde31d967001780e18886ba684bcfca3599bdfc0ae2023a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306607 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7064 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:06:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"de1fe633c9754255355dcdeb074a2b74" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7064 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-phorpiex.png zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/	8 KB 8 KB	22ms 8ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/r-phorpiex.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f1b6769841d8855161c81c4b3df805698216e85781bfa9ea49147d1c1766b536 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306670 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7877 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:14:46 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"7b03f982f98d4143ed74275886af31b7" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7877 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-cobalt.png zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/	7 KB 7 KB	22ms 9ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/r-cobalt.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b7c2702e4b5c5f4e157a08a5209cad35606e424c8492ca5340b4426bf9ff45e4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306670 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7492 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:16:58 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"d0877cdf7d6a876fdb0293fb95411756" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7492 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	image-gallery-modal-426b98fe1d-rev.js Show response zdnet1.cbsistatic.com/fly/js/components/	5 KB 2 KB	16ms 8ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-426b98fe1d-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 744ae87db00be85a6a482a3e8036f81aafaa7754be29b05a2330d0fbc8fea803 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 345148 vary Accept-Encoding, Accept content-length 1860 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:37 GMT server ContentServer x-frame-options SAMEORIGIN etag "d52e85ba65e246e80154e01e5159303a" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 19:03:57 GMT
GET H2	200	anthem-hacker.jpg zdnet3.cbsistatic.com/hub/i/r/2019/05/29/48679984-c00c-4d32-87b9-4963628f9813/thumbnail/170x128/f09153854c6474331f0a55b83f1abd32/	4 KB 4 KB	13ms 5ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2019/05/29/48679984-c00c-4d32-87b9-4963628f9813/thumbnail/170x128/f09153854c6474331f0a55b83f1abd32/anthem-hacker.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 639c05b819b690aa73793fe651ef9b97e2130dd8e6ecb314fbd0d3f4143b1dad Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 1204864 vary Accept-Encoding, Accept content-length 4127 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"3caf5467bcfec002279f8326d433e3a9" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:23 GMT
GET H2	200	apt41.png zdnet4.cbsistatic.com/hub/i/r/2020/09/16/e6206a11-5b28-4028-88cc-d11e56ea37c2/thumbnail/170x128/31d2f891ad3b5e9031950156b16d0265/	20 KB 20 KB	28ms 21ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2020/09/16/e6206a11-5b28-4028-88cc-d11e56ea37c2/thumbnail/170x128/31d2f891ad3b5e9031950156b16d0265/apt41.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash beb37102acb27e46ccf21505537172f0636fac464a0b13107aa6a049e169f897 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 1204883 vary Accept-Encoding, Accept content-length 20659 x-xss-protection 1; mode=block last-modified Wed, 16 Sep 2020 16:39:45 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"8f192c0643162c7a4047796a9d6ce492" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:04 GMT
GET H2	200	sae.jpg zdnet3.cbsistatic.com/hub/i/r/2019/05/28/119595aa-09b6-4aa3-80f8-a29d823ec9d3/thumbnail/170x128/c3b8c7f157484ec06dfdacd038bc3a3e/	5 KB 5 KB	26ms 19ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2019/05/28/119595aa-09b6-4aa3-80f8-a29d823ec9d3/thumbnail/170x128/c3b8c7f157484ec06dfdacd038bc3a3e/sae.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 19ed1f41f7e045dafd78caec8848b6c14bf348121b0861ffe30bdae24774ba27 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff age 1038400 vary Accept-Encoding, Accept content-length 4680 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"19a223efb8cb70ab2a3763a68ec0c034" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sun, 10 Jan 2021 18:29:46 GMT
GET H2	200	lazarus-group-member.jpg zdnet1.cbsistatic.com/hub/i/r/2019/05/29/0470890a-3f2d-4291-bf6f-168fa50d6537/thumbnail/170x128/75bbbeebb309f148e251ea16f2ff22e7/	4 KB 4 KB	13ms 6ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/r/2019/05/29/0470890a-3f2d-4291-bf6f-168fa50d6537/thumbnail/170x128/75bbbeebb309f148e251ea16f2ff22e7/lazarus-group-member.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b812ea0519c2fd65624b96ae5f3704ded0ac78eacd1bb4ec9b551a9d6fc77f1c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff age 1039439 vary Accept-Encoding, Accept content-length 4228 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"27963ab30220bdc399383d654dc9a002" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sun, 10 Jan 2021 18:11:22 GMT
GET H2	200	zeus.jpg zdnet3.cbsistatic.com/hub/i/r/2019/05/28/238b3585-22ff-4ba9-8c90-bb5d864a1f00/thumbnail/170x128/6de0fc8e9b5d999206db3b7ff0cac1ae/	4 KB 4 KB	26ms 19ms	Image image/jpeg	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/r/2019/05/28/238b3585-22ff-4ba9-8c90-bb5d864a1f00/thumbnail/170x128/6de0fc8e9b5d999206db3b7ff0cac1ae/zeus.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2139e564507235ce0fb33edd4796536bcec35161a8186ff82cc386d1413cfdb7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 1204840 vary Accept-Encoding, Accept content-length 4462 x-xss-protection 1; mode=block last-modified Fri, 21 Aug 2020 16:50:43 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"939cadc3eaf300ddebe96f6553f0e45a" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 08 Jan 2021 20:15:23 GMT
GET H2	200	disqus-loader-e3cab293df-rev.js Show response zdnet3.cbsistatic.com/fly/js/components/	1 KB 989 B	29ms 9ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-e3cab293df-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2b1068aa007abf0e405b0840844c67718204a0073dc392337d78427a0dba6854 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 544329 vary Accept-Encoding, Accept content-length 667 x-xss-protection 1; mode=block last-modified Mon, 16 Nov 2020 17:08:32 GMT server ContentServer x-frame-options SAMEORIGIN etag "eac3a26f962835dccb7790960dc0a8fb" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 24 Nov 2020 11:44:16 GMT
GET H2	200	tesla-model-x.png zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/	30 KB 30 KB	9ms 8ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/tesla-model-x.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bad84eb6e0f8f9254ac62ec0ab6dd294a89b0ae7d0b1b991478fab0b2794a710 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff age 4739 vary Accept-Encoding, Accept content-length 30577 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 17:37:27 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"b567f7d01bcac9f5853552a06820379d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 22 Jan 2021 17:37:28 GMT
GET H2	200	wordpress.png zdnet2.cbsistatic.com/hub/i/r/2020/02/19/01b9fa6b-7ebe-4a2a-b07b-782dc3099457/thumbnail/170x128/ae1584c170d221fc0ee8ec04ffb98dc6/	34 KB 34 KB	8ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/r/2020/02/19/01b9fa6b-7ebe-4a2a-b07b-782dc3099457/thumbnail/170x128/ae1584c170d221fc0ee8ec04ffb98dc6/wordpress.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 56825f87974920966489cf3a7e1352bb4a654bc8e2b20e281bbc7922a59fc0ee Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff age 13544 vary Accept-Encoding, Accept content-length 34544 x-xss-protection 1; mode=block last-modified Fri, 04 Sep 2020 15:01:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"50f8c0fb0b89103dedac038a18bd8cbe" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 22 Jan 2021 15:10:33 GMT
GET H2	200	20120314-google-chrome-lapel-pin-4sts-011.jpg zdnet4.cbsistatic.com/hub/i/r/2019/12/10/f5f6e56d-93cd-4542-a6b9-f1caf732ad8e/thumbnail/170x128/c1f4a11dbab9df6fa097dcfc2b0f8220/	8 KB 8 KB	9ms 8ms	Image image/jpeg	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2019/12/10/f5f6e56d-93cd-4542-a6b9-f1caf732ad8e/thumbnail/170x128/c1f4a11dbab9df6fa097dcfc2b0f8220/20120314-google-chrome-lapel-pin-4sts-011.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ac357eec1b219695bc2451c0ce5647eee0af960beee698f90b06de1d8246945c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff age 109216 vary Accept-Encoding, Accept content-length 7701 x-xss-protection 1; mode=block last-modified Thu, 03 Sep 2020 06:41:54 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"0482777da787a4d0b86266536af063be" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 21 Jan 2021 12:36:10 GMT
GET H2	200	manchesterunited.jpg zdnet2.cbsistatic.com/hub/i/r/2020/11/21/dcf85201-634d-4d43-9314-af45bc9b98aa/thumbnail/170x128/b97b4a84a513e973167486bb1e657c2f/	9 KB 9 KB	10ms 9ms	Image image/jpeg	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/r/2020/11/21/dcf85201-634d-4d43-9314-af45bc9b98aa/thumbnail/170x128/b97b4a84a513e973167486bb1e657c2f/manchesterunited.jpg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2a2e21ebff85f5dd9baa3466c6c15c966d40b61aeee43c24198d44e58ec358bc Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff age 167451 vary Accept-Encoding, Accept content-length 9136 x-xss-protection 1; mode=block last-modified Sat, 21 Nov 2020 20:25:35 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"e2434976a8942bb377c2296a590c06b8" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 20 Jan 2021 20:25:35 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 887 B	173ms 173ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 6f9ad836de490137136436af6cfcbf905778ccdb3446f9ef142df017d6937b52 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip referrer-policy no-referrer-when-downgrade date Mon, 23 Nov 2020 18:56:26 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" x-frame-options SAMEORIGIN x-tx-id 4c104648-764c-485d-93e9-1c3b4c2cbc02 content-type application/json cache-control no-cache x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block
POST H2	200	/ Show response www.zdnet.com/m3d0s1/xhr/right-rail/	12 KB 2 KB	200ms 199ms	XHR application/json	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/m3d0s1/xhr/right-rail/ Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 48447a2f84910fcbd68bf4a3a9a2059588e0327b7d3601c5d2e2305bc0f0c205 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip referrer-policy no-referrer-when-downgrade date Mon, 23 Nov 2020 18:56:26 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" x-frame-options SAMEORIGIN x-tx-id 506b90df-e195-491a-b4d8-273c3260734d content-type application/json cache-control no-cache x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block
GET H2	200	front-door-carousel-d989216481-rev.js Show response zdnet1.cbsistatic.com/fly/js/components/	5 KB 2 KB	7ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-d989216481-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0aa48808ddef7604ba969db62e4af3a2ba001b7a8751823cf0ab2d430308ea5 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 345311 vary Accept-Encoding, Accept content-length 1542 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:37 GMT server ContentServer x-frame-options SAMEORIGIN etag "15b374003241d75f16514aad8cfd3520" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 19:01:15 GMT
GET H2	200	urban-airship-0350b998c8-rev.js Show response zdnet3.cbsistatic.com/fly/js/components/	2 KB 1 KB	8ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-0350b998c8-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a11031f99966230867eebb1167b3855ed90e2b4d4bb562601d7e6f4d816ec118 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 381180 vary Accept-Encoding, Accept content-length 1139 x-xss-protection 1; mode=block last-modified Wed, 18 Nov 2020 16:48:10 GMT server ContentServer x-frame-options SAMEORIGIN etag "ecbf8f7744e83bf9d1cc909276e8d013" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 09:03:26 GMT
POST H/1.1	204 No Content	/ 685d5b19.akstat.io/	0 354 B	39ms 21ms	Other image/gif	2a02:26f0:6c00:291::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://685d5b19.akstat.io/ Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:291::11a6 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:26 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 23 Nov 2020 18:56:26 GMT
GET H2	200	advertisement-9a7c0c51b1-rev.js Show response zdnet2.cbsistatic.com/fly/js/utils/	0 193 B	9ms 8ms	Script application/javascript	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-9a7c0c51b1-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT content-encoding gzip x-content-type-options nosniff age 210915 vary Accept-Encoding, Accept content-length 32 x-xss-protection 1; mode=block last-modified Thu, 19 Nov 2020 18:10:38 GMT server ContentServer x-frame-options SAMEORIGIN etag "b5d40c40856e0c071b192d6cea7ea934" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Sat, 28 Nov 2020 08:21:10 GMT
GET H2	200	loader.js Show response cdn.taboola.com/libtrc/cbsinteractive-zdnet/	115 KB 22 KB	157ms 38ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software obaker.90.1.2-10.498 / Resource Hash c756e5a479faa069fd72f90b99148c210b604f077f735f75f25c2308fc6620dc Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id yIxM8xLu03hPS43YAZc7ysCtAUyiLLLk content-encoding gzip etag "d175fa3eaacc76de509c6bb056b9c388cec0a3b0" age 0 via 1.1 varnish x-cache MISS x-from-cache 1 content-length 22227 x-amz-id-2 IxcgrTFhhmRz7aphTusiPbPS7F74zDQxcCto+mniR2n81EgW8L85Q1QF7zw215CqhicBAScHMs0= x-served-by cache-fra19142-FRA last-modified Mon, 23 Nov 2020 18:56:26 UTC server obaker.90.1.2-10.498 x-timer S1606157787.918130,VS0,VE15 date Mon, 23 Nov 2020 18:56:26 GMT vary Accept-Encoding, Accept-Encoding x-amz-request-id 42418B5B8139F1B1 access-control-allow-origin * cache-control private,max-age=14400 accept-ranges bytes content-type application/javascript; charset=utf-8 abp 13 x-cache-hits 0
