www.zdnet.com Open in urlscan Pro
2a04:4e42:4c::666  Public Scan

20 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 128

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 145

• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1

Request Chain 146

• https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
• https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbnRFmpBB20p6UTNOxOmoAAA HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1

Request Chain 147

• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
• https://ib.adnxs.com/setuid?entity=101&code=CAESEGr8W9CYsBi7CCfEeRCu4wM&google_cver=1 HTTP 307
• https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGr8W9CYsBi7CCfEeRCu4wM%26google_cver%3D1

Request Chain 148

• https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
• https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg2NDE5Mjg2Nzc2Nzc0OTI1OQ%3D%3D

Request Chain 187

• https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pibfvkc51 HTTP 302
• https://jyx5ahqxg6q4synz2elq-pibfvk-3c24126f3-clientnsv4-s.akamaihd.net/eum/results.txt

Request Chain 188

• https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pibfvkc51 HTTP 302
• https://fiaqj6abkaqaqkqce3ygyaaaabq3tuiy-pibfvk-f3244754b-clienttons-s.akamaihd.net/eum/results.txt

190 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/	229 KB 92 KB	311ms 277ms	Document text/html	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 268214f6762da533afd83cbb96b7a0b00333e6811aa34daee4e217fbe44eedde Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" link <https://www.zdnet.com/a/fly/css/core/main-974623586b-rev.css>; rel="preload"; as="style"; nopush referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id d059cd62-94a6-47ec-9501-dd3a494552ad x-xss-protection 1; mode=block date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 varnish cache-control max-age=5400, private expires Wed, 15 Dec 2021 12:56:28 GMT strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent content-length 93380
GET H2	200	main-974623586b-rev.css www.zdnet.com/a/fly/css/core/	304 KB 52 KB	11ms 10ms	Stylesheet text/css	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/core/main-974623586b-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash be847a5e8bf2c6b967e15a38e09258e75228250529e4038d995fe07fab8e5f26 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 53406 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 20:22:42 GMT server ContentServer x-frame-options SAMEORIGIN etag "a781901d3b891cdaab963419597dfb25" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 20:24:30 GMT
GET H2	200	inlineMedia_core.js Show response static.myfinance.com/widget/	184 KB 63 KB	97ms 70ms	Script application/javascript	2606:4700:3030::ac43:b431 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia_core.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c2898711aa44688968b5769b7ca3a50be196c4897657ab6ce34f215b07f455d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 663 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id HHSJP7534EDWQCG3 x-amz-id-2 Ko19KzwjZiLsOj2lCJFOTqS9WvYxwFid2E6CS14yXQmbV0jEqPWA5XNNGBZenh2WKw8BnJJ41h4= last-modified Thu, 09 Dec 2021 19:58:40 GMT server cloudflare etag W/"874805badaa992bae7fba35738ee6edc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6JpXAF9DwFdDA2%2F4KULmiOI1IjRrADVvpKtroko7eRqIbKDTBHin7N3GnuMM%2FcEgQPCBL9OFqcEEwy5Qusk0A%2BVtzp%2FkJ150lBGIdsEErY%2BF944sP8dXWhfwfxhBuu0EexJjuUrSBdyBuZgQEuZdGp82g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript vary Accept-Encoding cache-control max-age=14400 cf-ray 6bdf52615fa1697f-FRA
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	19 KB 7 KB	49ms 20ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4d2a74d8b25e1ccd4b1294b0b937804bc24aeea7f46edad3f3c1f91604d2708c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 BXRr8anumVFsMvgN5QlueA== age 8074 vary Accept-Encoding content-length 6508 x-ms-lease-status unlocked last-modified Mon, 13 Dec 2021 20:19:26 GMT server cloudflare etag 0x8D9BE75DC2F7AD9 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 63169a6a-f01e-006a-1a66-f0844d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bdf52611fc24e55-FRA
GET H2	200	optanon-v1.1.0.js Show response www.zdnet.com/a/privacy/optanon/	36 KB 10 KB	10ms 9ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 10444 x-xss-protection 1; mode=block last-modified Thu, 04 Mar 2021 19:22:21 GMT server ContentServer x-frame-options SAMEORIGIN etag "46e2aa30cbebb708b5fc468d57d56d8b" strict-transport-security max-age=31536000 content-language en via 1.1 varnish cache-control public, max-age=86400 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type application/javascript expires Thu, 18 Nov 2021 07:05:01 GMT
GET H2	200	controls-2157f66332-rev.css www.zdnet.com/a/fly/css/video/htmlPlayerControls/	25 KB 4 KB	10ms 9ms	Stylesheet text/css	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-2157f66332-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 1268ebc82a331bdf7b30636e4d2f0e70005a76c1c7f7b126dc278fc0a6e98439 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 4313 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 20:22:44 GMT server ContentServer x-frame-options SAMEORIGIN etag "536420a8e313cc35e7aac9f99f8f8ac5" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 20:24:31 GMT
GET H2	200	inlineMedia.css static.myfinance.com/widget/	3 KB 2 KB	72ms 69ms	Stylesheet text/css	2606:4700:3030::ac43:b431 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 530 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id RM9EMK8GHMB7NW7G x-amz-id-2 rO4/tb/v63P6c/qJxa0JBYiRUj2pmFCIHFUoYyKlU+xVn/UKNLDsHpQEB0iQ2jT47cP+krHxRTQ= last-modified Mon, 12 Jul 2021 14:22:18 GMT server cloudflare etag W/"528a38ce39fc58a866c1226253bbb189" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0zcFaT5Bve1oOU3Zh2z40IFt1JLaQ0o97B53aQWEAp1mUiyjRnbWQPHBimlOSpTP5sRhNI9MiL%2BscZjCPlkwHSwpCj1oz3NU%2BSABCoFJDH2sU6RIXC%2FhUgXBszQEnev7%2BerltLLMIYKnxrJoRObJJIpHaQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css vary Accept-Encoding cache-control max-age=14400 cf-ray 6bdf52615fa7697f-FRA
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame 0C93	205 KB 50 KB	249ms 22ms	Script application/javascript	2a02:26f0:ef:288::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:ef:288::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:16 GMT Content-Encoding br Last-Modified Thu, 14 Oct 2021 03:09:47 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 50393
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	headshot-2.jpg www.zdnet.com/a/img/resize/f0bbe46eb924a42c2089410d297965cfcf5caf8a/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/	640 B 889 B	11ms 11ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/f0bbe46eb924a42c2089410d297965cfcf5caf8a/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/headshot-2.jpg?width=50&height=50&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 390f3fdc72e993d038e98d93fe33da4e69352543996f53cf64d51f874033bac8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 varnish fastly-io-info ifsz=28670 idim=280x280 ifmt=jpeg ofsz=640 odim=50x50 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638183284258 fastly-stats io=1 content-length 640 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "30tCV37TZpEekDE4q+VB0E2jr0qSpSHoYpgXeHEbnNM" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Mon, 06 Dec 2021 01:40:22 GMT
GET H2	200	headshot-2.jpg www.zdnet.com/a/img/resize/3b698b059a0b6f3de3d965c35f085ecfb983f2be/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/	958 B 1 KB	11ms 11ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/3b698b059a0b6f3de3d965c35f085ecfb983f2be/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/headshot-2.jpg?width=70&height=70&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash be4f0a635682a22c9abf3684f48086f9fcba76da5a31b8e0c598375e65c42be3 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 varnish fastly-io-info ifsz=28670 idim=280x280 ifmt=jpeg ofsz=958 odim=70x70 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638183284258 fastly-stats io=1 content-length 958 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "PAlFLl1omnYqeAy+Vf5j9K6Z8BJouLnIzRVuN589oYw" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Mon, 06 Dec 2021 01:40:22 GMT
GET H2	200	require-2.1.2.js Show response www.zdnet.com/a/fly/js/libs/	16 KB 6 KB	9ms 9ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 16:01:53 GMT server ContentServer x-frame-options SAMEORIGIN etag "ef4ea9601b2a10c6fa6a76408a1d97b4" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 18:20:59 GMT
GET H2	200	Semibold.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	7ms 7ms	Font font/woff2	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 varnish vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:29 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 16 Nov 2022 18:20:56 GMT
GET H2	200	Regular.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	8ms 8ms	Font font/woff2	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 varnish vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:30 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 16 Nov 2022 18:20:56 GMT
GET H2	200	logo.png www.zdnet.com/a/fly/1639513189-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	10ms 9ms	Image image/png	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1639513189-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-974623586b-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-974623586b-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish last-modified Tue, 14 Dec 2021 16:01:59 GMT server ContentServer x-frame-options SAMEORIGIN date Wed, 15 Dec 2021 11:27:16 GMT vary Accept-Encoding, Accept content-type image/png cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 4105 x-xss-protection 1; mode=block expires Tue, 21 Dec 2021 20:12:07 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	40ms 20ms	XHR application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 xkIaWO5Hr0+rNu9IdoYHdw== age 7692 vary Accept-Encoding content-length 1425 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:53 GMT server cloudflare etag 0x8D94223473B0939 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6b7a330a-601e-004d-2d15-b61e04000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bdf5261abda4e26-FRA expires Wed, 15 Dec 2021 15:27:16 GMT
GET H2	200	main.default.js Show response www.zdnet.com/a/fly/65214c-fly/js/	223 KB 70 KB	8ms 8ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 56e69679f1bb212e6a9c1940392932c8d44e08a4cc9e4b3eacd29a561fbd2615 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 71762 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 20:22:32 GMT server ContentServer x-frame-options SAMEORIGIN etag "843a0d625c2fa08f823d8fd463ec7635" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 20:24:32 GMT
OPTIONS H2	204	record a.myfidevs.io/ Frame	0 0	349ms 111ms	Preflight	34.224.146.121 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.224.146.121 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-224-146-121.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,x-api-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods POST access-control-allow-headers * server Python/3.7 aiohttp/3.7.4.post0
OPTIONS H2	200	v1.5 www.myfinance.com/api/au/ Frame	0 0	726ms 703ms	Preflight text/html	2606:4700:3030::ac43:b431 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUva2hvbnNhcmktcmFuc29td2FyZS1pcmFuaWFuLWdyb3VwLW5lbWVzaXMta2l0dGVuLXNlZW4tZXhwbG9pdGluZy1sb2c0ai8= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-type text/html; charset=utf-8 vary Origin access-control-allow-credentials true access-control-allow-origin https://www.zdnet.com access-control-allow-headers x-requested-with, content-type, accept, origin, authorization, x-csrftoken, x-api-key, Access-Control-Allow-Origin access-control-allow-methods DELETE, GET, OPTIONS, PATCH, POST, PUT access-control-max-age 86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KV9%2BPcXSvU8oCIhCPjWxHpHmLRb8aBiqNQuoNSIYiXv79VIN3NAqoQxAmYLLoMo1k80EdJRz8yQjquMVITZPMqLaHlFDxDL33f8mYFTv5%2BdCjPJF3rZ20MOfipSIlTcjPWluMALrsvpeSV2OcFi71g%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15552000 x-content-type-options nosniff server cloudflare cf-ray 6bdf5261f8764a6e-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