GET H2	200	r-emotet.png zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/	12 KB 12 KB	8ms 7ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/3cc3f4ca-b496-4207-9f10-0a80e649ce0d/r-emotet.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash fd5f254160734cb504a726cc3fd8b534191a507bfc62d1ea5b8e399abd2f0c24 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306675 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 11921 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:27:37 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"ad7329ed69a1cd18d06ba2e1fc73532e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 11921 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-sdbbot.png zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/	6 KB 7 KB	7ms 6ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/c997580d-1a8f-4b66-a5e0-57705be7527f/r-sdbbot.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 04d8bd36ba34b7709873296c02eb9cc09cb1709a168fbde7c6f3d28cae4cce29 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306640 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6490 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:56:50 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"882f7af6a82b1cd0a0bb02d1ac73267d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6490 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-bazar.png zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/	7 KB 7 KB	9ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/71f81cca-756f-4ac3-a54b-be2f2d223130/r-bazar.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 282464f343a1ed2c3e0b4a5a6e0e4bc752c5a720f98bd8211c918450f028adb4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306608 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7082 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:40:48 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"4f79134d3332607173f5665af3387d8d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7082 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-trickbot.png zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/	6 KB 6 KB	8ms 7ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/1b8341cf-dadb-40c8-b2ba-66f53a6caee1/r-trickbot.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0852a03789c2c216174ddae0a69503ff7f97fdf7d0675977ed4fd5f38473178e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306676 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6410 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:35:41 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1984faad0c4fabe5ffd0f5973c29bfd3" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6410 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-zloader.png zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/	6 KB 6 KB	8ms 7ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/814d41d2-52f0-40bc-a452-e170c20725f1/r-zloader.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f65b40035a6fb820501c15c8cdff5fc437ea0f4c71125ba572de42a6324cc1f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306640 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 6049 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:02:00 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"dab2d159d7b0fbeca3dd6fd0ef81f5b1" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 6049 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-buer.png zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/	7 KB 7 KB	12ms 9ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/2020/11/20/1bd4f30c-864c-486b-a6b1-2e64b61ae307/r-buer.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 62772634c444620fcdde31d967001780e18886ba684bcfca3599bdfc0ae2023a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306608 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7064 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:06:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"de1fe633c9754255355dcdeb074a2b74" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7064 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-qbot.png zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/	16 KB 17 KB	8ms 7ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/0cdf641b-5900-4a5b-ad29-212a0f41ee2e/r-qbot.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6066b15b5a8a1ec97658e0bb7a8485fef03d833c3d3c813843ffb912ee960794 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306639 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 16783 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:46:23 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"090c34f18ab19c990a2b3815d3b9696e" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 16783 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 02:25:18 GMT
GET H2	200	r-dridex.png zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/	6 KB 6 KB	8ms 7ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet3.cbsistatic.com/hub/i/2020/11/20/edefaceb-85cb-4f3b-a820-18d8dac7d787/r-dridex.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 61f390f09e05236631b453b30c48c58a630c1bc8501e397edfd80de4b19e66f9 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306640 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 5894 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 01:57:02 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"1de527d7269606586163e568cdf3889b" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 5894 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-phorpiex.png zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/	8 KB 8 KB	14ms 2ms	Image image/png	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet1.cbsistatic.com/hub/i/2020/11/20/8c8942a5-df7f-4e72-81d9-e37e98e3dc83/r-phorpiex.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f1b6769841d8855161c81c4b3df805698216e85781bfa9ea49147d1c1766b536 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306671 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7877 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:14:46 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"7b03f982f98d4143ed74275886af31b7" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7877 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	r-cobalt.png zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/	7 KB 8 KB	19ms 10ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/2020/11/20/583205c5-7a98-466b-be41-102020c73f8d/r-cobalt.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b7c2702e4b5c5f4e157a08a5209cad35606e424c8492ca5340b4426bf9ff45e4 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff x-goog-meta-imagewidth 770 age 306671 x-goog-meta-imageheight 100 x-goog-meta-imageformat png vary Accept-Encoding, Accept content-length 7492 x-xss-protection 1; mode=block last-modified Fri, 20 Nov 2020 02:16:58 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"d0877cdf7d6a876fdb0293fb95411756" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 x-goog-meta-contentlength 7492 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 19 Jan 2021 05:45:47 GMT
GET H2	200	wordpress.png zdnet2.cbsistatic.com/hub/i/r/2020/02/19/01b9fa6b-7ebe-4a2a-b07b-782dc3099457/thumbnail/170x128/ae1584c170d221fc0ee8ec04ffb98dc6/	34 KB 34 KB	9ms 9ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/r/2020/02/19/01b9fa6b-7ebe-4a2a-b07b-782dc3099457/thumbnail/170x128/ae1584c170d221fc0ee8ec04ffb98dc6/wordpress.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 56825f87974920966489cf3a7e1352bb4a654bc8e2b20e281bbc7922a59fc0ee Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff age 13545 vary Accept-Encoding, Accept content-length 34544 x-xss-protection 1; mode=block last-modified Fri, 04 Sep 2020 15:01:51 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"50f8c0fb0b89103dedac038a18bd8cbe" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 22 Jan 2021 15:10:33 GMT
GET H2	200	20120314-google-chrome-lapel-pin-4sts-011.jpg zdnet4.cbsistatic.com/hub/i/r/2019/12/10/f5f6e56d-93cd-4542-a6b9-f1caf732ad8e/thumbnail/170x128/c1f4a11dbab9df6fa097dcfc2b0f8220/	8 KB 8 KB	13ms 6ms	Image image/jpeg	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2019/12/10/f5f6e56d-93cd-4542-a6b9-f1caf732ad8e/thumbnail/170x128/c1f4a11dbab9df6fa097dcfc2b0f8220/20120314-google-chrome-lapel-pin-4sts-011.jpg Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ac357eec1b219695bc2451c0ce5647eee0af960beee698f90b06de1d8246945c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff age 109217 vary Accept-Encoding, Accept content-length 7701 x-xss-protection 1; mode=block last-modified Thu, 03 Sep 2020 06:41:54 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"0482777da787a4d0b86266536af063be" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 21 Jan 2021 12:36:10 GMT
GET H2	200	tesla-model-x.png zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/	30 KB 30 KB	6ms 6ms	Image image/png	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet4.cbsistatic.com/hub/i/r/2020/11/23/8f00ebf8-09f0-4458-810a-9ebbff9e690b/thumbnail/170x128/1b24a61c7410c909e913913e59225889/tesla-model-x.png Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bad84eb6e0f8f9254ac62ec0ab6dd294a89b0ae7d0b1b991478fab0b2794a710 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff age 4740 vary Accept-Encoding, Accept content-length 30577 x-xss-protection 1; mode=block last-modified Mon, 23 Nov 2020 17:37:27 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"b567f7d01bcac9f5853552a06820379d" strict-transport-security max-age=31536000 content-type image/png access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Fri, 22 Jan 2021 17:37:28 GMT
GET H2	200	manchesterunited.jpg zdnet2.cbsistatic.com/hub/i/r/2020/11/21/dcf85201-634d-4d43-9314-af45bc9b98aa/thumbnail/170x128/b97b4a84a513e973167486bb1e657c2f/	9 KB 9 KB	11ms 10ms	Image image/jpeg	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://zdnet2.cbsistatic.com/hub/i/r/2020/11/21/dcf85201-634d-4d43-9314-af45bc9b98aa/thumbnail/170x128/b97b4a84a513e973167486bb1e657c2f/manchesterunited.jpg Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/e8033f-fly/js/main.default.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2a2e21ebff85f5dd9baa3466c6c15c966d40b61aeee43c24198d44e58ec358bc Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-content-type-options nosniff age 167452 vary Accept-Encoding, Accept content-length 9136 x-xss-protection 1; mode=block last-modified Sat, 21 Nov 2020 20:25:35 GMT server ContentServer x-frame-options SAMEORIGIN etag W/"e2434976a8942bb377c2296a590c06b8" strict-transport-security max-age=31536000 content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 20 Jan 2021 20:25:35 GMT
GET H2	200	0.32040121708797353 saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/	43 B 422 B	117ms 28ms	Image image/gif	15.237.136.106 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.32040121708797353?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=the+malware+that+usually+installs+ransomware+and+you+need+to+remove+right+away&v22=content_article&v23=&v24=8b15401f-988e-4324-98b9-2cc9d6b77118&v30=11810b01-3924-4277-9d2c-5fe945d43f07&v60=33164070,33164073,33164072&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=202011232-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-237-136-106.eu-west-3.compute.amazonaws.com Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:26 GMT x-content-type-options nosniff x-c master-1404.I1e61f9.M0-468 p3p CP="This is not a P3P policy" vary * content-length 43 x-xss-protection 1; mode=block pragma no-cache last-modified Tue, 24 Nov 2020 18:56:27 GMT server jag xserver anedge-f7bfdfcfd-vgb9s etag 3449197583775662080-4621761411405902852 strict-transport-security max-age=31536000; includeSubDomains content-type image/gif;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Sun, 22 Nov 2020 18:56:27 GMT
GET H2	200	pixel.png im.cbsileads.com/	609 B 1 KB	199ms 150ms	Image image/png	34.120.132.76 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://im.cbsileads.com/pixel.png?spotname=right-rail&docid=33164070,33164073,33164072&pagetype=article&topicname=Security,Security,Security&devicetype=desktop&lon=1500008513,1500008513,1500008513&promo=2150&site=zdnet&ursid=&tid=2311201856267927269 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.132.76 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 0b960c8f9b3fb4ca1d0b1f43e40b5defd11dbf0fd60ebad49ad50ecc06119170 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT x-guploader-uploadid ABg5-Uy0N6u3LG2OEBL4sJnbkiz8ndIwCZiaRlahWGQxywnCeUPPHFd6qeCy5jum9E8K5_vk6smpwkMTgznrUDMQkd8 x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc clear content-length 609 last-modified Tue, 23 Jun 2020 01:31:20 GMT server UploadServer etag "6802175f61adc40617e8ba87a30aa6bd" x-goog-hash crc32c=Yf0PfA==, md5=aAIXX2GtxAYX6LqHowqmvQ== content-language en x-goog-generation 1592875880921192 cache-control no-cache,max-age=0 x-goog-stored-content-length 609 accept-ranges bytes content-type image/png expires Mon, 23 Nov 2020 18:56:27 GMT
GET H2	200	ua-sdk.min.js Show response web-sdk.urbanairship.com/notify/v1/	157 KB 29 KB	71ms 20ms	Script application/javascript	35.227.208.151 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js Requested by Host: zdnet3.cbsistatic.com URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-0350b998c8-rev.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.227.208.151 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash ebc8419821dd4d9a2cd710ea02fd413bded2fe931609c77b35997471a2c0bd21 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:54:00 GMT content-encoding gzip age 147 x-guploader-uploadid ABg5-UxsPelXhHMjxxmgYXWzJlzLmkCPxRvn25YKev8H1148czMCsHBLup-bsnDVu_JReV4Rnwwp_0988F3GDwbI0LXUSYbhyA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 29548 last-modified Thu, 03 Sep 2020 13:21:36 GMT server UploadServer etag "29e2383112026cd1bc0bd7f1a436a222" x-goog-hash crc32c=THaGHA==, md5=KeI4MRICbNG8C9fxpDaiIg== x-goog-generation 1599139296738055 cache-control public,max-age=300,no-transform x-goog-stored-content-length 29548 accept-ranges bytes content-type application/javascript expires Mon, 23 Nov 2020 18:59:00 GMT
GET H2	200	show-hide-1.0-7bf562809f-rev.js Show response zdnet3.cbsistatic.com/fly/js/components/	2 KB 1013 B	6ms 6ms	Script application/javascript	2a04:4e42:1b::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7bf562809f-rev.js Requested by Host: zdnet2.cbsistatic.com URL: https://zdnet2.cbsistatic.com/fly/js/libs/require-2.1.2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash cd715c0fa7d69e85432e8b08d0a02b9613edf40212cca2040bde31670167638e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT content-encoding gzip x-content-type-options nosniff age 383876 vary Accept-Encoding, Accept content-length 671 x-xss-protection 1; mode=block last-modified Wed, 18 Nov 2020 16:48:09 GMT server ContentServer x-frame-options SAMEORIGIN etag "b05603b1b4fd765174fc4171bed7290d" strict-transport-security max-age=31536000 content-type application/javascript access-control-allow-origin * cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 26 Nov 2020 08:18:30 GMT
GET H/1.1	200 OK	beacon.js Show response sb.scorecardresearch.com/	1 KB 1 KB	110ms 31ms	Script application/x-javascript	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://sb.scorecardresearch.com/beacon.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:27 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=86400 Connection keep-alive Content-Length 884 Expires Tue, 24 Nov 2020 18:56:27 GMT
GET H2	200	tr5 cdn.taboola.com/libtrc/	3 B 103 B	30ms 29ms	Image text/html	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.taboola.com/libtrc/tr5?abgroup=vpl_ctrl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:27 GMT via 1.1 varnish server Varnish x-timer S1606157787.408286,VS0,VE0 x-served-by cache-fra19142-FRA x-cache HIT content-type text/html cache-control private,max-age=14400 accept-ranges bytes content-length 3 retry-after 0 x-cache-hits 0
GET H2	200	load.js Show response widget.perfectmarket.com/cbsinteractive-zdnet/	13 KB 5 KB	80ms 14ms	Script application/javascript	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id rwr9L97XovW8QPypI62jHvd7E2HiNZm2 content-encoding gzip etag "fc0de48a0976cde02ddee0bd49a81832" age 159 x-cache HIT, HIT content-length 4742 x-amz-id-2 L9yj3L5x6DgDGCOllzFF3eSn5r2nzIZtAeTjNbt70zeCA9tZ8NYdTf2IlgAnrL/PNegw1sNU07U= x-served-by cache-lax10650-LGB, cache-cdg20758-CDG last-modified Thu, 20 Oct 2016 17:48:07 GMT server AmazonS3 x-timer S1606157787.464741,VS0,VE1 date Mon, 23 Nov 2020 18:56:27 GMT vary Accept-Encoding,, x-amz-request-id AEDE2788DB2CA3A9 via 1.1 varnish, 1.1 varnish cache-control max-age=300 accept-ranges bytes content-type application/javascript; charset=utf-8 x-cache-hits 1, 1