POST H2	204	record Show response a.myfidevs.io/	0 166 B	136ms 136ms	XHR text/plain	34.224.146.121 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.224.146.121 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-224-146-121.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 x-api-key yuH27H1QId6afXAojow6Tafi7Vw9v1spaLD5Yznw Content-Type application/json Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true server Python/3.7 aiohttp/3.7.4.post0 access-control-allow-headers * access-control-allow-methods POST
POST H3	200	v1.5 Show response www.myfinance.com/api/au/	1 KB 1 KB	496ms 483ms	XHR application/json	2606:4700:3030::ac43:b431 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUva2hvbnNhcmktcmFuc29td2FyZS1pcmFuaWFuLWdyb3VwLW5lbWVzaXMta2l0dGVuLXNlZW4tZXhwbG9pdGluZy1sb2c0ai8= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:b431 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fdf0338ec44ad555b3528900511ac68afab2b2bb7791207c684df14781bd7f49 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-type application/json alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 allow POST, GET server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vlhArRdhO3MAq5F3PyhNlU4OBilkhFoMe4rtCn7%2BAqJPkXYyZ%2BOEF51DkyQp0OtlNg%2FNp9UvD0xM3N8eCCM77Kipcbak0dJUus14rgDsWKnbxFWN5ttOnaXpxX%2FPYqMXLvZ0WvZLABN2CLo0npqXPg%3D%3D"}],"group":"cf-nel","max_age":604800} content-language en-us access-control-allow-origin https://www.zdnet.com vary Accept, Accept-Language, Origin, Cookie cache-control max-age=0, no-cache, no-store, must-revalidate access-control-allow-credentials true cf-ray 6bdf52667d265c9e-FRA expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	164 B 373 B	48ms 23ms	Script text/javascript	2606:4700:10::6814:b844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 6bdf5261fea7701b-FRA
GET H2	200	bidbarrel-zdnet-rv.min.js Show response at.adtech.redventures.io/lib/dist/prod/	607 KB 177 KB	30ms 10ms	Script application/javascript	151.101.130.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/dist/prod/bidbarrel-zdnet-rv.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 6c0cd7b80611259d4ccce9165e8b5dd062aad43e3e3e19a404fe967c49795d03 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 9810d82af8847b51b9c3048141069a65.cloudfront.net (CloudFront), 1.1 varnish age 187 x-cache Hit from cloudfront, HIT content-encoding gzip content-length 180330 x-served-by cache-fra19156-FRA last-modified Thu, 28 Oct 2021 17:15:17 GMT server AmazonS3 x-timer S1639567637.813407,VS0,VE1 etag "873be44731952ce6844f825d0be702dd" vary Accept-Encoding, Origin content-type application/javascript cache-control max-age=900, public, must-revalidate x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id HyiAQGNAqqJGI4e11n2jarWqUb7ylPNbZBXhgr4lvZOxr4jfBjGfQQ== x-cache-hits 1
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	154ms 118ms	Script application/javascript	34.120.203.121 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.203.121 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 121.203.120.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT via 1.1 google last-modified Tue, 12 Jan 2021 17:00:48 GMT etag "5ffdd5c0-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H2	200	mpulse-1.0.2.js Show response www.zdnet.com/a/fly/js/libs/	61 KB 12 KB	8ms 7ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/mpulse-1.0.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Mon, 13 Dec 2021 22:34:51 GMT server ContentServer x-frame-options SAMEORIGIN etag "148d7e6acc80b32c08a3cbf8e3164307" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 05:39:11 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	266ms 212ms	XHR application/json	2a02:26f0:ef:288::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1639567636820&s=65427aeb0208f9f5b396047a4b4e1d94195e91e520c15b7bb03f3f5c586588f7 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:ef:288::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 9c8e31b33a1866b522d68bcb6425a9352667a4e18ffb79817ac11eb392a73e9c Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:17 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 817
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.20.0/	376 KB 84 KB	18ms 17ms	Script application/javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jOOTzA5W9ewbfwCUPpt/mw== age 4965585 vary Accept-Encoding content-length 86053 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:48 GMT server cloudflare etag 0x8D941124BEC2620 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id b5562596-701e-0174-096c-c418f5000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bdf526239d14e55-FRA
OPTIONS H2	200	diff at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame	0 0	163ms 147ms	Preflight text/html	151.101.130.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context f6c4d805d9208131acacc7a3c6fb128c server Google Frontend accept-ranges bytes date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish x-served-by cache-fra19171-FRA x-cache MISS x-cache-hits 0 x-timer S1639567637.911018,VS0,VE138 vary Accept-Encoding, Origin content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/	168 KB 33 KB	33ms 8ms	Script text/javascript	151.101.129.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.129.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 82527e4b52260341c34f496151fa24bedc8aafec48906007f7a354ca1235b024 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:16 GMT Content-Encoding gzip Age 2181 X-Cache HIT Connection keep-alive Content-Length 33325 x-amz-id-2 IcCnmPYUyivS2HOGFWyZ8RxuRHVRkp1wzGUzq3sjnz/svvjU/a7lcLP+xmy7UPUoDPEtw59EWGs= X-Served-By cache-fra19137-FRA Last-Modified Wed, 15 Dec 2021 10:40:35 GMT Server AmazonS3 X-Timer S1639567637.897678,VS0,VE0 ETag "1f0ac2121498b729930f96095342fb28" x-amz-request-id RM0P80G5J29KNHX4 Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 32
GET H2	200	diff Show response at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/	26 KB 3 KB	11ms 11ms	Fetch application/json	151.101.130.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash b8a17ddcc1b2d843e901f25a8f03437d056fd9524567808fcd9bb2cd2fda6a9b Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers cat 5zTciER5s Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Accept application/json Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ variant core version rv2.25.6 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff age 560 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 2716 x-xss-protection 1; mode=block x-served-by cache-fra19171-FRA access-control-allow-origin * server Google Frontend x-timer S1639567637.058722,VS0,VE0 x-frame-options SAMEORIGIN date Wed, 15 Dec 2021 11:27:17 GMT x-download-options noopen vary Accept-Encoding, Origin content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context c92d69bac2955c7a95d5e55dd8ed4b63 cache-control max-age=900 etag W/35afc89a94a709fa54db8726ad4ad8e0bdc593b4 accept-ranges bytes access-control-allow-headers * x-cache-hits 5
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	78 KB 27 KB	45ms 18ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 1907478e8fa62801a1db26be87cab0755288131c9c8e80320582e560825df3cc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1071 / 634 of 1000 / last-modified: 1639397097" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26912 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Wed, 15 Dec 2021 11:27:16 GMT
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/	93 KB 20 KB	17ms 17ms	Fetch application/x-javascript	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 AlmWtxV11YCExQkuyz0PJA== age 7602 vary Accept-Encoding content-length 20136 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:59 GMT server cloudflare etag 0x8D942234AE979B3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 04e26c27-701e-00bc-7615-b6cf97000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bdf5262bdd54e26-FRA expires Wed, 15 Dec 2021 15:27:16 GMT
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/	189 KB 61 KB	9ms 9ms	Script application/javascript	151.101.129.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.129.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 80da370ad41bee2716b42d1583e139eac39f5c7c243c5fe6439b9754013116c6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:16 GMT Content-Encoding gzip Age 50 X-Cache HIT Connection keep-alive Content-Length 61460 x-amz-id-2 mhjLBwq4ofP4Ht18aFXJwavbMA7sAA+j53tdu5a+bQynUB9jggNi8MPZBXPh5JJbJapjzT+KHSM= X-Served-By cache-fra19137-FRA Last-Modified Thu, 02 Dec 2021 17:00:39 GMT Server AmazonS3 X-Timer S1639567637.923327,VS0,VE0 ETag "0bad6e8b774e2623401e436c2a44f48e" x-amz-request-id K526S02KR1DXHTEX Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 26
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame 0C93	2 KB 1 KB	223ms 187ms	XHR application/json	2a02:26f0:ef:288::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5465225&v=1.720.0&if=&sl=0&si=b21f5e6a-8d82-4373-89e3-0eec2eb2024e-r45mhg&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:ef:288::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash cbb0cc3c9c0b141b99b6158e8b4725757b35c0e0dd6e4a43f79e2e69e8208489 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:17 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 871
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.20.0/assets/	13 KB 3 KB	15ms 15ms	Fetch application/json	2606:4700::6810:9540 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 15 Dec 2021 11:27:16 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OL7qnwFOarng5AW29V9Pw== age 4965560 vary Accept-Encoding content-length 2950 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:42 GMT server cloudflare etag 0x8D94112485FC2D3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id 84c52ef2-f01e-0048-626c-c4ea7b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bdf5262fe4e4e26-FRA
GET H2	200	pubads_impl_2021120601.js Show response securepubads.g.doubleclick.net/gpt/	348 KB 117 KB	22ms 21ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 119476 x-xss-protection 0 last-modified Mon, 06 Dec 2021 09:34:20 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Wed, 15 Dec 2021 11:27:17 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 153 B	34ms 17ms	XHR application/json	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 12717f96c61a500136a8564d666db9b960869a71dd3176a438b53fb08be5c7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128 x-xss-protection 0 expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	cohesion-latest.min.js Show response cdn.cohesionapps.com/cohesion/	77 KB 22 KB	41ms 11ms	Script text/javascript	18.66.139.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-139-69.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 6d5246d5f81b078b8d850b3fbe4ac7c44d05c0755ea14786c6fee453e6805fff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Tue, 14 Dec 2021 17:07:20 GMT content-encoding gzip last-modified Tue, 14 Dec 2021 17:07:13 GMT server AmazonS3 age 65998 etag W/"9f7be06169d1d8c9558378c9b8f53586" vary Accept-Encoding x-cache Hit from cloudfront x-amz-version-id null via 1.1 760a29e891ec10bba1274911260e1fc9.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 content-type text/javascript x-amz-cf-id Y3mtfYwUO7UCeLkk4V8xnCCLIKxcwWNkV4VdUGHHy4xc_1yhXOLKYw==
GET H2	200	article-6ebc50982c-rev.js Show response www.zdnet.com/a/fly/js/pages/	102 KB 26 KB	9ms 8ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/pages/article-6ebc50982c-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 5b6e97cf069d0d1a67390ad12ef50237963c77addfd1c8f15399b916993dd143 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 26736 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 15:00:39 GMT server ContentServer x-frame-options SAMEORIGIN etag "077e6dbcc2328e1aabe9b3b472aa6e18" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 15:23:17 GMT
GET H2	200	moatheader.js Show response z.moatads.com/redventuresgamheader644747280705/	240 KB 82 KB	36ms 18ms	Script application/x-javascript	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash ba5c9b5823ef1377da70e73357b85ef2dca7ade9afe70c93d0aa163c61c9bf03 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip last-modified Thu, 02 Dec 2021 16:10:34 GMT server AmazonS3 x-amz-request-id DG2H92XYZRQZ4RSV etag "33d2b31f29685690d6e2e3d016555f04" vary Accept-Encoding content-type application/x-javascript cache-control max-age=11875 accept-ranges bytes content-length 83699 x-amz-id-2 TnGeV4HtYB4NVPsPbHr+b5g34xbNmb7VjpQ7zI9/ywXjEabCjusxmRc+mMFbdi/bypbtdhI7jN0=
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	334ms 105ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	332ms 104ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	328ms 105ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	327ms 105ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	325ms 105ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	124ms 122ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 9added75b026790d386ad86510ffbd9354f408bff4aff4131cbc011890b95978 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	117ms 114ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash a6c60cce918035d292eac177aca4b0a0ae0baa236a43b5cece9ac0407e312023 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	119ms 118ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 5e19462c84cbab4bea0936427ad2e7514cd7fc3c4aae8324c95d9197e55b5000 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	134ms 132ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 441039500e27e5475cfb803777b74f9840d772836123e456cee380b36eb39516 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	120ms 118ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash 52518185ec61ff25c7a91bc46cd68423db51fa5a9ade2f239f8103ec51171c73 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H2	200	xs1.html Show response cdn.cohesionapps.com/cohesion/ Frame 4A5C	2 KB 1 KB	10ms 8ms	Document text/html	18.66.139.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs1.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-139-69.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Response headers content-type text/html date Tue, 14 Dec 2021 17:07:28 GMT last-modified Tue, 14 Dec 2021 17:07:14 GMT etag W/"10b2c1751c2247b1aeccc91060f971cf" x-amz-server-side-encryption AES256 x-amz-version-id null server AmazonS3 content-encoding gzip vary Accept-Encoding x-cache Hit from cloudfront via 1.1 760a29e891ec10bba1274911260e1fc9.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 x-amz-cf-id nXtMysbcgbznBkg_J8hAI3qpTSSHg4Ki3btLgRIlZTHA23W1jt5Zxw== age 65990
GET H2	200	public Show response taggy.cohesionapps.com/implementations/	8 KB 8 KB	103ms 103ms	XHR application/json	3.222.76.241 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://taggy.cohesionapps.com/implementations/public Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.222.76.241 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-222-76-241.compute-1.amazonaws.com Software / Express Resource Hash 1057d5fd733028374c07f587279e61230771eddfd056ce12fb75492fd1224ffd Request headers Source-Key src_1kYsAcdpfzbZ8UlNLYht1RPg3m2 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Page-URL https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/#ftag=RSSbaffb68 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT x-powered-by Express etag W/"202f-WDoQOp1rO0z7TI9x4+12ERK4udk" content-length 8239 content-type application/json; charset=utf-8
OPTIONS H2	204	public taggy.cohesionapps.com/implementations/ Frame	0 0	332ms 104ms	Preflight	3.222.76.241 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://taggy.cohesionapps.com/implementations/public Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.222.76.241 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-222-76-241.compute-1.amazonaws.com Software / Express Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers content-type,page-url,source-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT x-powered-by Express access-control-allow-origin * access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE vary Access-Control-Request-Headers access-control-allow-headers content-type,page-url,source-key
GET H2	200	integrator.js Show response adservice.google.de/adsid/	107 B 792 B	71ms 17ms	Script application/javascript	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 549 B	62ms 17ms	Script application/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	48 KB 11 KB	445ms 444ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3841504468304820&correlator=1221754835747230&output=ldjh&impl=fifs&eid=31063820%2C31063914%2C31063706&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211215&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity%2Ccyber-threats%2Cransomware&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=728x90%7C970x66%7C5x5&prev_scp=pos%3Dnav%26sl%3Dnav-ad-plus-leader%253FT-1000%26iid%3Dunit%253Dnav-ad-plus-leader%257Cvguid%253D80aacfc0-c333-458b-867d-5889a83a97c9%257Cpv%253D1&eri=1&cust_params=test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dransomware%252Csecurity%252Ccyber-threats%26tag%3Dransomware%252Cmcafee%26prodtype%3Dantivirus%26mfr%3Dmcafee%252Ceset-llc%252Cmicrosoft%26pid%3Dmicrosoft-teams%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D5%26session%3Dc%26pv%3D1%26vguid%3D80aacfc0-c333-458b-867d-5889a83a97c9&cookie_enabled=1&bc=31&abxe=1&lmt=1639567637&dt=1639567637290&dlt=1639567636610&idt=622&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=50&adks=3155022550&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100&msz=1600x100&ga_vid=157234709.1639567637&ga_sid=1639567637&ga_hid=1571581940&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash f1c1d8fe57f01ed3fd11ee487daed115b9b170d4df1b82f01187ec0b38b2a52e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11696 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html Show response f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FB3B	6 KB 4 KB	77ms 17ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Wed, 15 Dec 2021 11:27:17 GMT expires Thu, 15 Dec 2022 11:27:17 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	20 KB 9 KB	421ms 421ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3841504468304820&correlator=2667320335965685&output=ldjh&impl=fifs&eid=31063820%2C31063914%2C31063706&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211215&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity%2Ccyber-threats%2Cransomware&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Dtop%26sl%3Dmpu-plus-top%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-plus-top%257Cvguid%253D80aacfc0-c333-458b-867d-5889a83a97c9%257Cpv%253D1&eri=1&cust_params=test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dransomware%252Csecurity%252Ccyber-threats%26tag%3Dransomware%252Cmcafee%26prodtype%3Dantivirus%26mfr%3Dmcafee%252Ceset-llc%252Cmicrosoft%26pid%3Dmicrosoft-teams%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D5%26session%3Dc%26pv%3D1%26vguid%3D80aacfc0-c333-458b-867d-5889a83a97c9&cookie_enabled=1&bc=31&abxe=1&lmt=1639567637&dt=1639567637357&dlt=1639567636610&idt=622&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=450&adks=2925621730&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x280&msz=370x30&ga_vid=157234709.1639567637&ga_sid=1639567637&ga_hid=1571581940&ga_fc=false&fws=4&ohw=370&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 662c3e8a1de49634504c4990086ac9f7c255aa6355f994daa3397f30244e06dd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9501 x-xss-protection 0 google-lineitem-id 5821501893 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138370174589 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	15 KB 8 KB	528ms 527ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3841504468304820&correlator=3939537937231106&output=ldjh&impl=fifs&eid=31063820%2C31063914%2C31063706&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211215&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity%2Ccyber-threats%2Cransomware&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=300x250&prev_scp=pos%3Dmiddle%26sl%3Dmpu-middle%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-middle%257Cvguid%253D80aacfc0-c333-458b-867d-5889a83a97c9%257Cpv%253D1&eri=1&cust_params=test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dransomware%252Csecurity%252Ccyber-threats%26tag%3Dransomware%252Cmcafee%26prodtype%3Dantivirus%26mfr%3Dmcafee%252Ceset-llc%252Cmicrosoft%26pid%3Dmicrosoft-teams%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D5%26session%3Dc%26pv%3D1%26vguid%3D80aacfc0-c333-458b-867d-5889a83a97c9&cookie_enabled=1&bc=31&abxe=1&lmt=1639567637&dt=1639567637360&dlt=1639567636610&idt=622&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=1333&adks=2999017174&ucis=3&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x30&msz=370x30&ga_vid=157234709.1639567637&ga_sid=1639567637&ga_hid=1571581940&ga_fc=false&fws=4&ohw=370&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash d7ba9b773722c505ed4f248675cfe63982affa8d4a54d6625c40f7081bd6fb6c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8059 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	23 KB 10 KB	88ms 87ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3841504468304820&correlator=3541951888812285&output=ldjh&impl=fifs&eid=31063820%2C31063914%2C31063706&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211215&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity%2Ccyber-threats%2Cransomware&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=320x50%7C11x11&fluid=height&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%26sl%3Dsharethrough-top%253FLL%257CT-1000%26iid%3Dunit%253Dsharethrough-top%257Cvguid%253D80aacfc0-c333-458b-867d-5889a83a97c9%257Cpv%253D1&eri=1&cust_params=test%3Dseamless%257C1%257Cc%26buyingcycle%3Ddiscover%26topic%3Dransomware%252Csecurity%252Ccyber-threats%26tag%3Dransomware%252Cmcafee%26prodtype%3Dantivirus%26mfr%3Dmcafee%252Ceset-llc%252Cmicrosoft%26pid%3Dmicrosoft-teams%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D5%26session%3Dc%26pv%3D1%26vguid%3D80aacfc0-c333-458b-867d-5889a83a97c9&cookie_enabled=1&bc=31&abxe=1&lmt=1639567637&dt=1639567637364&dlt=1639567636610&idt=622&frm=20&biw=1600&bih=1200&oid=2&adxs=215&adys=1434&adks=2423816997&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x150&msz=770x0&ga_vid=157234709.1639567637&ga_sid=1639567637&ga_hid=1571581940&ga_fc=false&fws=4&ohw=770&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 97e2fd51a34cba6e8b2da280107531d7f5a37a09702cc2040d0e2862e228d4ad Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10147 x-xss-protection 0 google-lineitem-id 5667186874 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138346534047 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	v2 Show response mb.moatads.com/yi/	358 B 533 B	132ms 34ms	Script text/html	18.169.85.185 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&callback=MoatNadoAllJsonpRequest_48784645 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.169.85.185 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-169-85-185.eu-west-2.compute.amazonaws.com Software TornadoServer/5.1.1 / Resource Hash d030648ba21aa4580e3d6dfa9223f47bbe6192035da8db5e4e6e7232a7a8013a Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT cache-control max-age=900 server TornadoServer/5.1.1 timing-allow-origin * etag "5576c07e8b3207ceff963055d915fe27ee6bd8d7" content-length 358 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	84 B 258 B	98ms 26ms	Script text/html	18.132.26.114 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639567637387&de=476698456321&m=0&ar=8ab009d7785-clean&iw=04a0275&q=1&cb=0&cu=1639567637387&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A402%3A402%3A0%3A399&jk=-1&jm=-1&fs=195979&na=900292590&cs=0&ord=1639567637387&jv=2103495950&callback=DOMlessLLDcallback_48784645 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.132.26.114 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-132-26-114.eu-west-2.compute.amazonaws.com Software TornadoServer/5.1.1 / Resource Hash 2767ec51ce3a5cda110adf1b47c4e5dc6bee3eef2d8aeaf5fee3335e60ca4593 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT cache-control max-age=900 server TornadoServer/5.1.1 timing-allow-origin * etag "dd03e0430805980e3d5207706d24d435438c3555" content-length 84 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	86 B 259 B	100ms 28ms	Script text/html	18.132.26.114 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639567637387&de=476698456321&m=0&ar=8ab009d7785-clean&iw=04a0275&q=2&cb=0&cu=1639567637387&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A402%3A402%3A0%3A399&jk=-1&jm=-1&fs=195979&na=1047221455&cs=0&callback=MoatDataJsonpRequest_48784645 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.132.26.114 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-132-26-114.eu-west-2.compute.amazonaws.com Software TornadoServer/5.1.1 / Resource Hash 2435563f8c2d5be05cea82ca107697032c4fc30be53029e89fb8ef734d67106a Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT cache-control max-age=900 server TornadoServer/5.1.1 timing-allow-origin * etag "95ead8fcb1544e3db3f048ea463e7ca172b7a51b" content-length 86 content-type text/html; charset=UTF-8