GET H2	200	impl.20201116-23-RELEASE.js Show response cdn.taboola.com/libtrc/	448 KB 103 KB	34ms 33ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3-br / Resource Hash f7eae951f0a4d945f86cafe6725d20c83229ef15ddd9b22e9ab4b09045bca250 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id 8.LuYV88Q3BN3Xjq2riT7SAL2.ixv6Fy content-encoding br etag "35aff8820f47348863899539c6944606" age 7507 x-cache HIT content-length 105235 x-amz-id-2 6V5Rasqw6rxt6EZ8FsG7/S/MPLLAaNxWrjvHLZJ/yhu0CWUF0FoifejFPiVmooZJl+alFHdmj4Y= x-served-by cache-fra19142-FRA last-modified Tue, 17 Nov 2020 00:37:26 GMT server AmazonS3-br x-timer S1606157787.413312,VS0,VE0 date Mon, 23 Nov 2020 18:56:27 GMT vary Accept-Encoding x-amz-request-id F25274519A1AC225 via 1.1 varnish cache-control private,max-age=31536000 accept-ranges bytes content-type application/javascript abp 78 x-cache-hits 1372
GET H2	200	pmk-201618008.1.js Show response widget.perfectmarket.com/cbsinteractive-zdnet/	323 KB 89 KB	21ms 20ms	Script application/javascript	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu content-encoding gzip etag "da73fb2066df9f51d08b6688cfb35441" age 4567426 x-cache HIT, HIT content-length 91236 x-amz-id-2 XpQc4w2tqjXS8i9b9g54OgKhFFuKl0h4kOoHVy9VhSOp3SbZkQc3KSURTRjh4JTn7jZQx4vMUNA= x-served-by cache-lax8648-LAX, cache-cdg20758-CDG last-modified Thu, 20 Oct 2016 17:47:53 GMT server AmazonS3 x-timer S1606157788.537911,VS0,VE1 date Mon, 23 Nov 2020 18:56:27 GMT vary Accept-Encoding,, x-amz-request-id 7W3KFJ6PFXBX9J5R via 1.1 varnish, 1.1 varnish cache-control max-age=31536000 accept-ranges bytes content-type application/javascript; charset=utf-8 x-cache-hits 1, 1
GET H/1.1	204 No Content	b2 sb.scorecardresearch.com/ Redirect Chain https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%2... https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%...	0 399 B	119ms 38ms	Image text/plain	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=&cs_ak_ss=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:27 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=&cs_ak_ss=1 Pragma no-cache Date Mon, 23 Nov 2020 18:56:27 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	204 No Content	b2 sb.scorecardresearch.com/ Redirect Chain https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20a... https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20...	0 399 B	126ms 46ms	Image text/plain	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=&cs_ak_ss=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Mon, 23 Nov 2020 18:56:27 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1606157787602&ns_c=UTF-8&cv=3.5&c8=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&c9=&cs_ak_ss=1 Pragma no-cache Date Mon, 23 Nov 2020 18:56:27 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 18 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 6039 date Mon, 23 Nov 2020 17:15:48 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18817 expires Mon, 23 Nov 2020 19:15:48 GMT
GET H/1.1	200 OK	beacon.js Show response sb.scorecardresearch.com/	1 KB 1 KB	98ms 33ms	Script application/x-javascript	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://sb.scorecardresearch.com/beacon.js Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:27 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=86400 Connection keep-alive Content-Length 884 Expires Tue, 24 Nov 2020 18:56:27 GMT
GET H2	404	tboptevent.html widget.perfectmarket.com/opt/ Frame 7BEC	0 0	23ms 20ms	Document text/plain	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash Request headers :method GET :authority widget.perfectmarket.com :scheme https :path /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers server Varnish retry-after 0 accept-ranges bytes date Mon, 23 Nov 2020 18:56:27 GMT via 1.1 varnish x-served-by cache-cdg20758-CDG x-cache MISS x-cache-hits 0 x-timer S1606157788.825842,VS0,VE0 content-length 0
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	2 B 65 B	37ms 36ms	XHR text/plain	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=512873210&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&ul=en-us&de=UTF-8&dt=The%20malware%20that%20usually%20installs%20ransomware%20and%20you%20need%20to%20remove%20right%20away%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=712052196&gjid=2094399887&cid=735377612.1606157788&tid=UA-33613588-22&_gid=1209150470.1606157788&_r=1&_slc=1&cd2=other&z=632933655 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:28 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.zdnet.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	404	tboptevent.html widget.perfectmarket.com/opt/ Frame BC76	0 0	52ms 19ms	Document text/plain	151.101.193.181 FASTLY
General Check archive.org Show headers Download Go to Full URL https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D Requested by Host: widget.perfectmarket.com URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.193.181 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash Request headers :method GET :authority widget.perfectmarket.com :scheme https :path /opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers server Varnish retry-after 0 accept-ranges bytes date Mon, 23 Nov 2020 18:56:28 GMT via 1.1 varnish x-served-by cache-cdg20758-CDG x-cache MISS x-cache-hits 0 x-timer S1606157788.085370,VS0,VE0 content-length 0
GET H2	200	bcn www.summerhamster.com/	43 B 182 B	142ms 39ms	Image image/gif	52.28.163.208 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.summerhamster.com/bcn?fe=1606157788088&y=2.0.1105&elg=484032819&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fwkh-pdozduh-wkdw-xvxdoob-lqvwdoov-udqvrpzduh-dqg-brx-qhhg-wr-uhpryh-uljkw-dzdb%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fjrsen%2Fycgrou%2Fwvagadqo%2F%3Brug%3D1606157785008%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Auivv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.28.163.208 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software Jetty(9.2.10.v20150310) / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Mon, 23 Nov 2020 18:56:28 GMT server Jetty(9.2.10.v20150310) content-length 43 access-control-allow-methods * content-type image/gif
GET H3-Q050	200	pubads_impl_2020111701.js Show response securepubads.g.doubleclick.net/gpt/	277 KB 98 KB	139ms 100ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash 68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:28 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 17 Nov 2020 09:43:24 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 99766 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:28 GMT
GET H2	200	json Show response trc.taboola.com/cbsinteractive-zdnet/trc/3/	13 KB 5 KB	340ms 339ms	XHR application/javascript	151.101.113.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=19%3A56%3A28.628&lti=vpl_ctrl&data=%7B%22id%22%3A838%2C%22ii%22%3A%22%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1606060369894%2C%22vi%22%3A1606157788625%2C%22cv%22%3A%2220201116-23-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22pev%22%3A4141%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A8940%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A8465.03125%2C%22mw%22%3A770%7D%5D%2C%22cacheKey%22%3A%22text%3D%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2CZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%3Dalternating-thumbnails-a%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22vpl_ctrl%22%7D Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ea06aa69315cc7b4c6affded338c4c87c01112f7d544c18b31ad3cd9b73f0631 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers x-vcl-time-ms 307 date Mon, 23 Nov 2020 18:56:28 GMT content-encoding gzip server nginx x-timer S1606157789.643076,VS0,VE307 x-served-by cache-hhn4076-HHN vary Accept-Encoding x-cache MISS p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin https://www.zdnet.com access-control-allow-credentials true accept-ranges bytes content-type application/javascript; charset=utf-8 via 1.1 varnish x-cache-hits 0
GET H2	200	integrator.js Show response adservice.google.fr/adsid/	109 B 803 B	40ms 15ms	Script application/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.fr/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:28 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 317 B	16ms 15ms	Script application/javascript	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:28 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	233 KB 34 KB	776ms 775ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2886565102612226&correlator=526792188921800&output=ldjh&impl=fifs&eid=21067994%2C21068727%2C21066288%2C21068031%2C21068418&vrg=2020111701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201123&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=5x5%2C728x90%7C970x250%7C970x66%2C300x250%7C300x600%7C300x1050%2C300x250%2C371x771%2C320x50%7C11x11%2C300x250%2C728x90%7C970x250%7C970x66&fluid=0%2C0%2C0%2C0%2C0%2Cheight%2C0%2C0&prev_scp=pos%3Dnav%26sl%3Dnav-ad%253FT-1000%7Cpos%3Dtop%26sl%3Dleader-plus-top%253FT-1000%7Cpos%3Dtop%26sl%3Dmpu-plus-top%253FT-1000%7Cpos%3Dmiddle%26sl%3Dmpu-middle%253FT-1000%7Cpos%3Dtop%26sl%3Ddynamic-showcase-top%253FT-1000%7Cpos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FT-1000%7Cpos%3Dbottom%26sl%3Dmpu-bottom%253FT-1000%7Cpos%3Dbottom%26sl%3Dleader-plus-bottom%253FT-1000&eri=1&cust_params=buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cnetworking%26tag%3Dransomware%252Cmalware%252Ctarget%26mfr%3Dsophos-inc%26prodtype%3Dcomputers%252Ccomputer%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Duk%26subses%3D1%26session%3Db%26pv%3D1%26vguid%3D8b15401f-988e-4324-98b9-2cc9d6b77118&cookie_enabled=1&bc=31&abxe=1&lmt=1606155690&dt=1606157788808&dlt=1606157783247&idt=5408&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-20%2C1050%2C1050%2C1015%2C215%2C1050%2C436&adys=0%2C365%2C485%2C2512%2C1711%2C2146%2C3992%2C8741&adks=2072725681%2C3581870410%2C1925781520%2C3289239044%2C3970605601%2C2484431570%2C3509234736%2C519614694&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&dssz=57&icsg=172032&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x9201%7C1600x90%7C370x250%7C370x250%7C370x771%7C770x11%7C370x250%7C1210x90&msz=1600x5%7C1600x90%7C370x250%7C370x250%7C370x771%7C770x11%7C370x250%7C1210x90&ga_vid=735377612.1606157788&ga_sid=1606157789&ga_hid=512873210&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 561d5c22fcabac8c7a98ce064966f372818cf61211266666d86272f387201b98 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33701 x-xss-protection 0 google-lineitem-id 5536907755,-1,-1,-1,4825966980,5245653073,-1,4745556468 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138330579524,-1,-1,-1,138247024569,138316868599,-1,138286514475 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html 8931a4e592a2b9d537f2ad6eb4b829fa.safeframe.googlesyndication.com/safeframe/1-0-37/html/	0 0	80ms 39ms	Other text/html	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://8931a4e592a2b9d537f2ad6eb4b829fa.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	cta-branding.js Show response cdn.taboola.com/demand-formats/cta-branding/	22 KB 4 KB	32ms 31ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/demand-formats/cta-branding/cta-branding.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash d105039750eae90346c700600eee4d839f6c61aec77f30669013c2c01d0d7361 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id MPfcHgBulRizUm1OhOUPQznYQ1jgzw60 content-encoding gzip etag "8cee40ddbad0d56c6e33b6479d8e45c4" age 5733 x-cache HIT x-amz-replication-status PENDING content-length 4310 x-amz-id-2 CwwtQCduCl+T76f9HGvrkRu/59XuVKsgyM1KCgZ82weig+RGB+WnHJ+CBEjuF/ur9BJgiZcs4LE= x-served-by cache-fra19142-FRA last-modified Sun, 15 Nov 2020 09:20:35 GMT server AmazonS3 x-timer S1606157789.994147,VS0,VE0 date Mon, 23 Nov 2020 18:56:28 GMT vary Accept-Encoding x-amz-request-id C803D9C9AA785B79 via 1.1 varnish cache-control private,max-age=14400 accept-ranges bytes content-type application/javascript abp 78 x-cache-hits 6196
GET H2	200	cta-branding.css cdn.taboola.com/demand-formats/cta-branding/	3 KB 1 KB	29ms 29ms	Stylesheet text/css	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/demand-formats/cta-branding/cta-branding.css Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash b2cb57515497d75f4345929ae896c87c21f27d609aed94fb83f857e5b96f9835 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id tcahAQL7SM5vHmChLog9xryayd2KNhUu content-encoding gzip etag "9e155136143a96e23a99757df9aa3cc8" age 5737 x-cache HIT x-amz-replication-status PENDING content-length 728 x-amz-id-2 f65xj6iuxogMKrz0V0PcFaMwZec2VDREXRA0jdjbf3aLNlkxtn2vhTmCXQ21535SK5HpYLHFJGI= x-served-by cache-fra19142-FRA last-modified Sun, 15 Nov 2020 09:20:35 GMT server AmazonS3 x-timer S1606157789.994071,VS0,VE0 date Mon, 23 Nov 2020 18:56:28 GMT vary Accept-Encoding x-amz-request-id 414C1B5C7AA1A893 via 1.1 varnish cache-control private,max-age=14400 accept-ranges bytes content-type text/css abp 78 x-cache-hits 6117
GET H2	200	userx.20201116-23-RELEASE.es6.js Show response cdn.taboola.com/libtrc/	23 KB 8 KB	29ms 29ms	Script application/javascript	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/userx.20201116-23-RELEASE.es6.js Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 9ec1d960b9c13263c5acac08d184a8ea24c401bd7cc00ae34fc41fc7694d3cf7 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id 8AdQq2s2jDt1jE8u9BhnhZm3qRZiiS85 content-encoding gzip etag "57a52f762444c874b7d3e1d5813c5886" age 118 x-cache HIT x-amz-replication-status COMPLETED content-length 7880 x-amz-id-2 f0VuYJsHuHsYgzZcITwKVL1XaOY4TzFDsKBzgGLXLzUuydS8p5rS9oSAuTHLc9SHsEP4LbySn/o= x-served-by cache-fra19142-FRA last-modified Tue, 17 Nov 2020 00:38:04 GMT server AmazonS3 x-timer S1606157789.034545,VS0,VE0 date Mon, 23 Nov 2020 18:56:29 GMT vary Accept-Encoding x-amz-request-id C00AF1605EF2CE8A via 1.1 varnish cache-control private,max-age=14400 accept-ranges bytes content-type application/javascript; charset=utf-8 abp 78 x-cache-hits 3
GET H2	204	social trc-events.taboola.com/cbsinteractive-zdnet/log/3/	0 276 B	95ms 30ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://trc-events.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=vpl_ctrl&ri=355a51790bffca88237e1efa43e44b7e&sd=v2_9598fd7aab6fa5cb17ce655a510c15de_a5824339-1331-48a3-86cf-642d27e12b0d-tuct6b58b5c_1606157788_1606157788_CNawjgYQzro_GNHL27PfLiABKAEwSjjE1whA7IsQSJSE2ANQ7aEPWAFgAGjipqqRsq2X4nA&ui=a5824339-1331-48a3-86cf-642d27e12b0d-tuct6b58b5c&pi=/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&wi=3925768829892879526&pt=text&vi=1606157788625&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22widget%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=19%3A56%3A29.046&id=9296&llvl=1&cv=20201116-23-RELEASE& Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:29 GMT server nginx x-fastly-to-nlb-rtt 9040 p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * cache-control no-cache access-control-allow-credentials true tbl-x-upstream 10.41.30.18:10213
GET H2	204	social trc-events.taboola.com/cbsinteractive-zdnet/log/3/	0 274 B	96ms 31ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://trc-events.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=vpl_ctrl&ri=355a51790bffca88237e1efa43e44b7e&sd=v2_9598fd7aab6fa5cb17ce655a510c15de_a5824339-1331-48a3-86cf-642d27e12b0d-tuct6b58b5c_1606157788_1606157788_CNawjgYQzro_GNHL27PfLiABKAEwSjjE1whA7IsQSJSE2ANQ7aEPWAFgAGjipqqRsq2X4nA&ui=a5824339-1331-48a3-86cf-642d27e12b0d-tuct6b58b5c&pi=/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&wi=3925768829892879526&pt=text&vi=1606157788625&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A341%2C%22ly%22%3A395%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=19%3A56%3A29.046&id=6813&llvl=1&cv=20201116-23-RELEASE& Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:29 GMT server nginx x-fastly-to-nlb-rtt 9040 p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * cache-control no-cache access-control-allow-credentials true tbl-x-upstream 10.40.20.9:10213