GET H/1.1	204 No Content	/ Show response 0217991b.akstat.io/	0 354 B	251ms 216ms	XHR image/gif	2a02:26f0:7100:199::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://0217991b.akstat.io/?h.pg=article&h.ab=seamless_c_1&when=1639567637376&cdim.Site_View=desktop&t_other=custom4%7C315&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=77468f32663ec7ef92d63a0c79033b8be9a8a784-5f2eb70f-800602a4&h.t=1639567636981&http.initiator=api&rt.start=api&rt.si=0061f787-962f-40f5-bb34-68ff0522d28a&rt.ss=1639567637343&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:7100:199::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:17 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	xs2.html Show response cdn.cohesionapps.com/cohesion/ Frame 4A5C	473 B 833 B	9ms 9ms	Document text/html	18.66.139.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs2.html Requested by Host: cdn.cohesionapps.com URL: https://cdn.cohesionapps.com/cohesion/xs1.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.139.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-139-69.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 88b8a3cb9df436d6910440c58428516accee080be4fa556d3cf10ec6905cf1b9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://cdn.cohesionapps.com/cohesion/xs1.html Response headers content-type text/html content-length 473 date Tue, 14 Dec 2021 17:07:19 GMT last-modified Tue, 14 Dec 2021 17:07:14 GMT etag "ffa03bed298484a7755ca23c5431cb28" x-amz-server-side-encryption AES256 x-amz-version-id null accept-ranges bytes server AmazonS3 x-cache Hit from cloudfront via 1.1 760a29e891ec10bba1274911260e1fc9.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 x-amz-cf-id ku0S526R408_Tj2avKQkXbxt0KE43pZS-4cI-eLKzcl0yckluPt1eA== age 65999
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 6A52	0 0	47ms 47ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu9QTky2yVwfkeVNpYHhKECq2twkkMWR__TQ5bNlynArN0pzI9Yxkq0lfKZR22mfedyqDm3VdiNbAuhn5UHR9lLA7iWjKTxwdrFlFfkK-f2tE1GIQwSaTsEfJdMXN0V1v6iGNn91kwGdETHPAQEKFeflkrUXcyjfc_nyNA4pTjJgk_en0Lwk0_uLiHkob2VTOxfJ-4Si0ZoPjYlJwTe4qJKz7UoB-K3xZwXzlLV2y1VfHKA1Igj1eU6q3jyZ_KLTEMiUMwQbMUoul-CnnIJXiYd9P9w045qPw8DkDEVxjNfPm1PWCrOdANN6Kpkr1JUhCFGjG8ftBUHiLOinxwhmNKQlD45qA8sPmxrHSkMgOROpxKnmTml&sai=AMfl-YQCO30cK1zuxivfW9ocpfnArCKJbiP5PAt6WT0VHs7tyRdLtwUMuqtyXVBu3zn35n0SLfRR0044GyfNtz8OYwZfC-9qsy_we2Fmbxr_dAne0Iv1nnau1qk784NVuRY&sig=Cg0ArKJSzJTVsdfTmTHaEAE&uach_m=[UACH]&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 6A52	119 KB 37 KB	36ms 35ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/ Frame 6A52	335 KB 112 KB	12ms 12ms	Script application/x-javascript	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip last-modified Thu, 09 Dec 2021 16:36:30 GMT server AmazonS3 x-amz-request-id G85B7X4BDG3XQXNK etag "9c75e5b0c5bc0a53e0cdef53eae89c77" vary Accept-Encoding content-type application/x-javascript cache-control max-age=11830 accept-ranges bytes content-length 114446 x-amz-id-2 dFEXSaK1YIFJMrG2zCIjWW/53ykIcfzya/4OqOjSodPQdVoUN0oOf9sBWW+rTddw8uFpja+dVfc=
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	102ms 102ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	101ms 101ms	Preflight	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	116ms 114ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash b1f9350cab069a33f1fddefccd337b2d0220bf5edd9692e626e50a38a6507402 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	118ms 117ms	XHR application/json	54.172.4.218 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.4.218 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-4-218.compute-1.amazonaws.com Software / Resource Hash b1e21876dc3dee88942b26239e1ec02f9a1c6ece75210ee046a8e830425ecea8 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	54ms 22ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=11x11&zMoatPS=top&zMoatSZPS=11x11%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1639567637584&de=817235982878&m=0&ar=cc97a930ec1-clean&iw=101177c&q=6&cb=0&ym=0&cu=1639567637584&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5009920773%3A2843412950%3A5667186874%3A138346534047&zMoatW=11&zMoatH=11&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=sharethrough-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A402%3A402%3A0%3A399&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=195926&na=1153779427&cs=0 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:17 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:17 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 6A52	0 0	43ms 43ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvl2zUwZd9bh8NRHNC2hC_FJ2pCisOPbhyv6xHLCZtqn89i49QDD6F0yWkrFS1oNjOSOKdf1K6dj4exQyN0B6tr5xII9Pbk_Gp0hectqC3sF408XLu2oWmVetamTwRGNJurgrjJWA02L-Qe0EzTlo7U1B2r8qQzKQzUry24ynBdP-beRwCkToQO3GHjV4qGFbC8IcfTFU78PufJp8JMGXbMijrU8iTK36B5WZqTQ4HqfG-CNNqSk-pSlu7S0FfIJPgi0P3f9jZ8Xd66MLw4mwGJsqAHog_6xeQTiUZTt2NrFvIoKNtKcsRWRepPonF_ADFayLf59u4Rw7W0J_2HIviCRhPY_4VcIfZEk0wVcUtSetNzo1p7C9E&sai=AMfl-YRprsYm2CLo7mWZKyxvf9UG4lpKM2R3LpaovAP-4JgNbmv_nI-ykCKOrlZ366KpCNptojU0weDMGRsxxQw4TO2SMplgea3sMUBBVPTIz8NZfhvaO8786vlNDo7C_Zc&sig=Cg0ArKJSzI-iLzE7C4xjEAE&uach_m=[UACH]&urlfix=1&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	nr-spa-1212.min.js Show response js-agent.newrelic.com/	44 KB 17 KB	31ms 8ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-spa-1212.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-version-id wY72Ah.NJX5KzzqRFK3uhSo3Jh07tDe4 content-encoding gzip etag "8bd93bf0ecb2f4e971a2055a41402bb6" x-amz-request-id VG6YBKXNYMJ05RRS x-cache HIT cross-origin-resource-policy cross-origin content-length 16636 x-amz-id-2 CN/OtP3A9z0ShcwSC84Dp2716OPSVqHtXjTa3tL4kDFfrY9FTweTMDz1ynWsKHz8NETzizCEpEw= x-served-by cache-fra19132-FRA last-modified Thu, 04 Nov 2021 21:16:16 GMT server AmazonS3 x-timer S1639567638.683197,VS0,VE0 date Wed, 15 Dec 2021 11:27:17 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 2161
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 9 KB	47ms 22ms	XHR application/json	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021120601&st=env Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c07caf19b33a262b5b1fed7b2614f4beac27036619dc0693b20386ebc4116367 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8477 x-xss-protection 0
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 1 KB	124ms 124ms	XHR application/json	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d46051f1579605feffda85c819d21c560a9b46df7582bde3874be9df76eaba1c Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-84dd412c5bbc40b3----1639567637707 traceparent 00-91d0732d74b3868da8a7d4636955a8d0-84dd412c5bbc40b3-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiODRkZDQxMmM1YmJjNDBiMyIsInRyIjoiOTFkMDczMmQ3NGIzODY4ZGE4YTdkNDYzNjk1NWE4ZDAiLCJ0aSI6MTYzOTU2NzYzNzcwNywidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff last-modified Wed, 15 Dec 2021 10:53:23 GMT vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFtcXRQODFJfQzkGQ1NSCQ8NBW8MXRVLGhgCHVUJUQFRH1JKBgRWVVMUHgFIQ1BSBQMHBVMOUAdQWlIDWgpAFF5VXkAAZA== x-frame-options SAMEORIGIN date Wed, 15 Dec 2021 11:27:17 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 2d122041-27ba-4639-b750-be55a06155b0 content-type application/json via 1.1 varnish cache-control max-age=5400, private accept-ranges bytes expires Wed, 15 Dec 2021 12:23:23 GMT
GET H2	200	track-cwv-72dfb3ae38-rev.js Show response www.zdnet.com/a/fly/js/components/	239 B 329 B	9ms 9ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/track-cwv-72dfb3ae38-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 9b7909cb9edd007095b41a13617b66208e4210fff9c5e411a7db116efefc8e71 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 199 x-xss-protection 1; mode=block last-modified Wed, 08 Dec 2021 21:25:59 GMT server ContentServer x-frame-options SAMEORIGIN etag "c9a7fcd1b409a8885e607521d8760279" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 15 Dec 2021 22:42:12 GMT
GET H2	200	author-modal-d55d4e857c-rev.js Show response www.zdnet.com/a/fly/js/components/	573 B 424 B	8ms 8ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/author-modal-d55d4e857c-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 06c00948dd5d4c3109c9e00bb6c44938e1251feae65e2b7c2591f333ab230d9b Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 311 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:39 GMT server ContentServer x-frame-options SAMEORIGIN etag "4da97158326b0293b09b6a931c98a1e3" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 20 Dec 2021 15:22:57 GMT
GET H2	200	disqus-loader-17293b5282-rev.js Show response www.zdnet.com/a/fly/js/components/	1 KB 895 B	9ms 9ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/disqus-loader-17293b5282-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0aee86f10613d80ea0542d89047ea3467747db993379daeb592178ebf943b534 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 684 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:40 GMT server ContentServer x-frame-options SAMEORIGIN etag "1e5f048735ffba851865782fc08a4a43" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 16 Dec 2021 17:11:51 GMT
GET H2	200	front-door-carousel-dcdcc78ebc-rev.js Show response www.zdnet.com/a/fly/js/components/	5 KB 2 KB	10ms 9ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 1651 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 16:02:01 GMT server ContentServer x-frame-options SAMEORIGIN etag "aa0b07f3033f1a844f55155bbf0b9f8c" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 18:20:58 GMT
GET H2	200	istock-1185282377.jpg www.zdnet.com/a/img/resize/9d9a2bd154002583e26033a492cce61fbc4f291d/2020/09/28/6ce2ab9c-621c-4b07-90a2-7fb82fe7c55c/	5 KB 6 KB	9ms 5ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/9d9a2bd154002583e26033a492cce61fbc4f291d/2020/09/28/6ce2ab9c-621c-4b07-90a2-7fb82fe7c55c/istock-1185282377.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2acc7fd764c06a23a7663672609a2e82520950feac737f4249dbd784f17537ea Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=94730 idim=787x444 ifmt=jpeg ofsz=5456 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5456 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "2ry/roN8LZgQ2Et9BTO7nFFpPkO/bUNG0gLrdLyKJUo" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 05 Dec 2021 07:25:21 GMT
GET H2	200	shutterstock-1660368628.jpg www.zdnet.com/a/img/resize/251b4ef6a477a806bc6bd0bd212a31b9713987a9/2021/10/18/13365fec-9a4f-4acf-97e2-1553c3ee1abb/	6 KB 6 KB	11ms 6ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/251b4ef6a477a806bc6bd0bd212a31b9713987a9/2021/10/18/13365fec-9a4f-4acf-97e2-1553c3ee1abb/shutterstock-1660368628.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 422f83f437feea28193ba2271f192fcfab346cafcbdf07a3ea0ad7c83ae82f76 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=24615890 idim=6000x3948 ifmt=jpeg ofsz=5948 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5948 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "dSBpJIqM/GUE0MlhDfAYpO8+avtvpHUGp1pM2Z+mKVA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Tue, 14 Dec 2021 02:48:59 GMT