GET H2	204	social trc-events.taboola.com/cbsinteractive-zdnet/log/3/	0 275 B	98ms 33ms	Image text/plain	141.226.228.48 TABOOLA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://trc-events.taboola.com/cbsinteractive-zdnet/log/3/social?route=AM:AM:V&lti=vpl_ctrl&ri=355a51790bffca88237e1efa43e44b7e&sd=v2_9598fd7aab6fa5cb17ce655a510c15de_a5824339-1331-48a3-86cf-642d27e12b0d-tuct6b58b5c_1606157788_1606157788_CNawjgYQzro_GNHL27PfLiABKAEwSjjE1whA7IsQSJSE2ANQ7aEPWAFgAGjipqqRsq2X4nA&ui=a5824339-1331-48a3-86cf-642d27e12b0d-tuct6b58b5c&pi=/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&wi=3925768829892879526&pt=text&vi=1606157788625&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A383%2C%22ly%22%3A395%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=19%3A56%3A29.047&id=5634&llvl=1&cv=20201116-23-RELEASE& Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:29 GMT server nginx x-fastly-to-nlb-rtt 9040 p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin * cache-control no-cache access-control-allow-credentials true tbl-x-upstream 10.41.32.36:10213
GET H2	200	f539211219b796ffbb49949997c764f0.png cdn.taboola.com/libtrc/static/thumbnails/	254 B 671 B	31ms 30ms	Image image/png	151.101.13.44 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC via 1.1 varnish etag "dfa7b52c86e56bd67fa4002f6ed19854" age 25195 x-cache HIT x-amz-replication-status COMPLETED content-length 254 x-amz-id-2 Vjnfq2okxpLEG/cBVxSfv3DOOCGN7KTpixt29L7DwUhoZL6eRlgDSODZqhfatrYL58q01gaLKf4= x-served-by cache-fra19142-FRA last-modified Wed, 24 Jun 2015 07:14:11 GMT server AmazonS3 x-amz-meta-s3cmd-attrs uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567 x-timer S1606157789.103083,VS0,VE0 date Mon, 23 Nov 2020 18:56:29 GMT x-amz-request-id F6D91014AAA6CDC4 cache-control private,max-age=31536000 accept-ranges bytes content-type image/png abp 78 x-cache-hits 42416
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 60D0	0 0	215ms 214ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuHBvc0lTwFvgYxsSBSfuGEb7VsY6aeUpwXIrQkK0cC0JMEYKswkxMs_JQjt8dZu96mDeI_l79_LGHKjc3vulQva-Mzv_V8uqDFGFh3F-BeS1JWrebFtRaF-3azmDf8CkflO-VEmqh7se1ZzSg0T3df1dnTvx6npCr8A4HlSmzghDDdlSplPT7JiGxWJLyI56wuTQvhB0RvGppY71tXIqkaKMzbQYeTz4nihFnzQBkwxSIp4PUycEabypLD7m-By1mZBviLsZH8oz5mOg&sai=AMfl-YQDvNe-oNg8MgRs9G0IfffVrW2T8TfrV3TYeNu3eyoZ--m2eVIdTl4WYaGfo-REfdr-P0jpx4iw0T-yhFbP6RGKPDX1EgvHD1VlGY38rBAngkIb8wTmG6lKQXwX0Yk&sig=Cg0ArKJSzNS1B6xa4K9tEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:29 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	ad.js Show response clipcentric-a.akamaihd.net/ad/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/ Frame 60D0	135 KB 37 KB	103ms 30ms	Script text/javascript	2.16.177.50 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://clipcentric-a.akamaihd.net/ad/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/ad.js?q=1604705524 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.177.50 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Apache/2.2.34 / Resource Hash 6f61194871255096b51c078ecffd02a93699b2cda3bc71c8c48cea2a5511a5b2 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding br last-modified Thu Jan 1 00:00:00 1970 server Apache/2.2.34 cache-control max-age=3600 content-length 37902 content-type text/javascript
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 60D0	75 KB 29 KB	62ms 40ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 60D0	320 KB 107 KB	35ms 35ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38973 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	B24946233.286791742;dc_pre=CIS4hoSsme0CFRHiuwgdKyYARQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/ Frame 60D0 Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=? https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CIS4hoSsme0CFRHiuwgdKyYARQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_fo...	42 B 515 B	453ms 409ms	Image image/gif	216.58.210.6 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CIS4hoSsme0CFRHiuwgdKyYARQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=? Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.210.6 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:30 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 23 Nov 2020 18:56:29 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N7384.3861580VIACOMCBS/B24946233.286791742;dc_pre=CIS4hoSsme0CFRHiuwgdKyYARQ;dc_trk_aid=480369388;dc_trk_cid=140485965;ord=2139843369;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=? cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	73 KB 28 KB	54ms 46ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28207 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	204	gen_204 pagead2.googlesyndication.com/pagead/	0 265 B	19ms 14ms	Image image/gif	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sz&pvsid=2886565102612226&r=320x50%7C11x11&w=11&h=11&a=0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:29 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame A647	180 KB 50 KB	64ms 32ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121516 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H2	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A647	13 KB 5 KB	47ms 15ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H2	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A647	90 KB 27 KB	42ms 11ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H2	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A647	3 KB 1 KB	41ms 10ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121159 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H2	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A647	41 KB 14 KB	39ms 8ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189595 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET H2	200	css fonts.googleapis.com/ Frame A647	6 KB 774 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 56e4953af5c01ed820d5e5dc430e77234a87e8d019c38fda46f9f3593cd05e0f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:56:29 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	css fonts.googleapis.com/ Frame A647	4 KB 701 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:01:05 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET DATA	200 OK	truncated / Frame A647	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 108ca5b86411abd87da6de7c89a303b1656f994baec4d0d7891576a0b1f502d7 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame 18AE	180 KB 50 KB	37ms 24ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121516 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 18AE	13 KB 5 KB	87ms 69ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 18AE	90 KB 27 KB	106ms 88ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 18AE	3 KB 2 KB	68ms 51ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121159 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 18AE	41 KB 13 KB	119ms 98ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189595 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET DATA	200 OK	truncated / Frame 18AE	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fe3fe5bbc4340300d321d84fbef8517b47538e8e8012d4f876889855c07627fc Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame 684D	180 KB 50 KB	19ms 16ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121516 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 684D	13 KB 5 KB	118ms 100ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 684D	90 KB 27 KB	117ms 99ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 684D	3 KB 1 KB	116ms 99ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121159 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 684D	41 KB 13 KB	132ms 110ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189595 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame 684D	4 KB 650 B	68ms 49ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 17:03:31 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame 684D	4 KB 1 KB	46ms 28ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500&text= Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:10:18 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Mon, 23 Nov 2020 18:56:29 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET DATA	200 OK	truncated / Frame 684D	215 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 80de987fdaa481026937753614f883611adba0d0301b3658fc09d1753d23a714 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 7711	0 0	379ms 363ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssMBPS-KPgHm6kC-On7ldsB-WpgkZYhZM7xUvxRjDMPAH3YEbjr9vOeppxAA9Fot48HTJkkAEUN9aZQj6fPnhSWYozXGx58eF5jWNt06_gGaRN0pQGT5Qa45U8zsPi-i78XG4mHfYvpOTvWE7BZAl4n_FBQgLxjp6Z1CrGDYLWhrNX8sxoCAZ7GWX8EbZWUEX35ezXRwieeHPUAujoEWuMLht7uVILKBz0WvWgZqJ6-QsYnQhRBpbceOZNPYXhVSwMozQy-vpxv&sai=AMfl-YTdmChyJJQTsOd83eeNSqTqqCOXlPqeTni_GLoAQy5ml_DycEhfMDGdPH5WXCaN___-Cy6y6GIAvchpG8ktBDZlmyswD0NRM2fLgcy770_TwbnKEJTx9R83fygVSx4&sig=Cg0ArKJSzGwlXX6bw6jREAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:29 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	adKit.min.js Show response rev.cbsi.com/common/js/ Frame 7711	6 KB 2 KB	383ms 151ms	Script application/javascript	2a04:4e42:31::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://rev.cbsi.com/common/js/adKit.min.js?1071799592 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:31::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 2bf78db102c9d6e84c8e86cd2bd6134383688ae866a991028728b62f482358ab Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:30 GMT content-encoding gzip vary Accept-Encoding age 0 x-cache MISS content-length 2149 x-served-by cache-ewr18162-EWR access-control-allow-origin * last-modified Thu, 16 Apr 2020 15:02:48 GMT server AmazonS3 x-timer S1606157790.088108,VS0,VE61 etag "e524dc608d5c7c30eef57b6ed95dc6a8" strict-transport-security max-age=300 content-type application/javascript via 1.1 varnish accept-ranges bytes x-cache-hits 0
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 7711	75 KB 29 KB	47ms 27ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 7711	320 KB 107 KB	57ms 33ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38973 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2846	0 0	361ms 353ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst_w0PszSinn3wAPtIUaboMxBMBDP_OfW4vITVxm3PV2Xd_X9Ce254dRU6ZnNCGG0PxWofaVbUy97UhKtCbArAojRwlwkV5TUVaOWKmnUR1vSOvFLHvSVZZhKCgFa5YfU9xFg4AkDBXdL4Daubv4DLZd9kr_SktIqJJuAogqkKRO0NwqzQfirMB5_5URqhjUlXHsXJgUSDzDLyDVPJn6ePNRMTxMbhoHWGtzC5YU3qIK7O424U8yEn7-heszxd0-5ytlLvpN3-Yq1kz7w&sai=AMfl-YRkg6YeVOn6ICEaksssjfusazEdy6Y6KrCEFhGGoa09a_pomBwHXAR0WhW0sDWQcHwoGQowGu8GCiYjmH3DsnLcCerKOG1a71ZdLravgsa4UnaHW6CPRayVdor092U&sig=Cg0ArKJSzGNJMujEnSCAEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:29 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	sfp-set-targeting.js Show response native.sharethrough.com/assets/ Frame 2846	56 KB 20 KB	194ms 37ms	Script application/javascript	65.9.86.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://native.sharethrough.com/assets/sfp-set-targeting.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.86.33 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash c283da3a38e4fa2ded33a3c2c87ef417dfc24e40af00e8f73bcdf28b801dd25e Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:44:17 GMT content-encoding gzip last-modified Thu, 19 Nov 2020 14:59:44 GMT server AmazonS3 age 733 etag "9c1b8e32230beda3058032e167d4e6f7" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript via 1.1 bdba42cf1410fb617eeb4ffd3e0b9cb7.cloudfront.net (CloudFront) cache-control public, max-age=3600 x-amz-cf-pop AMS1-C1 x-amz-cf-id 3T_zyJWm2VS69NqPrdu4mvYxfSvUpmUbf0nWBIoL6JhLQDglmDNv4w== expires Thu, 19 Nov 2020 15:59:43 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 2846	75 KB 29 KB	32ms 27ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 2846	320 KB 107 KB	45ms 38ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38973 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H3-Q050	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame 637A	180 KB 50 KB	96ms 70ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121516 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:11:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:11:13 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 637A	13 KB 5 KB	89ms 73ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 637A	90 KB 27 KB	94ms 79ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189596 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:33 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:33 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 637A	3 KB 1 KB	105ms 90ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 121159 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Sun, 22 Nov 2020 09:17:10 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Mon, 22 Nov 2021 09:17:10 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 637A	41 KB 13 KB	100ms 91ms	Script text/javascript	2a00:1450:4001:803::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 189595 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Sat, 21 Nov 2020 14:16:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Sun, 21 Nov 2021 14:16:34 GMT
GET DATA	200 OK	truncated / Frame 637A	218 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3c4fcf045ffda51073588395fcf1126d8cb108e0c41a0efea7c4372a2c75d82 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 008D	0 0	301ms 220ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuHmMKuyy4oAD3cRo2lgZqvwYYHxz-xtqMtJqJFbG1ihvmaUHkaplVybpsrtqZpcytBFaAdcDE1m3qBT38P9530rN2uZ42dBjjOdR2JcPLhBP3AzeomMhXaEfXg-E208lTciIGPq14OUrGOSNrixjgjqnYcxbAHFunWvPzwgxg0hM_awH2fIQfBwdImVKJ2o6pzy6vmfVYQ8OueP_L_SDGSy97DWR-JEcexyHqocAPJnstv1rCOD1XyyFMSm3vzt4FEZEhyVgky&sai=AMfl-YQxVl7ejh-BYBkihcn2SHAlXArYvLfPOvFiRtqfJ9VvYowAaLoO_3M8yydeUM7An7WZKioLbLE05nMljb8aSSkkAHlXXMtbMV_VUn4K4wXt6HuzFb3A9-Xw06i88QU&sig=Cg0ArKJSzFVxiIF6vkdNEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:29 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 008D	75 KB 29 KB	86ms 22ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5e72a6053c72fd8b75a2723a35b054605a26ed93fe36fa40c5cb1ace71322129 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 29194 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:29 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 008D	320 KB 107 KB	103ms 23ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:29 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38973 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/11253319325380860251/ Frame A647	31 KB 31 KB	155ms 7ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/11253319325380860251/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b88380497b9347aff99bca5742fdcd5572e021a59b4f3f9c3477caaf76de35b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 13:15:45 GMT x-content-type-options nosniff last-modified Fri, 11 Sep 2020 10:24:32 GMT server sffe age 538845 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31511 x-xss-protection 0 expires Wed, 17 Nov 2021 13:15:45 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/10247368670396149040/ Frame A647	20 KB 20 KB	151ms 3ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/10247368670396149040/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qlPY2iaUapHNAvGzMrRT9878iFZCg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e879f510057a9402ebcd35912a42e45b3387f7a2a1c053a4b9794a512b2feca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 07:10:52 GMT x-content-type-options nosniff last-modified Wed, 26 Aug 2020 06:41:17 GMT server sffe age 387938 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20480 x-xss-protection 0 expires Fri, 19 Nov 2021 07:10:52 GMT
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame A647	0 0	305ms 218ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CaXdf3AW8X82hOdPSgQf164HICLqrvtBfgqy-0tYL2_zqggEQASDMka4iYPuBgICICqAB55HA1APIAQapAtgst_aI97M-4AIAqAMByAMKqgS6Ak_QTnV7VzrVdOuZ0ZIgMCkgXhxPF2OBm6PJbW3mOOqLVfZ2gSrLdiiR2EXHMVhO_nQU2EtJZaq6cJMm0lh-1OnNe12ohwauTR_QqCO_5i-MmbNtjj1e5FpIzw2U8NdtJuF6Z6c4kyUQFLBg7W_rN8d4WA4KS4m51uQXhwrAhfaB0QE9G70mwNuCDGTNWbO3S44ZMpiUCulOV4lsvsnckNx0tUQIxQsJfOymCw_7tD0nFSR9GfaAJdDRIPgMmGkSiKiHvzdLxijDiopntZ0hZtEyKq60Gh2ChDAugrNQ5GztKLMV0GL4W926FTxtyQlRM23SpzY6PAAoV_3fGMOgPL9nFd2JA9V8KiLj_PmFS-OMwcG0jGsF4J7PC7ZI77W3blf2tsSXLpvNEMvOxNj2Aenu49DoHiNE3nKZwAS83vWTmwPgBAGSBQQIBBgBkgUECAUYBKAGN4AHjLOsjgGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQ2fMc0ggJCIDhgFAQARgdgAoDyAsB2BMCiBQEshcaChgIARIUcHViLTE5OTE2Nzk2MjQzMzEzNjk&sigh=Ryj18zCgZTU&template_id=492&tpd=AGWhJms5C1dXS2lb4mF4f9xFxIDcOn4Kycaoh73lAe2Ig69NPw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A647	2 KB 3 KB	149ms 2ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28052 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A647	295 B 761 B	147ms 0ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73469 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	200	12684587740497415278 tpc.googlesyndication.com/simgad/ Frame 18AE	86 KB 86 KB	171ms 24ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/12684587740497415278?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnA5k8IC0IdatMloSLhv0ap82Qwig Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1663907db200b373dc41f3246b81f6f0986c8334614cb81cf5a4eb62c2510fb2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 16:04:10 GMT x-content-type-options nosniff last-modified Thu, 19 Nov 2020 08:06:22 GMT server sffe age 10340 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 87771 x-xss-protection 0 expires Tue, 23 Nov 2021 16:04:10 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 18AE	2 KB 3 KB	148ms 1ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28052 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 18AE	295 B 353 B	103ms 28ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73469 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 18AE	0 0	115ms 13ms	Image text/html	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaT_RenrTiS2Dw9BJHiGOGJ8PDouWQiGHU82sHbMY4yIxh5SYLgvkVD5UJluh9U8Ek1K9HlF Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 18AE	0 0	304ms 218ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CKgN73AW8X86hOdPSgQf164HICOqUy6Fgrqe1ls8Mv-EeEAEgzJGuImD7gYCAiAqgAa3ciogDyAEC4AIAqAMByAMIqgS5Ak_QZwyjhbV_yYrL-jwCKk4YiufkW-3QXUzAhtpW3yzy1Luj4LruiZLbdeBgxhLVMvPNy0Pp2C19scQ43p75M0Csz_UQFEgd63NvmTGXZae5tqq_a9P68wKJN4xWTWO9AYrrsBCrv77z1Jowj_tDciKQ-Y39XdAltys03wQB4UPdw9g7HgXxI9tj20Ww-RqjpKxuaMT74AzpcV5w8oRwpwAyLGQGp2Gnl5EwQoKhTLa3yv2HDi-lCSXPff3aAm5dbSHyLE5asFAsn-iNzShZ7mA4jKRKw8YjLkeDeT3N5XCJObVnrqcT8prZP8gPH3-YwRt_o9YukIrijiE5s9ml2n5qXWF9m-hb2H3kgCkmlyp5q8CkFPHxO9TB_VMXMZPVtJ3SlYf5TR7cxFkfP50ZgO3Cr1V4OrJzY9XABLvB7am3A-AEAZIFBAgEGAGSBQQIBRgEoAYCgAeswtF4qAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcEELPBGNIICQiA4YBQEAEYHYAKA8gLAdgTDLIXGgoYCAESFHB1Yi0xOTkxNjc5NjI0MzMxMzY5&sigh=RQBUAteXj_8&tpd=AGWhJmvESt6bYYrZTG3eNrO_2OydrAhqMtTz_eWT0qmql9oDmw Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	15514801449903738019 tpc.googlesyndication.com/daca_images/simgad/ Frame 684D	11 KB 11 KB	70ms 29ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/15514801449903738019?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qnNHBhR3IkEc9QGTnb61QWei4Wv_w Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 14a1e76a9ba78a95d6c511248f2a79bd6443f9c03993ad159142d85d95551444 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 20 Nov 2020 17:08:33 GMT x-content-type-options nosniff last-modified Fri, 24 Nov 2017 04:35:02 GMT server sffe age 265677 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10863 x-xss-protection 0 expires Fri, 27 Nov 2020 17:08:33 GMT
GET H2	200	14809115904939601473 tpc.googlesyndication.com/daca_images/simgad/ Frame 684D	5 KB 5 KB	73ms 29ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/14809115904939601473?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qnXmJciPdEnHrK58bwJKGkcE4Bnyg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ddd0bcff13c408522f5c353fe9692fc3bd051708e126a1dcfd783c4a79557064 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 21 Nov 2020 19:06:24 GMT x-content-type-options nosniff last-modified Sat, 25 Nov 2017 12:11:03 GMT server sffe age 172206 content-type image/png access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4785 x-xss-protection 0 expires Sat, 28 Nov 2020 19:06:24 GMT
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 684D	0 0	305ms 208ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CVLoR3AW8X8-hOdPSgQf164HICMeM8sVf9tbfgtwFw_PGuIQQEAEgzJGuImD7gYCAiAqgAaSE5dMDyAEG4AIAqAMByAMKqgS-Ak_Qj7PoIcKIpT-M6co9aE5bPzt6wJ6GY53ql6yNsdxBFqtFCKPitxSu_v7UkiPo7sjGmhFqsp4k1ON9SRI_0Csaa52A-LIbCy_ch84gByidRTtXp-ZR-tdGLRFys0DFnoEcGJEODg1lSYRhzj4UYRZFjzk3cokAwcfd2J7Nn8KWa3s969DzsFb7vAME0GLnR-gzuhpwxc-v63q6ppd_DyWyyDD1h1nncGVbHwzxAKxRVKP5VJBh8SiAh81ET-C0ByBFWox2Zfgt16Nbx91kcEuwfOB6387ZV86-DG5ViIwEJil96c7W0ojppObfxhMxhoGOTFwmHAurpHSJPoMkrOD4CTqjv0CFEyHoJt-2tGC_tU--QHkp8yvkIi4hgbfs-ewjzg4gNdk3kY_pFtsdYI0i4lfbVYyfaGKMUZ6z_8AEi_Dsja8B4AQBkgUECAQYAZIFBAgFGASgBjeAB8T7miyoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQ0uAD0ggJCIDhgFAQARgdgAoDyAsB2BMMshcaChgIARIUcHViLTE5OTE2Nzk2MjQzMzEzNjk&sigh=oV76lOgZHa8&template_id=492&tpd=AGWhJmt7atDXIyjOeXYBjZsjKqzO2OwP-S_Gv2fd7eFIGmd6Mg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	204	l www.google.com/ads/measurement/ Frame 684D	0 0	127ms 23ms	Image text/html	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaQU0Dup1AGmq9RDnsUU448U9RR-ICeuhbM7E_-CI_sda-jVYdluJ_7Xb2IV12UH8ZaKWHaN Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 684D	2 KB 3 KB	68ms 27ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28052 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 684D	295 B 353 B	68ms 28ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73469 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H3-Q050	200	15605233287764909432 tpc.googlesyndication.com/daca_images/simgad/ Frame 637A	30 KB 30 KB	76ms 24ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/15605233287764909432 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e32c80d558f9cc1fd33467c892cf207d507efd12cebb380ed467c03d761dceb3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 03:58:39 GMT x-content-type-options nosniff age 399471 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30385 x-xss-protection 0 last-modified Thu, 20 Aug 2020 12:10:39 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 19 Nov 2021 03:58:39 GMT
GET H2	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 637A	2 KB 3 KB	48ms 27ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28052 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 637A	295 B 353 B	47ms 26ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73469 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 637A	0 0	127ms 23ms	Image text/html	2a00:1450:4001:802::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaT_rTwhKE4nPUEWfyJukpsM-itLwcu9iLf1JnSAbI2EBlJYHdimqPrVSEQ4Iz80uBrgrMPc Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 637A	0 0	305ms 202ms	Image text/html	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C5HrV3AW8X9ChOdPSgQf164HICN7xq59gpOr2utAMkvjrvekaEAEgzJGuImD7gYCAiAqgAYL7lL4CyAEC4AIAqAMByAMIqgTAAk_Qs4e0E5FMGvYA5-y99Ndr8l_S6uvyWsrygk09DkF19EhFBa0j9755MvBcFSZjXFlMMcHjRqzwL67FASGYaorNoK8EpQ484pLzxsQ1C18NqGGPxORLu5OdbidnX9DjTN8TyRH8o-mTWGvRGQwu5tG8zII__vGJQz_OkR8Y6d3i_6-iomFvkj_QIzSfACfHrN_MgypAttshBJqtNr4ZO37sZTSHuju08fQUNhhIkoIyIRRqMGmsRy94bPzCuy7uT3LnpN2WVpAIRhwj--15bwKim1sJ1r0Ba-TUCA40rIGFyHT8mkveEhsxfhMOhwxZjQUclt17-swy09WiSxr60O_VHcFV7OV0s0K6iHKNd6HyQP02M17WNaIjdfPGns0WcuOkIf1rUXCDHy7R2FLEoFYrTvnDQqI1FZXpTsm2anDbwATo85CLiwPgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH_7KWxwGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwMQiS_SCAkIgOGAUBABGB2ACgPICwHYEwyyFxoKGAgBEhRwdWItMTk5MTY3OTYyNDMzMTM2OQ&sigh=7vJAkeq-nUM&tpd=AGWhJmtENahg5MJ8AlZpI6qIy7ibgpaVrZJyH1JpDU-rPGnh8w Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	106ms 83ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1606157785741&de=663724139586&rx=76501015798&m=0&ar=a63e245-clean&iw=b2c8261&q=3&cb=0&cu=1606157785741&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A627%3A627%3A892%3A665&fs=186589&na=744064778&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:30 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:30 GMT
GET H3-Q050	200	sodar Show response pagead2.googlesyndication.com/getconfig/	8 KB 7 KB	63ms 28ms	XHR application/json	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020111701&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ba7b6523f738020c33822cafbfa7d5f6df7c67d17518c6a8a9fd5625fdb1d933 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:30 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 6481 x-xss-protection 0
GET H2	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame A647	11 KB 11 KB	15ms 6ms	Font font/woff2	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 11:20:35 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 113755 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Mon, 22 Nov 2021 11:20:35 GMT
GET H3-Q050	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame A647	11 KB 11 KB	32ms 8ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=fr User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 09:05:28 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 121862 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Mon, 22 Nov 2021 09:05:28 GMT
GET H3-Q050	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 684D	11 KB 11 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 17:20:24 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 92166 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Mon, 22 Nov 2021 17:20:24 GMT
GET H3-Q050	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 684D	11 KB 11 KB	9ms 6ms	Font font/woff2	2a00:1450:4001:819::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.zdnet.com Referer https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 22 Nov 2020 09:05:28 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 121862 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Mon, 22 Nov 2021 09:05:28 GMT
POST H2	204	bulk Show response trc.taboola.com/cbsinteractive-zdnet/log/3/	0 112 B	42ms 42ms	XHR image/gif	151.101.113.44 FASTLY
General Check archive.org Show headers Download Go to Full URL https://trc.taboola.com/cbsinteractive-zdnet/log/3/bulk?route=AM%3AAM%3AV&lti=vpl_ctrl&bulkSize=1 Requested by Host: cdn.taboola.com URL: https://cdn.taboola.com/libtrc/impl.20201116-23-RELEASE.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.113.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers x-vcl-time-ms 11 pragma no-cache date Mon, 23 Nov 2020 18:56:30 GMT via 1.1 varnish server nginx x-timer S1606157790.374772,VS0,VE11 x-served-by cache-hhn4076-HHN x-cache MISS p3p policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" access-control-allow-origin https://www.zdnet.com cache-control no-cache access-control-allow-credentials true accept-ranges bytes content-type image/gif x-cache-hits 0
GET H3-Q050	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	16 KB 6 KB	18ms 13ms	Script text/javascript	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:30 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603823857801521" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6015 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:30 GMT
GET DATA	200 OK	truncated / Frame 60D0	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0f3710f5c487833b119fc77b9568669c1492f8fd79b473a074d499b996b31d9e Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 008D	0 22 B	50ms 50ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstfgW1Of1NK2hVBUz5us-ogz1fplT4nkTlHwPKLh2l7uApk3MK_sHiHvoopQDggGAAoJqApq-otZ7kwDuDdIyPOv-mbZVn1jVw5rchxMULsfJpt3XfHKk6gZpGWttNFiCylXD9NM6DrcJGpMxQcYyBmziuV5pYyyrnoDz96_C3Vm-pwA4VnMdr-x6Rp3348rG2qE6VzfEv2uoczJWwkifaRXGsiwPBfuYKjDQ9uTOv1P7SlwX-_6WOTXPgikEIw1EISQcojiz-LlYc&sai=AMfl-YQXFnz5MAmdTnWTQ6_Wc-mjBLkAQg2Q0iJSyWpCEgw8_9NNl_lyfcWNhkmQ3lsoi3c2eVZyo_nebpaOMLI0JjvCOlWMKIJAw8LvFnIjL60Qk2FUOBjnYi4SIUXrUXM&sig=Cg0ArKJSzE9rFtdeXvO6EAE&urlfix=1&adurl= Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:30 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	sfp.js Show response native.sharethrough.com/assets/	270 KB 82 KB	81ms 80ms	Script application/javascript	65.9.86.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://native.sharethrough.com/assets/sfp.js Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gpt/202011171659/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.86.33 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 43dbe9fe6cedb103b80832631a3db837e47107ea5475aa629ce8a00bd756e161 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:07:50 GMT content-encoding gzip last-modified Thu, 19 Nov 2020 14:59:44 GMT server AmazonS3 age 2920 etag "17f1c067831e7f9704f285b22f31d23c" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript via 1.1 bdba42cf1410fb617eeb4ffd3e0b9cb7.cloudfront.net (CloudFront) cache-control public, max-age=3600 x-amz-cf-pop AMS1-C1 x-amz-cf-id 4F2nb-S2H58QoNqttNiP8xwZtIANF_KOPi2CVUayWoMkSkLHroXPJQ== expires Thu, 19 Nov 2020 15:59:43 GMT
GET DATA	200 OK	truncated / Frame 2846	210 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b77a7bf09f0ba33909b7772309e9cd83fce14760897878e98e64436a6c0990c5 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2846	0 22 B	664ms 662ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudzYGJhy_xTs6xMtjnPi4A4zo7lMmaoQOpfj2G6mMQm8IysbCvyiRAqouiKyf65Z94yuUbsoQu9KnIA7ejYMskvKvQZrHqD_ICm28PI3ViRofLl2gLnv0rzG_QkfYTO_oJIoY2uutN0dCxCtWWG2i8mPEODlPnUqEYST6Ym7su79PmdV1gsGlCgUM5cBe7kt10fHjgBvUqUNoZUus1NcLahF3kBGC3tdIELCHdIr3YHE3wosmOSE5NJgEdA8-TKxiPgSs75ksaHUvKriZr&sai=AMfl-YQ6tafK1O_lyMTGGn4IAyOZhZ8Sd3tH613kBD9LrcoH1tOADuBrArdsD8E7UDPkSfl8leu3PSmv-gUzxrT_DqOyPWK_GxkWgRQDHPr5ZeGBlVkf8Wq2ieiKJ7Ii4y0&sig=Cg0ArKJSzMSmozjfRiCOEAE&urlfix=1&adurl= Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:30 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	store.phtml ad.clipcentric.com/user-9/resources/ Frame 10F7	0 0	134ms 35ms	Document text/html	65.9.86.41 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ad.clipcentric.com/user-9/resources/store.phtml?v200530 Requested by Host: clipcentric-a.akamaihd.net URL: https://clipcentric-a.akamaihd.net/ad/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/ad.js?q=1604705524 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.86.41 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.2.34 / Resource Hash Request headers :method GET :authority ad.clipcentric.com :scheme https :path /user-9/resources/store.phtml?v200530 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers content-type text/html; charset=UTF-8 content-length 2976 date Mon, 19 Oct 2020 00:49:34 GMT server Apache/2.2.34 access-control-allow-origin * cache-control max-age=31536000 x-cache Hit from cloudfront via 1.1 609487f3e9c1fd7ddcc7b01d9818bfed.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-C1 x-amz-cf-id Fkk1soguPh3_RBL-Zsab4f3eOWekVt5oqU9VAT5jkYHuya0gyJU64g== age 3089216
GET H2	200	cbsi_ads_skyboxKit.js Show response rev.cbsi.com/common/js/ Frame 60D0	12 KB 3 KB	91ms 91ms	Script application/javascript	2a04:4e42:31::444 FASTLY
General Check archive.org Show headers Download Go to Full URL https://rev.cbsi.com/common/js/cbsi_ads_skyboxKit.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:31::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 4dbdcbed018562c656e6c5b5515ef82736596af03d573b06a50951d802f1e725 Security Headers Name Value Strict-Transport-Security max-age=300 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:30 GMT content-encoding gzip vary Accept-Encoding age 2129 x-cache HIT content-length 2691 x-served-by cache-ewr18162-EWR access-control-allow-origin * last-modified Fri, 23 Oct 2020 17:13:17 GMT server AmazonS3 x-timer S1606157791.832208,VS0,VE0 etag "d0afa4a98aa5509aad29266c3dca9dbb" strict-transport-security max-age=300 content-type application/javascript via 1.1 varnish accept-ranges bytes x-cache-hits 112