GET H2	200	natural-gas.jpg www.zdnet.com/a/img/resize/4063d1890ce4e1261756e017905002159f8018da/2021/12/14/20b91e91-01bd-4657-a4c9-5b0558084bdc/	10 KB 10 KB	12ms 7ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/4063d1890ce4e1261756e017905002159f8018da/2021/12/14/20b91e91-01bd-4657-a4c9-5b0558084bdc/natural-gas.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f443e1f84f8918d580ed93be6e1d5fd4de217f743d41516e4967c55e2d4a051d Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=2410484 idim=1600x1069 ifmt=jpeg ofsz=9926 odim=170x128 ofmt=webp fastly-stats io=1 content-length 9926 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "oe1XYvIrIpP8ClL+ZiM93WZxXc+VoQXt/DyGXHq30w0" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Tue, 14 Dec 2021 18:25:05 GMT
GET H2	200	ransomware.png www.zdnet.com/a/img/resize/5208d0c8e686811e55377f8f7bef450a9be6b39a/2020/09/08/b4b15301-4f60-4b29-84d4-15e6d3014d73/	14 KB 14 KB	12ms 7ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/5208d0c8e686811e55377f8f7bef450a9be6b39a/2020/09/08/b4b15301-4f60-4b29-84d4-15e6d3014d73/ransomware.png?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 8319d53f4a7cec37ce760a060ccda66570d72896f6245ee9b4085815bc85cdc3 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=55423 idim=1000x500 ifmt=png ofsz=14358 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599564287694184 fastly-stats io=1 content-length 14358 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "3ZflG5zvkFmhHhWNh61XK72wLOGAwApqjA1brYTE3sM" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 22:40:26 GMT
GET H2	200	critical-cybersecurity-vulnerabilities.jpg www.zdnet.com/a/img/resize/37940026a15105fa925841ea08960a3e919116fe/2021/06/22/679b7fab-3a40-4090-ae02-101c853b8cdf/	6 KB 6 KB	12ms 8ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/37940026a15105fa925841ea08960a3e919116fe/2021/06/22/679b7fab-3a40-4090-ae02-101c853b8cdf/critical-cybersecurity-vulnerabilities.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c5753ac857a12e70c663adb5ccc24b2006b21734a2b568438534975fd7ee0545 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=179239 idim=1600x1069 ifmt=jpeg ofsz=6268 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1624398027441450 fastly-stats io=1 content-length 6268 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "P2OsiU/h/OpkhakZ1X3Y6GtJ9bFml5DkEPIbcW1euSw" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 12 Dec 2021 10:22:22 GMT
GET H2	200	global-cybersecurity-cyberattack-network-gps.jpg www.zdnet.com/a/img/resize/04e8b2868a95aeb9ec5624568453c0e9cc9c8cf0/2021/08/02/9500e900-070f-49e2-b214-e088fa9e3f9b/	8 KB 8 KB	12ms 8ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/04e8b2868a95aeb9ec5624568453c0e9cc9c8cf0/2021/08/02/9500e900-070f-49e2-b214-e088fa9e3f9b/global-cybersecurity-cyberattack-network-gps.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c682a5ee7f8e26bd4efda7144a2e54689937045c738a55cfc900baf7057c7431 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=97780 idim=1067x600 ifmt=jpeg ofsz=8324 odim=170x128 ofmt=webp fastly-stats io=1 content-length 8324 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "sMd6VGYwQ50nn9kQgBdt8KhW/l8JGJPwWlAg9yJuGjg" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 21 Nov 2021 15:12:32 GMT
GET H2	200	ransomware.jpg www.zdnet.com/a/img/resize/c12ee0c4e5041aa866113736e3c35c511be1780b/2019/12/16/e39b2ee1-7c73-4047-975b-55949a9158ee/	5 KB 5 KB	15ms 11ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/c12ee0c4e5041aa866113736e3c35c511be1780b/2019/12/16/e39b2ee1-7c73-4047-975b-55949a9158ee/ransomware.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 314bdca7facd07945d4ef0b537b360a28ae0db8c6a9b631bed2a0ee677343214 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish fastly-io-info ifsz=82452 idim=1032x475 ifmt=jpeg ofsz=5234 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638246694489 fastly-stats io=1 content-length 5234 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "PCuc+t7TEM0Xjy+XuiN4ogwqN2hP6FylvCJLlC5QtzE" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Mon, 29 Nov 2021 09:05:41 GMT
GET H2	200	shutterstock-1751628242.jpg www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/	2 KB 3 KB	13ms 10ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/shutterstock-1751628242.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ee6665447bf60c13dcfb2a7e8f3e80d231f2f5cb180995889956ef93eebd8549 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=11768242 idim=6000x4000 ifmt=jpeg ofsz=2488 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2488 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Co54q6atr81IOHkwJ/WxG4xFMcCEePDgjnujOhrERQI" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 23:22:03 GMT
GET H2	200	cma-cgm-shipping-cargo.jpg www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/	8 KB 8 KB	14ms 10ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/cma-cgm-shipping-cargo.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f267f9c57ffe8ff134eee5ec282089ff9c4c0669ea8c8af414d38fe501410e9e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=117362 idim=1000x500 ifmt=jpeg ofsz=8254 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1601311989734263 fastly-stats io=1 content-length 8254 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "GpD9eEagf1IBcPIW0iapNx6zp8GVyVxnL0QII+RW2xA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 17:41:38 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	84ms 47ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" etag "1637097310169751" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6386 x-xss-protection 0 expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	istock-1185282377.jpg www.zdnet.com/a/img/resize/9d9a2bd154002583e26033a492cce61fbc4f291d/2020/09/28/6ce2ab9c-621c-4b07-90a2-7fb82fe7c55c/	5 KB 5 KB	8ms 8ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/9d9a2bd154002583e26033a492cce61fbc4f291d/2020/09/28/6ce2ab9c-621c-4b07-90a2-7fb82fe7c55c/istock-1185282377.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 2acc7fd764c06a23a7663672609a2e82520950feac737f4249dbd784f17537ea Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=94730 idim=787x444 ifmt=jpeg ofsz=5456 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5456 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "2ry/roN8LZgQ2Et9BTO7nFFpPkO/bUNG0gLrdLyKJUo" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 05 Dec 2021 07:25:21 GMT
GET H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/1/	49 B 715 B	191ms 166ms	Script text/javascript	162.247.243.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=1449&ck=1&ref=https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/&ap=153&be=334&fe=1360&dc=399&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1639567636296,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:15,%22c%22:15,%22s%22:17,%22ce%22:34,%22rq%22:34,%22rp%22:311,%22rpe%22:325,%22dl%22:314,%22di%22:399,%22ds%22:399,%22de%22:399,%22dc%22:1360,%22l%22:1360,%22le%22:1373%7D,%22navigation%22:%7B%7D%7D&fp=401&fcp=401&at=GkEWQAhCSx5HAxIDThwe&jsonp=NREUM.setToken Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:17 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 6bdf52681d121776-FRA
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012111011823000/ Frame 6F69	189 KB 55 KB	43ms 10ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 60024 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 55592 x-xss-protection 0 server sffe date Tue, 14 Dec 2021 18:46:53 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "11dee2040f5fc1d7" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 14 Dec 2022 18:46:53 GMT
GET H2	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame 6F69	13 KB 5 KB	50ms 17ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 46901 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4992 x-xss-protection 0 server sffe date Tue, 14 Dec 2021 22:25:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "858600ba27ef7413" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 14 Dec 2022 22:25:36 GMT
GET H2	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame 6F69	89 KB 28 KB	53ms 21ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 61846 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28555 x-xss-protection 0 server sffe date Tue, 14 Dec 2021 18:16:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a64e482645fd262b" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 14 Dec 2022 18:16:31 GMT
GET H2	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame 6F69	5 KB 2 KB	55ms 23ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 332682 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1731 x-xss-protection 0 server sffe date Sat, 11 Dec 2021 15:02:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "cb4f0e89d7d37d9b" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 11 Dec 2022 15:02:35 GMT
GET H2	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame 6F69	40 KB 13 KB	56ms 24ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 308142 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12826 x-xss-protection 0 server sffe date Sat, 11 Dec 2021 21:51:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f02165e023e70703" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 11 Dec 2022 21:51:35 GMT
GET H2	200	css fonts.googleapis.com/ Frame 6F69	3 KB 1 KB	44ms 17ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 15 Dec 2021 10:37:54 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 15 Dec 2021 11:27:17 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 15 Dec 2021 11:27:17 GMT
GET H/1.1	200 OK	pixel protected-by.clarium.io/	68 B 345 B	56ms 13ms	Image image/png	18.194.205.167 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6NzI4eDkw&v=5&s=v31fmuthf8s&sb=-1&h=www.zdnet.com&cb=4145397&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZOekk0ZURrdyIsIndkIjp7Im8iOjI4NzA3ODYwNzUsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.194.205.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-194-205-167.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:17 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H2	200	en_bl.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6F69	2 KB 3 KB	11ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Tue, 14 Dec 2021 20:16:06 GMT x-content-type-options nosniff server cafe age 54671 etag 11660698925711390587 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2471 x-xss-protection 0 expires Wed, 15 Dec 2021 20:16:06 GMT
GET H2	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6F69	295 B 399 B	9ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 05:43:34 GMT x-content-type-options nosniff server cafe age 20623 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Thu, 16 Dec 2021 05:43:34 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame 6F69	0 0	44ms 17ms	Image text/html	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaR2VA9KTRs2ULVgUn6Qgyji-OKqXoBCuf1td1SzoZDTIbme1TQopSKiXq8890P97a6tIem_fmbxs98lv4NxOgIzRhsiTg Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame 6F69	0 0	53ms 52ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C7_qCFdG5Yc2UFdyK9u8Pv8iziAaT89-IZ7nCsYuPD5aCzYWIFhABIPe7x4MBYJW6gIKYB6AB6feauQHIAQapAvZv6pNm6rI-4AIAqAMBqgToAk_QnmP5zCbpeBhCsksGgqTP3dlh4DKi7LaYx0X0-F3v0by3gmBeCKduKr4wVnIEJzqcZczrwMfC0aWTSeSflOYI1KQ-wgvQSCygiLH27ZaDDUeFXKnNledCAAvB6dkbatvXIImDrwi2wpYPvOdmCRcgPtqWUnPnmHEXQunlQDTR6U_wxH3mCCWfyO7vgGT02rmi4hI0J2sWsXtcquE7MwE0Z5vUu9RGgrNnsHmPJXBzXOfW5xzB3lqJVT8okxeqp5fk-e1lZmbE8rBx6DjQh19b-xtMO-8bfAGk-lJC293-gwaKcMN2pbiYRMWzrWy69EVVJo-jP7cWAdLVRfwU935bzNMeUBQi66TYD3bLFRWonCW5ltbQ8NO-IIdsCWZwfgpT4IdMm3iH56lZ0PcVV2QFwLOpyiivLmFcXdias5R9OvJ-5gwVDRHMDnXhrb2kwfTu4SkfzE3Sx4HYudHzsTneIIHHo7hedcAE1pfz9-oD4AQBkgUECAQYAZIFBAgFGASAB_-H5cYCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ2s0N0ggJCIjhgBAQARgdgAoDyAsB2BMM0BUBgBcBshceChwIABIUcHViLTg4MjAzNjI2MDU3MTExOTYYyZt6&sigh=E784e_r1zU4&uach_m=[UACH]&template_id=492&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET DATA	200 OK	truncated / Frame 6F69	218 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a3827e6684acbbd647313f4ee3e5eb9a0da9ef1323c6489ab63a9b883b7dd7cf Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	11ms 10ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&zMoatAdUnit4=cyber-threats&wf=1&ra=3&pxm=&sgs=3&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639567637387&de=633989469692&rx=799912607017&m=0&ar=8ab009d7785-clean&iw=04a0275&q=7&cb=0&cu=1639567637387&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=aw-zdnet&bd=ransomware&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=nav&zMoatvguid=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatptype=article&zMoatsl=nav-ad-plus-leader%3FT-1000&pe=1%3A402%3A402%3A1373%3A399&jk=-1&jm=-1&fs=195979&na=264521141&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:17 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	shutterstock-1660368628.jpg www.zdnet.com/a/img/resize/251b4ef6a477a806bc6bd0bd212a31b9713987a9/2021/10/18/13365fec-9a4f-4acf-97e2-1553c3ee1abb/	6 KB 6 KB	13ms 9ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/251b4ef6a477a806bc6bd0bd212a31b9713987a9/2021/10/18/13365fec-9a4f-4acf-97e2-1553c3ee1abb/shutterstock-1660368628.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 422f83f437feea28193ba2271f192fcfab346cafcbdf07a3ea0ad7c83ae82f76 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=24615890 idim=6000x3948 ifmt=jpeg ofsz=5948 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5948 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "dSBpJIqM/GUE0MlhDfAYpO8+avtvpHUGp1pM2Z+mKVA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Tue, 14 Dec 2021 02:48:59 GMT