GET DATA	200 OK	truncated / Frame 37A9	750 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e9cac3eeba1fc86e06fdc013a4c52742e9b4bd14b7be6517321127d4515095ce Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	E=in,im,fi tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=87/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 137 B	352ms 98ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=87/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=in,im,fi Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	xlr9vC2d.webp clipcentric-a.akamaihd.net/file/1068966/ad_q75/1604705147/ Frame 60D0	16 KB 16 KB	424ms 424ms	Image image/webp	2.16.177.50 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1068966/ad_q75/1604705147/xlr9vC2d.webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.177.50 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Apache/2.2.34 / Resource Hash 72abfb31f44d9d6ae87bfbebfe2e1eef8d44e58bd6f1603c764d029e9bcfae3e Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Mon, 23 Nov 2020 18:56:31 GMT cache-control max-age=31536000 last-modified Fri, 06 Nov 2020 23:32:08 GMT server Apache/2.2.34 content-length 16342 content-type image/webp
GET H2	200	w4dKN9Ed.webp clipcentric-a.akamaihd.net/file/1068964/ad_q75/1604705147/ Frame 60D0	15 KB 15 KB	235ms 231ms	Image image/webp	2.16.177.50 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://clipcentric-a.akamaihd.net/file/1068964/ad_q75/1604705147/w4dKN9Ed.webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.177.50 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Apache/2.2.34 / Resource Hash 9b4ca722833450a27d0f22918f250ba5882cadc1af54ac014d7c06f2b9805b1c Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Mon, 23 Nov 2020 18:56:31 GMT cache-control max-age=31536000 last-modified Fri, 06 Nov 2020 23:32:07 GMT server Apache/2.2.34 content-length 14862 content-type image/webp
GET H2	200	E=ls:load%20CBSi%20js%20file.0,li tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=98/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	340ms 99ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=98/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=ls:load%20CBSi%20js%20file.0,li Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:Super%20Billboard.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=119/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	390ms 150ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=119/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=ls:Super%20Billboard.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:hotspots%20collapsed.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=276/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	339ms 99ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=276/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=ls:hotspots%20collapsed.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:on%20scroll%20full%20collapse.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=277/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	388ms 148ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=277/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=ls:on%20scroll%20full%20collapse.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	E=ls:custom%20ad%20controls.0 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=293/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	390ms 151ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=293/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=ls:custom%20ad%20controls.0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	46ms 40ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1606157785741&de=647815772163&rx=76501015798&m=0&ar=a63e245-clean&iw=b2c8261&q=4&cb=0&cu=1606157785741&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A627%3A627%3A892%3A665&fs=186589&na=1077464110&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H3-Q050	200	gpt.js Show response www.googletagservices.com/tag/js/ Frame 7711	54 KB 18 KB	16ms 16ms	Script text/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: rev.cbsi.com URL: https://rev.cbsi.com/common/js/adKit.min.js?1071799592 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e37970414645d03fda1b2d9490b59ed026a54194e65a16044be51a69c8a1585f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "702 / 817 of 1000 / last-modified: 1606134076" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 18520 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	52ms 37ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=478&fi=1&apd=955&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=663724139586&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	56ms 42ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=478&fi=1&apd=955&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=663724139586&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	47ms 36ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=478&fi=1&apd=955&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=663724139586&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	46ms 41ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=506&fi=1&apd=983&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=663724139586&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	35ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=0&apd=28&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=647815772163&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	35ms 33ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=0&apd=28&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=647815772163&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	36ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=23&fi=0&apd=37&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=647815772163&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=9&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=759385320047&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=9&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=759385320047&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	38ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=22&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=759385320047&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	33ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=109460816361&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=109460816361&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	35ms 29ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=16&fi=1&apd=32&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330579524&S1id=23605329&S2id=23619609&ord=1606157790390&r=132027230877&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=16&fi=1&apd=32&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330579524&S1id=23605329&S2id=23619609&ord=1606157790390&r=132027230877&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	35ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=16&fi=1&apd=32&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330579524&S1id=23605329&S2id=23619609&ord=1606157790390&r=132027230877&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 684D Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	41ms 39ms	Image text/html	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:31 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 18AE Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	45ms 42ms	Image text/html	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:31 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame A647 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	40ms 39ms	Image text/html	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:31 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H2	200	E=ls:on%20scroll%20full%20collapse.1 tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=805/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	118ms 113ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=805/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=ls:on%20scroll%20full%20collapse.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:31 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 637A Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	40ms 40ms	Image text/html	2a00:1450:4001:806::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Mon, 23 Nov 2020 18:56:31 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/11253319325380860251/ Frame A647	31 KB 31 KB	58ms 51ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/11253319325380860251/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2b88380497b9347aff99bca5742fdcd5572e021a59b4f3f9c3477caaf76de35b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 17 Nov 2020 13:15:45 GMT x-content-type-options nosniff last-modified Fri, 11 Sep 2020 10:24:32 GMT server sffe age 538846 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31511 x-xss-protection 0 expires Wed, 17 Nov 2021 13:15:45 GMT
GET H3-Q050	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/10247368670396149040/ Frame A647	20 KB 20 KB	59ms 52ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/10247368670396149040/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qlPY2iaUapHNAvGzMrRT9878iFZCg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e879f510057a9402ebcd35912a42e45b3387f7a2a1c053a4b9794a512b2feca Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 07:10:52 GMT x-content-type-options nosniff last-modified Wed, 26 Aug 2020 06:41:17 GMT server sffe age 387939 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20480 x-xss-protection 0 expires Fri, 19 Nov 2021 07:10:52 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A647	2 KB 3 KB	37ms 30ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28053 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A647	295 B 389 B	64ms 54ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73470 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H3-Q050	200	12684587740497415278 tpc.googlesyndication.com/simgad/ Frame 18AE	86 KB 86 KB	54ms 13ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/12684587740497415278?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnA5k8IC0IdatMloSLhv0ap82Qwig Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1663907db200b373dc41f3246b81f6f0986c8334614cb81cf5a4eb62c2510fb2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 16:04:10 GMT x-content-type-options nosniff last-modified Thu, 19 Nov 2020 08:06:22 GMT server sffe age 10341 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 87771 x-xss-protection 0 expires Tue, 23 Nov 2021 16:04:10 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 18AE	2 KB 2 KB	38ms 8ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28053 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 18AE	295 B 320 B	38ms 8ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73470 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H3-Q050	200	15514801449903738019 tpc.googlesyndication.com/daca_images/simgad/ Frame 684D	11 KB 11 KB	54ms 13ms	Image image/jpeg	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/15514801449903738019?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw&rs=AOga4qnNHBhR3IkEc9QGTnb61QWei4Wv_w Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 14a1e76a9ba78a95d6c511248f2a79bd6443f9c03993ad159142d85d95551444 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 20 Nov 2020 17:08:33 GMT x-content-type-options nosniff last-modified Fri, 24 Nov 2017 04:35:02 GMT server sffe age 265678 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10863 x-xss-protection 0 expires Fri, 27 Nov 2020 17:08:33 GMT
GET H3-Q050	200	14809115904939601473 tpc.googlesyndication.com/daca_images/simgad/ Frame 684D	5 KB 5 KB	63ms 17ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/14809115904939601473?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qnXmJciPdEnHrK58bwJKGkcE4Bnyg Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ddd0bcff13c408522f5c353fe9692fc3bd051708e126a1dcfd783c4a79557064 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 21 Nov 2020 19:06:24 GMT x-content-type-options nosniff last-modified Sat, 25 Nov 2017 12:11:03 GMT server sffe age 172207 content-type image/png access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4785 x-xss-protection 0 expires Sat, 28 Nov 2020 19:06:24 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 684D	2 KB 2 KB	40ms 10ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28053 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 684D	295 B 320 B	106ms 70ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73470 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET H3-Q050	200	15605233287764909432 tpc.googlesyndication.com/daca_images/simgad/ Frame 637A	30 KB 30 KB	53ms 8ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/daca_images/simgad/15605233287764909432 Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e32c80d558f9cc1fd33467c892cf207d507efd12cebb380ed467c03d761dceb3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 19 Nov 2020 03:58:39 GMT x-content-type-options nosniff age 399472 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30385 x-xss-protection 0 last-modified Thu, 20 Aug 2020 12:10:39 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 19 Nov 2021 03:58:39 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 637A	2 KB 2 KB	47ms 11ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 11:08:58 GMT x-content-type-options nosniff server cafe age 28053 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Tue, 24 Nov 2020 11:08:58 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 637A	295 B 320 B	106ms 69ms	Image image/png	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Sun, 22 Nov 2020 22:32:01 GMT x-content-type-options nosniff server cafe age 73470 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Mon, 23 Nov 2020 22:32:01 GMT
GET DATA	200 OK	truncated / Frame 37A9	801 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2b526196d510bc11f40effba13f1b9e1792120b1f40b453695e8d7dcc05cf38d Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 60D0	0 22 B	1546ms 1486ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJ7prS3xgZ3iZ-UHFBedd23xiwDAvuuXgWMr2HKaYEz8kVyQaGa-Do6vAxqsFlrfOU9DTOGWNTRHHk2Q4TUD-UQT4wWgYpwLBuTHSnTzC0Gdv9Wi4hBYhhodK9Kh3XgB99teZJuW1wzb7uwLqROvHfVkeCyxWpDiJMG206T1WRBo80fXOLmwsp6kEL2m0gQmnbD55Iv7A140UIaCRDjGlj1DFI-LyEoavO2s028rhlP2n5q5iNdOlmyrH8IirjBpzH6FKNLJXhAZOBub5U&sai=AMfl-YSRrFwLjp56N1ETejMb-hQssuRUaNyWvBrH1KwNT8Rmc_6pbxdlJ-T7uXddxMoscSK7jYVtAHt8VJ9Xn5wLhOVKzgBS27DuiSHZphZEu06mWjOTUQH5sTkSFQmBT48&sig=Cg0ArKJSzDT6h6AR4BwOEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:31 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	41ms 38ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1606157785741&de=759385320047&rx=76501015798&m=0&ar=a63e245-clean&iw=b2c8261&q=5&cb=0&cu=1606157785741&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A627%3A627%3A892%3A665&fs=186589&na=546825111&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:31 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:31 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 36ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1010&tet=1342&fi=1&apd=1819&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=663724139586&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:32 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	39ms 39ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=814&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=109460816361&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:32 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	37ms 36ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=800&fi=1&apd=816&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330579524&S1id=23605329&S2id=23619609&ord=1606157790390&r=132027230877&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:32 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	E=wi tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=1551/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/ Frame 60D0	35 B 136 B	101ms 96ms	Image image/gif	34.206.120.154 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://tr.clipcentric.com/s/B=244/F=1068986/C=105721/P=22/A=105720/L=21/V=23/S=TOaLnfSR/Z=1/I=120.018764.1606157790683/U=www.zdnet.com/T=1551/M=i/D=d/PO=zdnet.com/LO=5536907755/VO=138330579524/E=wi Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.206.120.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-206-120-154.compute-1.amazonaws.com Software Apache/2.2.34 / Resource Hash 6c63cc5063ac82d8bbc925f9a31adf3a87f1510c021e0fde51854d60484b5019 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT cache-control no-cache server Apache/2.2.34 content-length 35 content-type image/gif