GET H2	200	natural-gas.jpg www.zdnet.com/a/img/resize/4063d1890ce4e1261756e017905002159f8018da/2021/12/14/20b91e91-01bd-4657-a4c9-5b0558084bdc/	10 KB 10 KB	13ms 10ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/4063d1890ce4e1261756e017905002159f8018da/2021/12/14/20b91e91-01bd-4657-a4c9-5b0558084bdc/natural-gas.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f443e1f84f8918d580ed93be6e1d5fd4de217f743d41516e4967c55e2d4a051d Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=2410484 idim=1600x1069 ifmt=jpeg ofsz=9926 odim=170x128 ofmt=webp fastly-stats io=1 content-length 9926 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "oe1XYvIrIpP8ClL+ZiM93WZxXc+VoQXt/DyGXHq30w0" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Tue, 14 Dec 2021 18:25:05 GMT
GET H2	200	ransomware.png www.zdnet.com/a/img/resize/5208d0c8e686811e55377f8f7bef450a9be6b39a/2020/09/08/b4b15301-4f60-4b29-84d4-15e6d3014d73/	14 KB 14 KB	11ms 10ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/5208d0c8e686811e55377f8f7bef450a9be6b39a/2020/09/08/b4b15301-4f60-4b29-84d4-15e6d3014d73/ransomware.png?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 8319d53f4a7cec37ce760a060ccda66570d72896f6245ee9b4085815bc85cdc3 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=55423 idim=1000x500 ifmt=png ofsz=14358 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599564287694184 fastly-stats io=1 content-length 14358 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "3ZflG5zvkFmhHhWNh61XK72wLOGAwApqjA1brYTE3sM" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 22:40:26 GMT
GET H2	200	critical-cybersecurity-vulnerabilities.jpg www.zdnet.com/a/img/resize/37940026a15105fa925841ea08960a3e919116fe/2021/06/22/679b7fab-3a40-4090-ae02-101c853b8cdf/	6 KB 6 KB	11ms 11ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/37940026a15105fa925841ea08960a3e919116fe/2021/06/22/679b7fab-3a40-4090-ae02-101c853b8cdf/critical-cybersecurity-vulnerabilities.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c5753ac857a12e70c663adb5ccc24b2006b21734a2b568438534975fd7ee0545 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=179239 idim=1600x1069 ifmt=jpeg ofsz=6268 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1624398027441450 fastly-stats io=1 content-length 6268 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "P2OsiU/h/OpkhakZ1X3Y6GtJ9bFml5DkEPIbcW1euSw" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 12 Dec 2021 10:22:22 GMT
GET H2	200	global-cybersecurity-cyberattack-network-gps.jpg www.zdnet.com/a/img/resize/04e8b2868a95aeb9ec5624568453c0e9cc9c8cf0/2021/08/02/9500e900-070f-49e2-b214-e088fa9e3f9b/	8 KB 8 KB	13ms 6ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/04e8b2868a95aeb9ec5624568453c0e9cc9c8cf0/2021/08/02/9500e900-070f-49e2-b214-e088fa9e3f9b/global-cybersecurity-cyberattack-network-gps.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c682a5ee7f8e26bd4efda7144a2e54689937045c738a55cfc900baf7057c7431 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=97780 idim=1067x600 ifmt=jpeg ofsz=8324 odim=170x128 ofmt=webp fastly-stats io=1 content-length 8324 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "sMd6VGYwQ50nn9kQgBdt8KhW/l8JGJPwWlAg9yJuGjg" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sun, 21 Nov 2021 15:12:32 GMT
GET H2	200	shutterstock-1751628242.jpg www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/	2 KB 3 KB	14ms 6ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/shutterstock-1751628242.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ee6665447bf60c13dcfb2a7e8f3e80d231f2f5cb180995889956ef93eebd8549 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=11768242 idim=6000x4000 ifmt=jpeg ofsz=2488 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2488 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Co54q6atr81IOHkwJ/WxG4xFMcCEePDgjnujOhrERQI" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 23:22:03 GMT
GET H2	200	cma-cgm-shipping-cargo.jpg www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/	8 KB 8 KB	12ms 7ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/cma-cgm-shipping-cargo.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f267f9c57ffe8ff134eee5ec282089ff9c4c0669ea8c8af414d38fe501410e9e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=117362 idim=1000x500 ifmt=jpeg ofsz=8254 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1601311989734263 fastly-stats io=1 content-length 8254 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "GpD9eEagf1IBcPIW0iapNx6zp8GVyVxnL0QII+RW2xA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 17:41:38 GMT
GET H2	200	ransomware.jpg www.zdnet.com/a/img/resize/c12ee0c4e5041aa866113736e3c35c511be1780b/2019/12/16/e39b2ee1-7c73-4047-975b-55949a9158ee/	5 KB 5 KB	10ms 7ms	Image image/webp	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/c12ee0c4e5041aa866113736e3c35c511be1780b/2019/12/16/e39b2ee1-7c73-4047-975b-55949a9158ee/ransomware.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/65214c-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 314bdca7facd07945d4ef0b537b360a28ae0db8c6a9b631bed2a0ee677343214 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT via 1.1 varnish fastly-io-info ifsz=82452 idim=1032x475 ifmt=jpeg ofsz=5234 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638246694489 fastly-stats io=1 content-length 5234 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "PCuc+t7TEM0Xjy+XuiN4ogwqN2hP6FylvCJLlC5QtzE" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Mon, 29 Nov 2021 09:05:41 GMT
GET H2	200	core-web-vitals-16efe3ae21-rev.js Show response www.zdnet.com/a/fly/js/managers/	545 B 538 B	10ms 8ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/managers/core-web-vitals-16efe3ae21-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 82f947d14a0a198dfe3cec2fde7896f6e332eb798cc193dad8da9ed2225277cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 366 x-xss-protection 1; mode=block last-modified Tue, 14 Dec 2021 16:02:01 GMT server ContentServer x-frame-options SAMEORIGIN etag "456e04f37a1b5aa7af3e4f05d7a26227" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 21 Dec 2021 18:20:57 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 514B	0 0	43ms 43ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssuF3vYWc13aupoSNvEPz-BDbqxtvupMfeHY5r_RXGNzHasjDaCyVBL7Tjr7EInPdzf0p62E3ZCZoLGRlFeQ4yefRTGaJ9KQQaDiocpk8liKsZjiQsMUxuVV-ZophT9fvkgkgj0YvIxWKBldd4YOawYPs51uW3WAcsveIhv_LfWFwdVigQ8nVYcgrfVreYSLm8UdT56WI37iKMX0x2bD86AwzVAUwtQA735VTyghBweCjwxUV7sy1FD2mqVlFtew9RNzxXPCwTpO4gGnsQQDYsPcEWVjeov-klwVokkf38zJQWdlQZOpXInFD6ngnIbaMB1pTsVeDGXBvbScBC8eWl7SWaXNEJUfL_Ce3sPPB9rJaIE9fCKjQ&sai=AMfl-YSMEHs9WEjB5Fp0hstgJQnOeYuMkDsKFY47KoNjScwUuNfHYgVw5NlohcLP8L4sk4k6DOqG2rPuFtfDfroPC9N_owBxPDYxrN5lOGNyMGHZDMOg19O_mp_zyGYKcImp&sig=Cg0ArKJSzJ-N8BWA3pbJEAE&uach_m=[UACH]&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:17 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	dcmads.js Show response www.googletagservices.com/dcm/ Frame 514B	9 KB 4 KB	8ms 8ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/dcm/dcmads.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:14:45 GMT content-encoding gzip x-content-type-options nosniff age 752 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4486 x-xss-protection 0 last-modified Mon, 29 Nov 2021 19:29:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="ads-dcm-tag" vary Accept-Encoding report-to {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]} content-type text/javascript cache-control public, max-age=3600 accept-ranges bytes expires Wed, 15 Dec 2021 12:14:45 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 514B	119 KB 36 KB	58ms 58ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 15 Dec 2021 11:27:17 GMT
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/ Frame 514B	335 KB 112 KB	8ms 8ms	Script application/x-javascript	2.21.143.57 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-143-57.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip last-modified Thu, 09 Dec 2021 16:36:30 GMT server AmazonS3 x-amz-request-id G85B7X4BDG3XQXNK etag "9c75e5b0c5bc0a53e0cdef53eae89c77" vary Accept-Encoding content-type application/x-javascript cache-control max-age=11830 accept-ranges bytes content-length 114446 x-amz-id-2 dFEXSaK1YIFJMrG2zCIjWW/53ykIcfzya/4OqOjSodPQdVoUN0oOf9sBWW+rTddw8uFpja+dVfc=
GET H2	200	show-hide-1.0-2b8cfc35ab-rev.js Show response www.zdnet.com/a/fly/js/components/	2 KB 870 B	9ms 9ms	Script application/javascript	2a04:4e42:4c::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/show-hide-1.0-2b8cfc35ab-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4c::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 1a703d617fb31d56238372d5bf78e9861b3a09b7447a0184bd5f1c178461ed12 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:17 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 710 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:39 GMT server ContentServer x-frame-options SAMEORIGIN etag "dd7ef257baebb2315958ebdd4603472f" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 20 Dec 2021 15:22:57 GMT
GET H2	200	4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame 6F69	21 KB 22 KB	33ms 9ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 20:07:29 GMT x-content-type-options nosniff age 55188 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21424 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:24 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 14 Dec 2022 20:07:29 GMT
GET H2	200	4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame 6F69	21 KB 21 KB	36ms 13ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 10:56:24 GMT x-content-type-options nosniff age 88253 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21660 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:07:18 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 14 Dec 2022 10:56:24 GMT
GET H3	200	container.html Show response f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1DB7	6 KB 3 KB	23ms 8ms	Document text/html	2a00:1450:4001:80f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Wed, 15 Dec 2021 11:27:17 GMT expires Thu, 15 Dec 2022 11:27:17 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	69ms 67ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&zMoatAdUnit4=cyber-threats&wf=1&ra=3&pxm=&sgs=3&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639567637387&de=17701651727&rx=799912607017&m=0&ar=8ab009d7785-clean&iw=04a0275&q=8&cb=0&cu=1639567637387&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=aw-zdnet&bd=ransomware&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=middle&zMoatvguid=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatptype=article&zMoatsl=mpu-middle%3FLL%7CT-1000&pe=1%3A402%3A402%3A1373%3A399&jk=-1&jm=-1&fs=195979&na=163066691&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:17 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:17 GMT
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/225/ Frame 79A2	13 KB 5 KB	30ms 9ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5046 date Wed, 15 Dec 2021 10:49:31 GMT expires Thu, 15 Dec 2022 10:49:31 GMT last-modified Mon, 21 Jun 2021 20:47:05 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 2266 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	aframe Show response www.google.com/recaptcha/api2/ Frame 4F12	783 B 535 B	39ms 18ms	Document text/html	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 1c722c9eee80841fe168d31a51042978d46bb749e8592b4d7eb0c9af76fc3869 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-AEW4j+ULIEtDH8ylCLmo1Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Wed, 15 Dec 2021 11:27:17 GMT date Wed, 15 Dec 2021 11:27:17 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-AEW4j+ULIEtDH8ylCLmo1Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 513 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	impl_v81.js Show response www.googletagservices.com/dcm/ Frame 514B	41 KB 17 KB	9ms 8ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/dcm/impl_v81.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/dcm/dcmads.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 09 Dec 2021 09:06:19 GMT content-encoding gzip x-content-type-options nosniff age 526858 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17189 x-xss-protection 0 last-modified Mon, 29 Nov 2021 19:28:15 GMT server sffe cross-origin-opener-policy same-origin; report-to="ads-dcm-tag" vary Accept-Encoding report-to {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Fri, 09 Dec 2022 09:06:19 GMT
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 6F69 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	0 0	102ms 76ms	Image text/html	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Redirect headers date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H2	200	B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1Vhaa... Show response ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/ Frame 514B	45 KB 22 KB	98ms 66ms	Script text/javascript	142.250.184.198 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1VhaaCptYdgfy2YRxmxeGE93TOMHPUy5Y-LBS6FLVO989zjzHKhhRuEqupPm9vLK9FW_L4OjQdcBLAVNt2RuSt8lcxcliD2sYPyHuEgLcjva83Lxddi2-D72d4bRnH2nqBeD-f2vvM3dXHDj42GIvglhKVDD2h6zdaO_F-jdpczFRlkaq_PB4thv3EgUfudnxJR_SCuC0vJsDSlAzsaLEGAdOzVWziq4dzfuPpM7Ibn7IXRb2JjJMF69RelYmOGMc4A1xLOomPejufI9wflD99nqzGhAMfqtJf9O_ajoS_2WWlbm4raKrXpIiiMe6z8xkUkx002xr43USWmg%26sai%3DAMfl-YRHup6PyXWkAS2cpG270uCvZIowqaMzAqG9KXQ5016b60kRx-KUN9EKh62qnzqh-PU_scuP0yAESU2InvjdCR0E65gji0zSAs5Ud8ENv9h2tCdk332KAgsVCsliXS-G%26sig%3DCg0ArKJSzH_Zg9sZRPYbEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68$0;xdt=0;crlt=s!Ha(jb6nw;sttr=92;prcl=s Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/dcm/impl_v81.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.198 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f6.1e100.net Software cafe / Resource Hash c09d84f0749a7c3f26e71f63a2addda299c50163e26cd94a3fd8362a2467e17e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22237 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel Show response googleads.g.doubleclick.net/xbbe/ Frame 32DF	624 B 838 B	21ms 21ms	Document text/html	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXSnwEQ97DF8gIYr5SQtgEwAQ&v=APEucNVkFuowKC9YFnExH_VKyEtS86CbLYt7FuVSHBGHZMTkIqRe60s56N6gsE91g1hszEOEebltGrkGvwoqJzoaSR53_L36rqPPPHFZYRsfl38NHc1X9cEa4jEjrHFg8pEswgyyyy8cQvuz3xDZ4tOuNAGoMWFwZQ Requested by Host: f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com URL: https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Wed, 15 Dec 2021 11:27:18 GMT server cafe cache-control private content-length 276 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	ad Show response googleads.g.doubleclick.net/dbm/ Frame 1DB7	51 KB 24 KB	49ms 48ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cad9XNJITZjeyMNqpKrcVgPQpRzuQf_qKUF1H_jSB7bQWAttDj6cyiy7PTGf9lM7rSpWvzUA26L3pL4viBhR_6f4aAvdFFGe2tnK5csygjg8p7LUbQjINpPGH0YS124fDLD0EmtRaDHb6FnRGwn3S9HQOGmA&dbm_d=AKAmf-BJ8SsdAWGtuVhgXPX2Ukf8UFN53Tq7Gzjc5Aac7SrQOv8E6IAmkfDWpz3i4WDY2hTs9vWxZ8xWeL8d5lJmZh3PTBNfLe-AE4JUSlK1H6AwsoCC47IQ4a1YjWVG1NmgTLpxg1ctk_RYbNCkq7tpg4KtTUgDq9sRS9AAbWsAJGt4OscitH9-ozWW4opDpCzwUR23o7xHeGBJA0YuWobr9VuCnyINeUlHC4E5pe5mJr5zy0cSaDS52cDmaAh9bqj5m1fVtr_siB9pZZvYL7Z_nBTD_6VKOkXqRa1bi1Poz-Ay3-JCKLTyo6uvk28uoBtjbuG0qIXUJDiG1QmDrc3QWnDBBhPCBif1rIsy1zxdogzvF2XxFeg2fMeOaAdc8Sgqn_NAvSD7yx3PPQBPZ4nmTkFcGv--VTmCnxUQSf6Snch-FZbX-Ftxnwtfso96H48XZLoJqhL71SASfAY8wQLyjr1urzBmn2fkkqsYrpcG7UQSPfnIUMJTt6b20xMKCQJ0dFMYRqV4OORAna5aOsU_Fc8T2_W-NXPWgoRqU3r7_o_HfzQn5Jh5lRWr4DI-4G0aKCYYFZx2YiMRmtwzg2WDm_LVTFZHu9Ucw1Lo0_sfQEAYPckUf5Hl2mjxj5iGfKhgj5VGJA8HMbnSAn_Vmwr0Hzq6OpV8UEXGNG3ccqM91jibLDQCPuyvExt8w9kmNwA2ChaXJjpjnvEF5KZsG7_NFdbTzgA-yk9AoNUxH-hZ7qghoRw7rZ_oyhEp07_oLH7w44P97CWyr4IeiiCNTL5I5Xfdms5uvJw78q9j4G5ND7JG-mYbebgnv79mloRt27Y6Iru3vaAyb9lzM8jhWkP1xBe5gj_rarapm_DzaCM5nJyfTSN7Dqu4t0Ypcs2LLWZIwFglKuynKQ45UlN3UQsop-x98rZxnY_3x_GnJbFXYcCCb9dRNlpVPOd-xLymHZhGyobpSzX5cR15q4C6TKhdN-gas1wCXsDfwfvquhcMOGINhMiM5jWlZXyaPQ4zaJkQQmTjwb8FoMg0Hslqufiv-q_iwAdIQljdvxiTEfatjHwpNEdc7XaCXcNS-QsxVDphl9lO1al7jKKdD4vqqmk5AQ4PD-A_mHFE2R89D1WI7q1hhqbm-LNzpdhFFgDA1P_2bWfk-7kf3r71UQBM5lz6PaHmsz26asAbssht5fRhbwex4xrrsNVxmPpCU_lsjxluO1oclU90xVQOHUAbcJ0YLt27iRve2po1Vfbz5m_BFlWOH_hDNiikxadJ3yAMtrAmMdfYfaCCdRC3WsWEPlg_MF_H8flhQWB2eN4q2uEjnhbHB1ZykZllYVkFE_GR0Lv7Rnbbl26lE6ogfc3sxECipeM4wFlDNAMRb87nUvPKiCPkxhUND7Gj26MsB5EZUMtEuXuMxSVX_-S7uWqHleIkpdJDngaMqLjrv_x35jFKJM9dqp1ZqWkydvFmt9rhBYULM_M2RRU2e58GwF1Oc7PlyV2wscWIvZ83c8nc--dhNDV7nOZA-eimpnPnKv0g1VV37B04-oTZ_wzC5Hg84Gwujg08RB77krsvU05-n4vl1ETjZHu3HvvioMX_BZcaCY0tizsIGvy9krh9LOL6Hyj2n4-wT52bt_IEHg9sCSHKgNwa6At_BVk4PT2uZuueNnb1meNiuo1rp_oJ-2UH7PQVNmQdF9jW5akhRKmZc3QCVWUL82KyA3wLU6xIrpo9LSvsy0s64otvxEIrLJE4bjCuzPmf__RlTbX1XZk4cnQfoK9Q7_b-rtKUm5l4vsWyNgZAkKFr04AwUpW_35Aymp2f3qLhhYEoDuuDIFz-F3h63kGH7rSCB4xTjAsxiwVzzU6NHC-yS2LwlzrmwKXEPljIjR_FZR0XDXWTfp9gwj6-_dRVtY7OV4S20PmnSyQzHJOvatbRWrxzr0UEqSBVc_iDq31yXZZrn6GSy4yaqw-et3DnyjVQ4Tzcb117JSMqyYrgiYVuO9FLGAoiLuLeZLX0VpX0ibLrAuBTHqMIfIZPSy-7X7e4QY8ISKjGT1Aib71YWQ0L7HSkFgIU50MyTSgyC6Tf-P9786dhAiZTLSFaQRyQQWn0_WxVObsNj-1AF2yQvWSvkuKJz_Aq58k-QimcCS725_hsftwG5qKTgp1JyhV87fy5aAh3UiIR3W_sgWpdfV6Pn35_jZAtZAfmuQu1p1b0w_bK1zSu8dqe-VUaqwhOzf_uWe8awrIYyTPjd54tuoGMg4XGFinhu-q2xuXEibTuEVVX_AvbBcp_6T-HK7eabNcSeRTz4f7ACj2VGArxsmzxIbnVdjSYBUuof1QgYJ7vu4BXV-rf7PWqYYId5Aqi3-kNWX-9BkoIFPiXSuVeb5rDOWmpHSFNyIvi2U31brWXMq_0b-17SMoV6RWIjZl-vDETDhf1DPMMbUYsm2Bd27d0BbEZ8qCawqNxwuKq_puoRqT3aLfHc8y8Z-9bB-ANPTJTL9N4fnxq8fbWTypNpgKbz0fD_UGDH9cIVvOaDba5UbiFGLdCHbHo-KMMOwo-dUZ7XH8MLxbgSW2GjOoZKoscOMBJFg0ZJiLD9MVvaiG5eD7I2tKJ8vOSyfi6TlA1U8bFWKiICBZJtUooaRX2t2U48i8TI-VmbiSb2aHAoKkW8IaX6TwDNoe8-jPwrQPeRtR1pR-K1CHoqB2N6s3Ia6F3vK8VBdzTGoeLbx08w0H4vrIFfjnuP29qu1NOjnjVE6Q1rVx6YylmQtFIF3XKSyebDLQbrplERA_dT-8jYHMFW0y3iTLzPvBipygVbe374S2iTQcAJgthyVkhZnWrOS5L0fLwLkL_t1UB6bbL2nO5sXRudEkZTNfsBgoDAM2qxeueVHa8Uv_X7hB87VtzryrOqC5cbqjzw3HOD-g-vDT0MV6oBnMXSBZaXr5tMl9i5jyh8zjTRUzIdxjfZHfg6H1cl_uum6Mg3If3z0yNUJwZ8x6qOaQ-D1e1HAh_JyVKb7_u4DWzqY-Khun203rT6VayC6lLFiIlZYF-D7dyijyR9ssavypvIDKsqHkHyMIkxhW0d3Zh0keXyuVkkMATo_2uuB3txOhB43U_W4dR0tTRmYW6Z62x9qPpzRTgOGb-RU-Odk9B5EF4qF8ESO-uV--ZegWJfJOGCCBE6xp4k8RV9-0iN3ea3o7J_6vnIHt3WkIf0sty7tX-mlnRa0FJyFoF1pH-GM23qDinsaS69yydfH4ls8_WDlRnIL-FAS5hmmaylnAUvXFRTPNdVQ-fqpuGf5yttYoxZlEtKxmY47K8SLG2EnnWBFxMmi-hHHkd7VK5u8u4qsRWRvTCk3_QEq5ALkBkTMvnep9ticGA4hKi0cUbn1vG2J0mXJzo3k91ccD5n1a7maPl6EujXoZjf2cig0X5tep12aIraABejrjAhsWAT8VPD41MgH2j4tzuCXQjGrNAW8PTj0vY6QGa4E7nqEmx&cid=CAASFeRoMt5Mh3JyX6QToICf15GzGNpHrw&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%252F%240 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5e5f9600e078b6244b11625245b7723ca3aeea9951f560a2c7c96dd59489cc70 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24799 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	gen_204 pagead2.googlesyndication.com/pagead/ Frame 1DB7	42 B 63 B	67ms 49ms	Image image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BXq7wgvhKqHmvSWTGWXzOG4girDlNG_EH1ogCH6BfRf7Ar911LjxPOp-iqFyjYaKNRNbi8g75rM41APHVUHtUmqy6BBfl62UZpx244eK6Q7wOqHoU Requested by Host: f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com URL: https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 1DB7	2 KB 1 KB	16ms 13ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com URL: https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:16:33 GMT content-encoding gzip x-content-type-options nosniff age 645 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 29 Dec 2021 11:16:33 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 1DB7	15 KB 6 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js Requested by Host: f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com URL: https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:17:37 GMT content-encoding gzip x-content-type-options nosniff age 581 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6464 x-xss-protection 0 server cafe etag 15715955993838318253 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 29 Dec 2021 11:17:37 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 1DB7	119 KB 36 KB	32ms 30ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com URL: https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:18 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 15 Dec 2021 11:27:18 GMT
GET H/1.1	200 OK	pixel protected-by.clarium.io/ Frame 1DB7	68 B 345 B	21ms 19ms	Image image/png	18.194.205.167 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6MzAweDI1MA==&v=5&s=v31fmuthfj7&id=eyJkZnAiOnsiYWQiOjUwMjQ0OTY5MTEsImMiOm51bGwsImwiOjAsIm8iOjI4NzA3ODYwNzUsIkEiOiIvMjIzMDk2MTAxODYvYXctemRuZXQvdGVjaG5vbG9neS9zZWN1cml0eS9jeWJlci10aHJlYXRzL3JhbnNvbXdhcmUiLCJ5IjoyODkwNzIsImNvIjowLCJzIjoibXB1LW1pZGRsZSJ9fQ%3D%3D&sb=undefined&cb=9530539&h=www.zdnet.com&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyODcwNzg2MDc1LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0= Requested by Host: f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com URL: https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.194.205.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-194-205-167.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
POST H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/events/1/	24 B 501 B	142ms 139ms	XHR image/gif	162.247.243.146 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=1858&ck=1&ref=https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 content-type text/plain Response headers Date Wed, 15 Dec 2021 11:27:18 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com access-control-allow-credentials true Connection keep-alive CF-Ray 6bdf526a88871776-FRA Content-Length 24
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 4F12	0 0	64ms 57ms	Image text/html	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2021120601&jk=3841504468304820&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame 514B	8 KB 3 KB	22ms 9ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1VhaaCptYdgfy2YRxmxeGE93TOMHPUy5Y-LBS6FLVO989zjzHKhhRuEqupPm9vLK9FW_L4OjQdcBLAVNt2RuSt8lcxcliD2sYPyHuEgLcjva83Lxddi2-D72d4bRnH2nqBeD-f2vvM3dXHDj42GIvglhKVDD2h6zdaO_F-jdpczFRlkaq_PB4thv3EgUfudnxJR_SCuC0vJsDSlAzsaLEGAdOzVWziq4dzfuPpM7Ibn7IXRb2JjJMF69RelYmOGMc4A1xLOomPejufI9wflD99nqzGhAMfqtJf9O_ajoS_2WWlbm4raKrXpIiiMe6z8xkUkx002xr43USWmg%26sai%3DAMfl-YRHup6PyXWkAS2cpG270uCvZIowqaMzAqG9KXQ5016b60kRx-KUN9EKh62qnzqh-PU_scuP0yAESU2InvjdCR0E65gji0zSAs5Ud8ENv9h2tCdk332KAgsVCsliXS-G%26sig%3DCg0ArKJSzH_Zg9sZRPYbEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68$0;xdt=0;crlt=s!Ha(jb6nw;sttr=92;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:23:14 GMT content-encoding gzip x-content-type-options nosniff age 244 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 29 Dec 2021 11:23:14 GMT