GET H2	200	pubads_impl_2020111701.js Show response securepubads.g.doubleclick.net/gpt/ Frame 7711	277 KB 98 KB	1725ms 1724ms	Script text/javascript	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software sffe / Resource Hash 68963209b16bd2a387c310495d51021d2fc57e5df9cb87ac98a0505c0daeca43 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:32 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 17 Nov 2020 09:43:24 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 99766 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	runner.html tpc.googlesyndication.com/sodar/sodar2/219/ Frame FBCB	0 0	51ms 17ms	Document text/html	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/219/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin content-length 4867 date Mon, 23 Nov 2020 17:55:11 GMT expires Tue, 23 Nov 2021 17:55:11 GMT last-modified Mon, 05 Oct 2020 22:33:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 3681 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	192ms 73ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=CBS_PREBID_HEADER1&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=11&f=0&j=&t=1606157785741&de=109460816361&rx=76501015798&m=0&ar=a63e245-clean&iw=b2c8261&q=6&cb=0&cu=1606157785741&ll=2&lm=0&ln=0&em=0&en=0&d=25365849%3A465723849%3A4676441751%3A138290752599&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&fd=1&ac=1&it=500&pe=1%3A627%3A627%3A892%3A665&fs=186589&na=546782442&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:32 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	135ms 74ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=864&tet=1338&fi=0&apd=1352&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25365849&L2id=465723849&L3id=4676441751&L4id=138290752599&S1id=uk-zdnet&S2id=security&ord=1606157785741&r=647815772163&t=iv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=0&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=0&zMoatPT=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:32 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	73ms 63ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=816&tet=1365&fi=1&apd=1381&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=67075449&L2id=2774809331&L3id=5536907755&L4id=138330579524&S1id=23605329&S2id=23619609&ord=1606157790390&r=132027230877&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=nav&zMoatPT=article&zMoatSL=nav-ad%3FT-1000&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:32 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:32 GMT
GET H2	200	v4 Show response btlr.sharethrough.com/	5 KB 2 KB	300ms 126ms	XHR application/json	52.58.195.54 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://btlr.sharethrough.com/v4?creative_key=DSSr9g43sPa2dfoW77fzAZrbJj&placement_key=8ec3a4f3&secure=true Requested by Host: native.sharethrough.com URL: https://native.sharethrough.com/assets/sfp.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.195.54 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-58-195-54.eu-central-1.compute.amazonaws.com Software nginx/1.18.0 / Express Resource Hash c2248428b4268cdb12a906b9f133c9db43304bf3ab0814442fa7a4790aa60db8 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:33 GMT content-encoding gzip server nginx/1.18.0 x-powered-by Express etag W/"12b1-kYMpBywdo/k+21VZrF6//8HSE5I" vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.zdnet.com access-control-allow-credentials true content-length 2144
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	37ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F11253319325380860251%2Fdownsize_200k_v1%3Fsqp%3D4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw%26rs%3DAOga4qngw5zs6rQKmhlqcFQxkZZ0oJOwfg&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=663724139586&rx=76501015798&cu=1606157785741&m=5568&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=0&ag=478&an=0&gf=478&gg=0&ix=478&ic=478&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=478&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=955&cd=0&ah=955&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=389771399&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	44ms 38ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F12684587740497415278%3Fsqp%3D4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4%26rs%3DAOga4qnA5k8IC0IdatMloSLhv0ap82Qwig&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=647815772163&rx=76501015798&cu=1606157785741&m=5584&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=76&vx=76%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=0&ag=14&an=0&gf=0&gg=0&ix=0&ic=0&ez=1&aj=1&pg=76&pf=0&ib=1&cc=0&bw=14&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=28&cd=0&ah=28&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=cc&zMoatJS=3%3A-&tc=0&fs=186589&na=982749153&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	38ms 37ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fdaca_images%2Fsimgad%2F15514801449903738019%3Fsqp%3D4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIrAIQnQEYASABLQAAAD8wrAI4nQFFAACAPw%26rs%3DAOga4qnNHBhR3IkEc9QGTnb61QWei4Wv_w&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=157&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=759385320047&rx=76501015798&cu=1606157785741&m=5591&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9&cd=0&ah=9&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=1270133212&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame 60D0	42 B 102 B	16ms 14ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstfmaOIzgxm7tKCeapJYLfJd35KkxXwgaamvfXqOM9Ohin5_5NzHO0jTU_fDXpIW2t04TaoGi_0dxSzqHs7qrFVDTFotdz43194tHFkfxU&sig=Cg0ArKJSzAxUdgEBxL87EAE&adk=2072725681&tt=-1&bs=1600%2C1200&mtos=1036,1036,1036,1036,1036&tos=1036,0,0,0,0&p=0,0,105,1600&mcvt=1036&rs=0&ht=0&tfs=1881&tls=2918&mc=1&lte=-1&bas=0&bac=0&met=ce&avms=nio&niot_obs=1263&niot_cbk=1479&md=2&btr=0&cpmav=0&lm=2&rst=1606157789653&dlt&rpt=3566&isd=0&msd=0&xdi=0&postrxl=1&ps=1600%2C9837&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-6-10-5-5-0-0-0&tvt=2910&is=1600%2C105&iframe_loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&r=v&id=osdim&vs=4&uc=6&upc=2&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201118 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	35ms 34ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fdaca_images%2Fsimgad%2F15605233287764909432&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=109460816361&rx=76501015798&cu=1606157785741&m=5609&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=186589&na=830661694&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	article9native.jpg static.sharethrough.com/creative_workflow/creative_thumbnails/441786/images/original/	64 KB 64 KB	588ms 479ms	Image image/jpeg	143.204.90.8 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://static.sharethrough.com/creative_workflow/creative_thumbnails/441786/images/original/article9native.jpg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.90.8 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-90-8.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 6e17c5ceb34d2adc57d2e11b054491e3b807ce15a7f1cc9472080088db403f96 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT via 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront) last-modified Wed, 08 Jul 2020 08:08:33 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "2899ac3d097b3369e7bd6ffa036d5781" x-cache RefreshHit from cloudfront content-type image/jpeg cache-control max-age=600 accept-ranges bytes content-length 65292 x-amz-cf-id qVsAwXm-QhofaqVGQ3K6sRl_SBW8-MiEB4lDZZ12yt0qnU973yfiMA==
GET H2	200	/ www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/	64 KB 64 KB	124ms 123ms	Image text/html	2a04:4e42:3::444 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::444 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 150675 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade last-modified Mon, 23 Nov 2020 18:21:30 GMT x-frame-options SAMEORIGIN date Mon, 23 Nov 2020 18:56:33 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" vary Accept-Encoding, User-Agent x-tx-id cc4101d5-d8a4-4576-8bb7-7c330ce1064a content-type text/html; charset=UTF-8 cache-control max-age=5400, private accept-ranges bytes expires Mon, 23 Nov 2020 19:51:30 GMT
GET H2	200	article9native.jpg str-assets.imgix.net/creative_workflow/creative_thumbnails/441786/images/original/	2 KB 2 KB	251ms 236ms	Image image/webp	2a04:4e42:1b::720 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://str-assets.imgix.net/creative_workflow/creative_thumbnails/441786/images/original/article9native.jpg?w=170&h=89&auto=format&fit=crop&dpr=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::720 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software imgix / Resource Hash b65333527a6b028a3bf672f4182050680c6933fd0d1a5026d9e8e94bb37d3135 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:33 GMT x-content-type-options nosniff last-modified Mon, 23 Nov 2020 18:56:33 GMT server imgix age 0 vary Accept, User-Agent x-cache MISS, MISS content-type image/webp access-control-allow-origin * cache-control public, max-age=600 x-imgix-id 7374b3c4cc81df9bd12fb04d5f8b261180a74919 accept-ranges bytes content-length 1582 x-served-by cache-sjc10076-SJC, cache-hhn4026-HHN
GET H/1.1	200 OK	butler b.sharethrough.com/	43 B 229 B	402ms 96ms	Image image/gif	54.84.220.128 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://b.sharethrough.com/butler?type=impressionReceived&arid=d-ba7c6cfa-6a40-40f2-9b16-748377baf805&pkey=8ec3a4f3&supplyId=kuSauEqV&tkey=bqSbBKSUnnhMPViET2buaJ7u&ckey=sfp-DSSr9g43sPa2dfoW77fzAZrbJj&vkey=DSaFwYXFYkfMG5NMCZuaiyYxLu&umtime=1606157793360&bootTime=9459.02&benchmarkBoot=495.40000036358833&butlerLatency=316.9&awid=72d7b2d2-9358-470b-8010-24cb96547dbe&sourceId=sfp&deal_id=undefined&action=clickout&isVast=false&bwidth=1600&bheight=1200&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%252F&renderEnv=top&version=gc-442-01444abc-eu Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.84.220.128 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-84-220-128.compute-1.amazonaws.com Software nginx / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:33 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx Connection keep-alive Content-Length 43 Content-Type image/gif
GET H/1.1	200 OK	butler b.sharethrough.com/	43 B 229 B	401ms 96ms	Image image/gif	54.84.220.128 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://b.sharethrough.com/butler?type=impression&arid=d-ba7c6cfa-6a40-40f2-9b16-748377baf805&pkey=8ec3a4f3&supplyId=kuSauEqV&tkey=bqSbBKSUnnhMPViET2buaJ7u&ckey=sfp-DSSr9g43sPa2dfoW77fzAZrbJj&vkey=DSaFwYXFYkfMG5NMCZuaiyYxLu&umtime=1606157793380&renderLatency=22.96&awid=72d7b2d2-9358-470b-8010-24cb96547dbe&sourceId=sfp&deal_id=undefined&action=clickout&isVast=false&pwidth=770&pheight=136&pxoff=215&pyoff=2406&twidth=170&theight=89&bwidth=1600&bheight=1200&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%252F&renderEnv=top&version=gc-442-01444abc-eu Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.84.220.128 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-84-220-128.compute-1.amazonaws.com Software nginx / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 18:56:33 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server nginx Connection keep-alive Content-Length 43 Content-Type image/gif
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame A647	42 B 66 B	51ms 50ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv4WermxVFpIcU53k254ZdSzhvdkDozOzMi_kaCrX_D_WKuwKU3lW-1vuAkJ9k8xxX0WIXp5Jlgp4KiWyLd-IM5c6-8ayS95BTX1myWipuJDciFJknHbhuse8ayqA&sai=AMfl-YSs6FwB6BApK0Yb6XJEDNpjEAXeUdU1pxOT4Iteq1aJxg8y_Nd2jbSBz80trnGtFh8mxYYMfawyPKcPRSikR1WlAZtg_VwqZtES8OWFsr3ajMbdaGfH0XLMGyDpSDE&sig=Cg0ArKJSzFbueTuoo8ShEAE&cid=CAASPeRobVg8JKJTY-HIGK_DYihDnd5QcYgwdMwK-I-58a7yO-FCcXoCvWrvjwVyr7I3ocwq09djAdNeKQ0j4sQ&id=ampim&o=315,465&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1017&mtos=0,0,0,1017,1017&tos=0,0,0,1017,0&tfs=1153&tls=2170&g=100&h=100&tt=2171&r=v&avms=ampa&adk=3581870410 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	85ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=663724139586&rx=76501015798&cu=1606157785741&m=6417&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=1&ag=1342&an=478&gi=1&gf=1342&gg=478&ix=1342&ic=1342&ez=1&ck=1342&kw=1010&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1342&bx=478&ci=1342&jz=1010&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1010&cd=955&ah=1010&am=955&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=548296637&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	32ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=193&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2638283940&L3id=5245653073&L4id=138316868599&S1id=23605329&S2id=23619609&ord=1606157790569&r=746537584554&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FT-1000&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	34ms 33ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=193&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2638283940&L3id=5245653073&L4id=138316868599&S1id=23605329&S2id=23619609&ord=1606157790569&r=746537584554&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FT-1000&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif cbsdfp5832910442.s.moatpixel.com/	43 B 253 B	33ms 30ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=252&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=51085689&L2id=2638283940&L3id=5245653073&L4id=138316868599&S1id=23605329&S2id=23619609&ord=1606157790569&r=746537584554&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=8b15401f-988e-4324-98b9-2cc9d6b77118&zMoatCURL=zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away&zMoatPS=top&zMoatPT=article&zMoatSL=sharethrough-top%3FT-1000&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	34ms 33ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=663724139586&rx=76501015798&cu=1606157785741&m=6418&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=1&ag=1342&an=1342&gi=1&gf=1342&gg=1342&ix=1342&ic=1342&ez=1&ck=1342&kw=1010&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1342&bx=1342&ci=1342&jz=1010&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1010&cd=1010&ah=1010&am=1010&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=2027329611&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	35ms 35ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=663724139586&rx=76501015798&cu=1606157785741&m=6423&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=1&ag=1342&an=1342&gi=1&gf=1342&gg=1342&ix=1342&ic=1342&ez=1&ck=1342&kw=1010&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1342&bx=1342&ci=1342&jz=1010&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1010&cd=1010&ah=1010&am=1010&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=1491639996&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	61ms 59ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=647815772163&rx=76501015798&cu=1606157785741&m=6904&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9877&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=76&vx=76%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=1&ag=1338&an=14&gf=0&gg=0&ix=0&ic=0&ez=1&ck=1338&kw=864&aj=1&pg=76&pf=76&ib=1&cc=1&bw=1338&bx=14&ci=1338&jz=864&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=864&cd=28&ah=864&am=28&rf=0&re=0&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=cc&zMoatJS=3%3A-&tc=0&fs=186589&na=1238005891&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:33 GMT
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame 18AE	42 B 553 B	16ms 16ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssjAU5JKvuDwEAKRNNTfGgoZwjIngIrvOnPI2Zs0JJX24jlP5XX7FcmZdzMFxI6UzEFbbGnzq7pEdYTkuuEwu6tvVJ7igMBJx1MzwDvjTP45V1jbFVTsaBLx4IR7g&sai=AMfl-YT0uAecNojgVAyAe1H7OjrJH0I4Io_PSLpI6JIV6wyglwrDAs-qnf09wHxHM3IXLdrI6M-1BmnJYw5dMfc8Xpgf_6-Ann_5PvzUFrIyvLorqfgbWsEOoUO7G5dIcJs&sig=Cg0ArKJSzBJmCW6FMfRLEAE&cid=CAASPeRomdqiv3fsz_1K1rW7DwKSxJK3GmtQ28YPRLYZwjkHm953SB6EqKS5_fn6CZF5jwfUnLEOPaDg4YM91_I&id=ampim&o=1050,745&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1003&mtos=0,0,1003,1003,1003&tos=0,0,1003,0,0&tfs=1728&tls=2731&g=75.83333253860474&h=75.83333253860474&tt=2731&r=v&avms=ampa&adk=1925781520 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 48 B	37ms 36ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020111701&jk=2886565102612226&bg=!mJulm7vNAAUoamvQKFgYvvKJdxra1QIAAAJ3UgAAAEpoAQcKAJeCodUoe0n9d_btTVmDTeYdHH5wbn7gRe7uhGbWIuphuYLy09WGLD55Wdv2SeaaBirqfkEjUlJbzOd8oUP6GWBFlcTwCz-m-UQagdwqMES_43ggzAo1m5NEYmr887NDnbvPcm_unDIlBtvEKSNgVcMTQ2yOOfqA69WhREEY9B828CfqBrPqWEdQPtSC3HXJeifbUreQFWnHmQHGj69cGKBArpupyeDLExV_Q14FxnIAhDethVQ5Btj7D-vjRDayMaS9e5-krCMmL1hGeBtS-nkUZ2jYMX6b3ZPrJ1nd-89SgHPvDNe10B88VHwVToFnhBcx8yXlL0RqVok5XJ7-A7BOWyGT_1Ga9thmDh5UVz1CpaWvvp4UpRhFRhCxL3TXRH2zxylDqNxRj6MqZNvO9BYYnwGndj0ljrydFM3PovI2SEBxMQ4O2FWAqtXVH2lW56MGM7jNrBOx4Bj-ZVPDi8zS7kely9fGv4g6apT9STI6LYR6V0y96Nl_2EKzLvLvBNcOFo9XIrRbmzMlNmEbSxsNpVmj2bxKZOqPr8P9QOfGvS0bwr-ZHhp23HcLScRAbG5GsYH7sXO3SbgEE_wlYiChH1bXGuEwlTzqgSpf9OT_f6pLWx7SwgJsLRKxgHkJvFqAyxv4Rb-_3c9X8pw71qaasQfqrGDjLGCFzivHmRzgeXq0NzSIT-1KZU5qhY4yntg5k61LUiAL6irembHi1T2xmoOWoCBN-94iBJZAWh7u83vxFZjAZa8mEFEpoZ-PCTrdmd7sQtq7-xju4uLjo7OwXMXqi_TwxtIvnc_JcmtwsQ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200 OK	NRJS-04e0f5db0886b3b33ff Show response bam-cell.nr-data.net/events/1/	24 B 489 B	145ms 144ms	XHR image/gif	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRJS-04e0f5db0886b3b33ff?a=450235099&v=1184.ab39b52&to=ZFMHbUMCXktYWxJZX10ZJFpFCl9WFlkURFlQWgBmQgpeX1Vd&rst=11020&ck=1&ref=https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1184.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 San Francisco, United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 content-type text/plain Response headers Date Mon, 23 Nov 2020 18:56:34 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Access-Control-Allow-Credentials true Connection keep-alive CF-Ray 5f6d1c654ebe32ab-CDG Content-Length 24 cf-request-id 0698101349000032abe2082000000001
GET H3-Q050	200	integrator.js Show response adservice.google.de/adsid/ Frame 7711	109 B 302 B	27ms 26ms	Script application/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	integrator.js Show response adservice.google.com/adsid/ Frame 7711	109 B 127 B	27ms 26ms	Script application/javascript	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:34 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 7711	0 23 B	24ms 24ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_ced&pvsid=3654951856602880&sc=t&level=slot&vrg=2020111701&nw_id=8264&nslots=1&eid=21068418%2C21068767%2C21068780%2C21068810&pub_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/ Frame 7711	17 KB 5 KB	130ms 103ms	XHR text/plain	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3654951856602880&correlator=4457523224894369&output=ldjh&impl=fifs&eid=21068418%2C21068767%2C21068780%2C21068810&vrg=2020111701&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201123&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Db%26subses%3D1%26ptype%3Darticle%26vguid%3D8b15401f-988e-4324-98b9-2cc9d6b77118%7Cenv%3Dprod%26session%3Db%26subses%3D1%26ptype%3Darticle%26vguid%3D8b15401f-988e-4324-98b9-2cc9d6b77118&cookie_enabled=1&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1606157794&dt=1606157794755&dlt=1606157789788&idt=4635&frm=23&biw=1600&bih=1200&isw=371&ish=771&oid=3&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&adks=3261246841%2C3261246840&ucis=djc5o9e39ie3%7Cl9q9hqy27lma&ifi=1&ifk=3555928426&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&dssz=13&icsg=10888&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&ga_vid=1160784049.1606157795&ga_sid=1606157795&ga_hid=749419050&fws=256%2C256&ohw=0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash 519e3af09203dec22133b49de1cdc48682c7263c9e07e714673772e48f7c20ee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:34 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4641 x-xss-protection 0 google-lineitem-id 4746066197,4746066197 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138239375540,138239479696 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html 6ff850c92d50d7d7ce2d0af088c43238.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 7711	0 0	138ms 37ms	Other text/html	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://6ff850c92d50d7d7ce2d0af088c43238.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html?n=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 7711	0 159 B	285ms 271ms	Image image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuI5Tl53t3EliZrOWmCw8WrkWIBJQ1BN3ICHYIwkJMmaAg2GJwxIbvTHsYLqO-op9yKulEubA9qa7AXz_suKtE6eS4P_0c4cnT6mt5u5FfD0WEo5J77V27fy5WqR3dw6s7pi8WMpBfz7x0k6-2JGVo9Y6Ela5cDgDXrMGjvxcKtkT_70cXjgRLafnumxr67wZ9pYkLoDuy4B_0L-80_Bxusf9Uhau-sjIJw01v_XLW5GAfMTy7CSyidrcJMweKnNzD5zXQX1iZviz8&sai=AMfl-YS92vLYUi80Vzp7ZzrePn_VVpqg07MyYGv8XVKNOuP5ZVdbj4q1xyINDy1LiG5yt7J7iPuEVSLQJ3bPXe-g9NwWWdB5XJvfQk4vYz0lVrsazf7F18eFFVY3dgaCR7c&sig=Cg0ArKJSzOiqm3ocFNzHEAE&urlfix=1&adurl= Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:34 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:34 GMT
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame 5F7C	0 0	785ms 784ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssy8icdNmZC7cPpp2YNrX5miYpSWqgg47Q3ZOPPo68LJzjj4cE9gkEwA7JBufBktHDQYa3OeHYrZyPc3pyHA5BfoqC_EVKHEYcPUBHzv3us0YD-QfpxSrR5d2tKbzbcyB3i1_SzXx5zcxXUH-4F48liTUNZPQNgz9Jma2uGHreWynm1c30H7YjHnUiInRSYbtw5A5t0_zS7B3DVlDc_SFmsutlP3n9EqH84c8QbH8tIZ-T65LDL0ztE1pdr_QvzqKiGwkFYiEHT&sig=Cg0ArKJSzL0xnAIyn0pxEAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 5F7C	103 KB 32 KB	44ms 41ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ae9daae5c7e9177b48cf7e63c72537535d98efdf02ed86021f4c780975ba57a8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702992033219" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 32299 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 5F7C	320 KB 107 KB	33ms 31ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38967 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame 23BE	0 0	755ms 754ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu2XpVYWZMjBDUlo0v0Vh4jR391-O0IsvdJItbi-dKqHn3_YXyeBI3W_ie2p5m-WiCaFxzEHSzuG5dd6DXpdtN1HituXkqafYE_iS25kerQolr1rBq-uDDY3ZpnjGxknorMEiNDmRpK_bRIz1saVz63DEVzHy37heuduMM9_ylBICP6PrGmgkQRkrl9WVn2hSfKLG9nojMEdK_uFdHFk0zbnHoGSBZJQ0FuhSXrW-xR1UIg9VCyoFZfcssYTaMVuVQQg37inrcP&sig=Cg0ArKJSzIQ8qJFUDrO6EAE&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 23BE	103 KB 32 KB	54ms 53ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ae9daae5c7e9177b48cf7e63c72537535d98efdf02ed86021f4c780975ba57a8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702992033219" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 32299 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H2	200	moatad.js Show response z.moatads.com/cbsdfp5832910442/ Frame 23BE	320 KB 107 KB	37ms 36ms	Script application/x-javascript	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/cbsdfp5832910442/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9291d9d87d61a0608d3a6b508cb92fa452e2ad612696a66716201dffdf968927 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip last-modified Mon, 09 Nov 2020 21:24:39 GMT server AmazonS3 x-amz-request-id A1A0B3F940F1DAC9 etag "6a6dcf414007d90f491fd34c0ded6f44" vary Accept-Encoding content-type application/x-javascript cache-control max-age=38967 accept-ranges bytes content-length 108768 x-amz-id-2 UR43//usmS5qM1+drhO+VGGwyXg2cnXCFBwLWVAMph1p2VgbAm2TDGDUM47RWoyL9kOfX+yVfbU=
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/ Frame 7711	73 KB 28 KB	51ms 49ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d56ee6a2ba915ad87e2dc9b49d9199563f3b35f9e048938e84d1a033e5c2b1c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1605702985553312" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28207 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H3-Q050	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 7711	8 KB 6 KB	23ms 21ms	XHR application/json	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020111701&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 8280dc602e14f99e840b7c314c299a0a8d8e25ff49e6a2cefc4afbebae1735d7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 6465 x-xss-protection 0
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 7711	16 KB 6 KB	17ms 16ms	Script text/javascript	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020111701.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 23 Nov 2020 18:56:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603823857801521" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6015 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 5F7C	0 0	170ms 130ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss1HcsBDCLKA1YDSljdJ6g5TSZcRAffOkk_H8TXlgdN1YUsp78ZKvc33jXhySuyBJc0Saawzl-tmMGwauBw74vrxcJPJufGo-THOnQT00sgSXSILGuyyvQgb7VdzsaW5VwHH0TcOAbQ5pkblh5tphigZJmD8ec7AFAXs3FDTEj_g5PBwytdtAXorNkTYcQn8wsj4DxhNrhd8jKNH4JBYrUrN8JZnYjnaPQtAltC16V-3zPwMz5UUYF6iiU-CnivOt4PTl85QRryLis&sig=Cg0ArKJSzCUV53uvFSK7EAE&urlfix=1&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 23BE	0 0	160ms 130ms	Fetch image/gif	216.58.206.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstmSPZqU0olvcke2IZygmJwgMf_E_1lx1FlptWV9pCrx8UkFduylXVVf0ecXEubKp_TRVaEAPPS5z-DWTuonNeZRYANJuSpb_DaP8ju76kl3zz2Ry6uQdhR7Pcft7LZqGsbrs-AAJRBtdM1oBkNoqlmMHIt9DkLT89B3CdKNWwGGefk5l2Ac1iHIu69vt6TLmLZZoY9wdeoSfL16ZkcCg2BgRlE2g3jszzqY9AIWEKLza_H3k-Pu_8XjyfrZMwe1De_Xp8E_E9NoQ8&sig=Cg0ArKJSzH6agsWOT7B6EAE&urlfix=1&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s20-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Mon, 23 Nov 2020 18:56:35 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H3-Q050	200	runner.html tpc.googlesyndication.com/sodar/sodar2/219/ Frame 84E7	0 0	21ms 19ms	Document text/html	2a00:1450:4001:81e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/219/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin content-length 4867 date Mon, 23 Nov 2020 18:35:53 GMT expires Tue, 23 Nov 2021 18:35:53 GMT last-modified Mon, 05 Oct 2020 22:33:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1242 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	50ms 44ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=248&w=474&rm=1&fy=1&gp=1&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=663724139586&rx=76501015798&cu=1606157785741&m=10103&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1&lb=9988&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=1&ag=5030&an=1342&gi=1&gf=5030&gg=1342&ix=5030&ic=5030&ez=1&ck=1342&kw=1010&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5030&bx=1342&ci=1342&jz=1010&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5265&cd=1010&ah=5265&am=1010&rf=0&re=1&ft=469&fv=0&fw=469&wb=2&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=186589&na=617102588&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:35 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:35 GMT
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 7711	0 23 B	16ms 15ms	Image image/gif	2a00:1450:4001:816::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020111701&jk=3654951856602880&bg=!bm2lbU3NAAVGySeIRliwKXVv0q2aMgIAAAHSUgAAACZoAQcKAT1nNlPeTzGPAzwgfuExCPBQ-IU_X3zNb78n7pysWJk51NKTh5heayo0pPZWAST0KoTIOffXEpyTj_FCSznZD_U0yz_WVtaOvazz4sWrlZqCr2_TWbTlJHjggjzmTigigs-GLyIXMYmrtpoFSWdL1QnnN_rNdy0TzY-7V1IdZUhWaPN4wp7O3xb5cKlMvHuWNfANxR7tHXAKzyaS4P1_71ywhbsi33uOle4aXktTTgqRmzAyc9qVVrjo9P7Of8d8-upyvXstzhC6orKXKhUbOcDpV3MZW_pWKNfQr1xyxyZZ9DeN5CC5FD-2oNsGgINU-FYqy7mMDEH8PEuaQOyWiwb6H9mdcJ_7q-XuS7UzM4boDeDlHQDCxOUlLt2Z-Pt4re9ziyVWpSDGvD6iTzjo0VZS3_iOLYbWq_WS9pPVzJkBvHzHSi7gQsQSy-1lhJ8AT8QVqa88qW6LKcUynOKh7JdB0AtUz1RCf017pPS94ijW_4BfUDrIya3Ki-Mf3-XYG_mcRcfGWdBk4xhTheC6Oq-kVjI40AM9BzW9YHr6p-KF9kgF23sH1Zk06E6PM4zy9g5E-ZYhB7NmMgiMTJjwR9uUZafl6OSHXTXxwF8-NMgFicQhMJcI2LW3vlO854fgxRkErXw7jD2fvrV7L8qLQ8a_j74cOGcTXiSUeTHdr2Fab3p_MFGsCiWTOjaFPzEPU5xmzCMFGqWMS-6URsQqbExjX9u5d_CFVoLp2RGnrQb3i8NR5xnUdlY6mdRELzexiKrvhTqcwCvWXHK6UiLX7ssupEhfBbipizrUIehF_AJynSEyHIY1HpxXMyxT4YyK1ZvCJ6iyHV3avbIVlYDVjV6IPSUkBwSgVZWsWoQUQFsdHvnA41SOb48soX6HUBX8ZqdTseX14T2-wX02HGcmF8YHtoY1RlUS2vpgvjYJ1rl7T0S5w58gp_h9xqM666KoBfgt5ilHrykj_n5W4Aj60QnYh4JMhSkcM4QL1XvN1DeNtSD02-54zSQSvn5ESg Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:36 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 253 B	32ms 32ms	Image image/gif	104.111.216.96 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&zMoatAdUnit1=uk-zdnet&zMoatAdUnit2=security&wf=1&vb=8&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=CBS_PREBID_HEADER1&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=1634153949&tf=nMzjG---CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbGBC4ehueB57NG9aJeRzBqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&pcode=cbsprebidheader506831276743&ql=&qo=0&vf=1&vg=100&bq=11&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fthe-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away%2F&id=1&ii=4&f=0&j=&t=1606157785741&de=647815772163&rx=76501015798&cu=1606157785741&m=10753&ar=a63e245-clean&iw=b2c8261&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=9988&le=1&lf=309&lg=1&lh=166&ch=0&vv=1&vw=1%3A0%3A0&vp=76&vx=76%3A-%3A-&pe=1%3A627%3A627%3A892%3A665&as=1&ag=5187&an=1338&gf=0&gg=0&ix=0&ic=0&ez=1&ck=1338&kw=864&aj=1&pg=76&pf=76&ib=1&cc=1&bw=5187&bx=1338&ci=1338&jz=864&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4999&cd=864&ah=4999&am=864&rf=0&re=1&ft=1118&fv=0&fw=1118&wb=1&cl=0&at=0&d=25365849%3A465723849%3A4676441751%3A138290752599&bo=uk-zdnet&bd=security&gw=cbsprebidheader506831276743&zMoatAType=content_article&zMoatTest=zdnet&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=cc&zMoatJS=3%3A-&tc=0&fs=186589&na=128740473&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-216-96.deploy.static.akamaitechnologies.com Software Apache / Resource Hash Request headers Referer https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Mon, 23 Nov 2020 18:56:36 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server Apache etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 23 Nov 2020 18:56:36 GMT