POST H2	200	view googleads4.g.doubleclick.net/pcs/ Frame 514B	0 524 B	92ms 45ms	Ping image/gif	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvqb-Gc2R0BdNEdg51DdwFiDhCCkceq1ErUYIF3_CrpkVMhulUcqkCi9U2a_A0-lYRdhIRlXzTKANV1RUShKW0Bu4t6XRUgBKV_czrVxFXiTV7_nOY0myCt6kjAGg40dYW0c_Jryh7BBq9vQNSFWzNW&sig=Cg0ArKJSzDdmggPwGzcoEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211207.24063&adurl= Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1VhaaCptYdgfy2YRxmxeGE93TOMHPUy5Y-LBS6FLVO989zjzHKhhRuEqupPm9vLK9FW_L4OjQdcBLAVNt2RuSt8lcxcliD2sYPyHuEgLcjva83Lxddi2-D72d4bRnH2nqBeD-f2vvM3dXHDj42GIvglhKVDD2h6zdaO_F-jdpczFRlkaq_PB4thv3EgUfudnxJR_SCuC0vJsDSlAzsaLEGAdOzVWziq4dzfuPpM7Ibn7IXRb2JjJMF69RelYmOGMc4A1xLOomPejufI9wflD99nqzGhAMfqtJf9O_ajoS_2WWlbm4raKrXpIiiMe6z8xkUkx002xr43USWmg%26sai%3DAMfl-YRHup6PyXWkAS2cpG270uCvZIowqaMzAqG9KXQ5016b60kRx-KUN9EKh62qnzqh-PU_scuP0yAESU2InvjdCR0E65gji0zSAs5Ud8ENv9h2tCdk332KAgsVCsliXS-G%26sig%3DCg0ArKJSzH_Zg9sZRPYbEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68$0;xdt=0;crlt=s!Ha(jb6nw;sttr=92;prcl=s Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H/1.1	200 OK	dvtp_src.js Show response cdn.doubleverify.com/ Frame 514B	8 KB 4 KB	146ms 12ms	Script application/javascript	2a02:26f0:6c00:2b2::4469 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn.doubleverify.com/dvtp_src.js?ctx=3758893&cmp=26699368&sid=5755331&plc=318185658&num=&adid=&advid=9640137&adsrv=1&btreg=510963286&btadsrv=doubleclick&crt=160249888&crtname=&chnl=&unit=&pid=&uid=&tagtype=&dvtagver=6.1.src Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1VhaaCptYdgfy2YRxmxeGE93TOMHPUy5Y-LBS6FLVO989zjzHKhhRuEqupPm9vLK9FW_L4OjQdcBLAVNt2RuSt8lcxcliD2sYPyHuEgLcjva83Lxddi2-D72d4bRnH2nqBeD-f2vvM3dXHDj42GIvglhKVDD2h6zdaO_F-jdpczFRlkaq_PB4thv3EgUfudnxJR_SCuC0vJsDSlAzsaLEGAdOzVWziq4dzfuPpM7Ibn7IXRb2JjJMF69RelYmOGMc4A1xLOomPejufI9wflD99nqzGhAMfqtJf9O_ajoS_2WWlbm4raKrXpIiiMe6z8xkUkx002xr43USWmg%26sai%3DAMfl-YRHup6PyXWkAS2cpG270uCvZIowqaMzAqG9KXQ5016b60kRx-KUN9EKh62qnzqh-PU_scuP0yAESU2InvjdCR0E65gji0zSAs5Ud8ENv9h2tCdk332KAgsVCsliXS-G%26sig%3DCg0ArKJSzH_Zg9sZRPYbEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68$0;xdt=0;crlt=s!Ha(jb6nw;sttr=92;prcl=s Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Microsoft-IIS/10.0 / Resource Hash 1e3126f4b1713295ca3a4510ea8a6be422cfe78cc9603dc8351818edcc6a1254 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:18 GMT Content-Encoding gzip Last-Modified Tue, 07 Dec 2021 14:09:11 GMT Server Microsoft-IIS/10.0 ETag "801dd2174ebd71:0" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=900 Connection keep-alive Accept-Ranges bytes Content-Length 3288
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 514B	41 KB 15 KB	20ms 9ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1VhaaCptYdgfy2YRxmxeGE93TOMHPUy5Y-LBS6FLVO989zjzHKhhRuEqupPm9vLK9FW_L4OjQdcBLAVNt2RuSt8lcxcliD2sYPyHuEgLcjva83Lxddi2-D72d4bRnH2nqBeD-f2vvM3dXHDj42GIvglhKVDD2h6zdaO_F-jdpczFRlkaq_PB4thv3EgUfudnxJR_SCuC0vJsDSlAzsaLEGAdOzVWziq4dzfuPpM7Ibn7IXRb2JjJMF69RelYmOGMc4A1xLOomPejufI9wflD99nqzGhAMfqtJf9O_ajoS_2WWlbm4raKrXpIiiMe6z8xkUkx002xr43USWmg%26sai%3DAMfl-YRHup6PyXWkAS2cpG270uCvZIowqaMzAqG9KXQ5016b60kRx-KUN9EKh62qnzqh-PU_scuP0yAESU2InvjdCR0E65gji0zSAs5Ud8ENv9h2tCdk332KAgsVCsliXS-G%26sig%3DCg0ArKJSzH_Zg9sZRPYbEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68$0;xdt=0;crlt=s!Ha(jb6nw;sttr=92;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 12:52:35 GMT content-encoding gzip x-content-type-options nosniff age 81283 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 14 Dec 2022 12:52:35 GMT
GET H2	200	2522686165059468884 s0.2mdn.net/simgad/ Frame 514B	40 KB 40 KB	50ms 9ms	Image image/jpeg	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/simgad/2522686165059468884 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 205095ece048b22ff85dcfab438575886503bd236a7136b7d5934971f9c729a8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sat, 11 Dec 2021 10:00:24 GMT x-content-type-options nosniff age 350814 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40520 x-xss-protection 0 last-modified Fri, 29 Oct 2021 16:29:24 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Sun, 11 Dec 2022 10:00:24 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 514B	119 KB 36 KB	28ms 17ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:27:18 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 15 Dec 2021 11:27:18 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 32DF Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1	43 B 894 B	25ms 20ms	Image image/gif	2.21.141.232 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXSnwEQ97DF8gIYr5SQtgEwAQ&v=APEucNVkFuowKC9YFnExH_VKyEtS86CbLYt7FuVSHBGHZMTkIqRe60s56N6gsE91g1hszEOEebltGrkGvwoqJzoaSR53_L36rqPPPHFZYRsfl38NHc1X9cEa4jEjrHFg8pEswgyyyy8cQvuz3xDZ4tOuNAGoMWFwZQ Protocol HTTP/1.1 Server 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-141-232.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Wed, 15 Dec 2021 11:27:18 GMT Redirect headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 32DF Redirect Chain https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbnRFmpBB20p6UTNOxOmoAAA https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1	43 B 894 B	20ms 20ms	Image image/gif	2.21.141.232 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXSnwEQ97DF8gIYr5SQtgEwAQ&v=APEucNVkFuowKC9YFnExH_VKyEtS86CbLYt7FuVSHBGHZMTkIqRe60s56N6gsE91g1hszEOEebltGrkGvwoqJzoaSR53_L36rqPPPHFZYRsfl38NHc1X9cEa4jEjrHFg8pEswgyyyy8cQvuz3xDZ4tOuNAGoMWFwZQ Protocol HTTP/1.1 Server 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-21-141-232.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Wed, 15 Dec 2021 11:27:18 GMT Redirect headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG-V8FsfEW3A111yaKzKnMc&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	bounce ib.adnxs.com/ Frame 32DF Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm https://ib.adnxs.com/setuid?entity=101&code=CAESEGr8W9CYsBi7CCfEeRCu4wM&google_cver=1 https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGr8W9CYsBi7CCfEeRCu4wM%26google_cver%3D1	43 B 1 KB	11ms 11ms	Image image/gif	37.252.172.37 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGr8W9CYsBi7CCfEeRCu4wM%26google_cver%3D1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXSnwEQ97DF8gIYr5SQtgEwAQ&v=APEucNVkFuowKC9YFnExH_VKyEtS86CbLYt7FuVSHBGHZMTkIqRe60s56N6gsE91g1hszEOEebltGrkGvwoqJzoaSR53_L36rqPPPHFZYRsfl38NHc1X9cEa4jEjrHFg8pEswgyyyy8cQvuz3xDZ4tOuNAGoMWFwZQ Protocol HTTP/1.1 Server 37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT X-Proxy-Origin 78.47.208.30; 78.47.208.30; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 0580c2eb-2cc8-4d54-9842-879b5b6e7ee3 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin * Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT X-Proxy-Origin 78.47.208.30; 78.47.208.30; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid edb28385-0f8c-46bd-b61d-0116dca0f86f Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGr8W9CYsBi7CCfEeRCu4wM%26google_cver%3D1 Cache-Control no-store, no-cache, private Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame 32DF Redirect Chain https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg2NDE5Mjg2Nzc2Nzc0OTI1OQ%3D%3D	170 B 188 B	19ms 18ms	Image image/png	142.250.186.98 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg2NDE5Mjg2Nzc2Nzc0OTI1OQ%3D%3D Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXSnwEQ97DF8gIYr5SQtgEwAQ&v=APEucNVkFuowKC9YFnExH_VKyEtS86CbLYt7FuVSHBGHZMTkIqRe60s56N6gsE91g1hszEOEebltGrkGvwoqJzoaSR53_L36rqPPPHFZYRsfl38NHc1X9cEa4jEjrHFg8pEswgyyyy8cQvuz3xDZ4tOuNAGoMWFwZQ Protocol H3 Server 142.250.186.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT X-Proxy-Origin 78.47.208.30; 78.47.208.30; 691.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com AN-X-Request-Uuid 8313629e-9b79-414e-ab58-7a755bd629d4 Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg2NDE5Mjg2Nzc2Nzc0OTI1OQ%3D%3D Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3	200	abg_lite.js Show response pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 1DB7	24 KB 9 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:24:03 GMT content-encoding gzip x-content-type-options nosniff age 195 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9516 x-xss-protection 0 server cafe etag 14328493792227503680 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 29 Dec 2021 11:24:03 GMT
GET H3	200	7477554383104146381 s0.2mdn.net/simgad/ Frame 1DB7	11 KB 11 KB	27ms 8ms	Image image/gif	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/simgad/7477554383104146381 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e8d5c19629dda68271b67a4b053c061731f4c796df06343288541339ab8c7c97 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 14:06:12 GMT x-content-type-options nosniff age 76866 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11394 x-xss-protection 0 last-modified Wed, 03 Nov 2021 14:00:15 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/gif access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Wed, 14 Dec 2022 14:06:12 GMT
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame 1DB7	8 KB 3 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 15 Dec 2021 11:23:14 GMT content-encoding gzip x-content-type-options nosniff age 244 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 29 Dec 2021 11:23:14 GMT
POST H2	200	view googleads4.g.doubleclick.net/pcs/ Frame 1DB7	0 107 B	54ms 53ms	Ping image/gif	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvcysPnEkK7wmBZrCKLCKKQdv8USBUBZYI7TwlrCejele9x16XagYr1F6C-bdhZBcFaYBS5yxlHqtsJgDR2A9zJz_u21rlpHH0SD2IWL5AvCfBH_JTMItu4tNkpVJaints4TKzyUa4bZCpNvRzOyN-x2KIoFge8v8iJA3tRFOVAORDHUP2w5gIgl97LQm9Dv3kvVYQUuYtv5Hln9WTOPouqLC-35IPV9h05IPle0WXEnA-GPspn_YV_tyXlJhDRc43atIRfJv133-IK-lsy8GwweaZfAAP-kUnbASVJ9FyWjcahVFLrBNOO0T1bXYF47ztm_dpZ6EAiyBXqigqCFRO5kxr9fuLVQbLY8DnlOxejCNcGCSIOaAOhThdjZIVsXvxjHJ3ZWI6wfyiwHhwep5QzC7qYVY1kHlrVDYi2w2Fzjki4HKu4Pz_Lj5cJTC6WY4CT45U0-F9QAQMjeSIGaIBzz52FVhWNQIH1ex_vA-hcUzPdG2bDmyCnYv_ofRBG79t6WN_rnEWKonp0OcAF6ujvzz0CECg22AF0stS_ujloubO7wnJIy0XvxBk9N7bnFShRlxT8UQ_zqHphW6EKkWHp0dKfTrt4SHOplXNXYrsYehVHFEmPXRFpEdJieslzRnm3ESjpvA7jFxZr9YsN5hxuZRDUa5Je3QDmtl0E9j6Z8skfB6YaMajzHm9Uvo3VGqEAQuwQIps2ku73Fx5nCo8Ah1EPsb0nTR66y31nU4RNirP9uSJ9GriLoSpzQCl1Rmmud1dhbWnCuH6eJRfXvwdNg0twKp4TcJhWwF4rMY7C-nep5BtkxHZYJAKOFa5pagbXM7Vv44s7wHTEGPeSiU6U7R4bwbhHBzASSKNzjQqwslYvp9w3A3uEnppnZVR-ZUKDoUaENVJt2v74Ds3L6LgG1uGt1Fn7Ju_lGoibS7zw3EMuEUdif80Osx8wf_hv8bwLalxxWMPXsqq4Z3T6zRmSHsh2g5ITH5IvTeZxEaQd8q2eTAkJm5OVJEBFubqlDlNWUe1l0FtKUAC3gIK7WKiKydjAxZELzmipP0OXhgELNp4GWARuMBw-xeFnGNHp2N5SWjkTRcjW-spffpFlPr5eDt5c0lDNYEBvrgd5rxR0D_geZBygjbAQRArMADIx7pUhyFT8cdjB9X5n1SJ9zkkaYT1Z5mtPrsYtgS7Hg4KOzTOM-OzbmYKr3Rcy5Tb1jTnqXX79jIWeX0cDAs0rgcUlsZpb4hN4lAJD2XONM9ML&sai=AMfl-YTjTuJEeS9tA5zGzTZG674Nup5p4f-eIJ6BIRK8h6N6fhQmu2j8mTNjB8kglsXhGAy4tXOOIbymGfTicq26wiUc-OxcpaHTLRc7GjBoIcsiO8x9LvNDi0TuyIIrH3K9SkBMUQocfwoNuPGsVrDXo1M86z2kdBhw-RyVZ5E&sig=Cg0ArKJSzEhOoQRyir9JEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211207.05804&adurl= Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cad9XNJITZjeyMNqpKrcVgPQpRzuQf_qKUF1H_jSB7bQWAttDj6cyiy7PTGf9lM7rSpWvzUA26L3pL4viBhR_6f4aAvdFFGe2tnK5csygjg8p7LUbQjINpPGH0YS124fDLD0EmtRaDHb6FnRGwn3S9HQOGmA&dbm_d=AKAmf-BJ8SsdAWGtuVhgXPX2Ukf8UFN53Tq7Gzjc5Aac7SrQOv8E6IAmkfDWpz3i4WDY2hTs9vWxZ8xWeL8d5lJmZh3PTBNfLe-AE4JUSlK1H6AwsoCC47IQ4a1YjWVG1NmgTLpxg1ctk_RYbNCkq7tpg4KtTUgDq9sRS9AAbWsAJGt4OscitH9-ozWW4opDpCzwUR23o7xHeGBJA0YuWobr9VuCnyINeUlHC4E5pe5mJr5zy0cSaDS52cDmaAh9bqj5m1fVtr_siB9pZZvYL7Z_nBTD_6VKOkXqRa1bi1Poz-Ay3-JCKLTyo6uvk28uoBtjbuG0qIXUJDiG1QmDrc3QWnDBBhPCBif1rIsy1zxdogzvF2XxFeg2fMeOaAdc8Sgqn_NAvSD7yx3PPQBPZ4nmTkFcGv--VTmCnxUQSf6Snch-FZbX-Ftxnwtfso96H48XZLoJqhL71SASfAY8wQLyjr1urzBmn2fkkqsYrpcG7UQSPfnIUMJTt6b20xMKCQJ0dFMYRqV4OORAna5aOsU_Fc8T2_W-NXPWgoRqU3r7_o_HfzQn5Jh5lRWr4DI-4G0aKCYYFZx2YiMRmtwzg2WDm_LVTFZHu9Ucw1Lo0_sfQEAYPckUf5Hl2mjxj5iGfKhgj5VGJA8HMbnSAn_Vmwr0Hzq6OpV8UEXGNG3ccqM91jibLDQCPuyvExt8w9kmNwA2ChaXJjpjnvEF5KZsG7_NFdbTzgA-yk9AoNUxH-hZ7qghoRw7rZ_oyhEp07_oLH7w44P97CWyr4IeiiCNTL5I5Xfdms5uvJw78q9j4G5ND7JG-mYbebgnv79mloRt27Y6Iru3vaAyb9lzM8jhWkP1xBe5gj_rarapm_DzaCM5nJyfTSN7Dqu4t0Ypcs2LLWZIwFglKuynKQ45UlN3UQsop-x98rZxnY_3x_GnJbFXYcCCb9dRNlpVPOd-xLymHZhGyobpSzX5cR15q4C6TKhdN-gas1wCXsDfwfvquhcMOGINhMiM5jWlZXyaPQ4zaJkQQmTjwb8FoMg0Hslqufiv-q_iwAdIQljdvxiTEfatjHwpNEdc7XaCXcNS-QsxVDphl9lO1al7jKKdD4vqqmk5AQ4PD-A_mHFE2R89D1WI7q1hhqbm-LNzpdhFFgDA1P_2bWfk-7kf3r71UQBM5lz6PaHmsz26asAbssht5fRhbwex4xrrsNVxmPpCU_lsjxluO1oclU90xVQOHUAbcJ0YLt27iRve2po1Vfbz5m_BFlWOH_hDNiikxadJ3yAMtrAmMdfYfaCCdRC3WsWEPlg_MF_H8flhQWB2eN4q2uEjnhbHB1ZykZllYVkFE_GR0Lv7Rnbbl26lE6ogfc3sxECipeM4wFlDNAMRb87nUvPKiCPkxhUND7Gj26MsB5EZUMtEuXuMxSVX_-S7uWqHleIkpdJDngaMqLjrv_x35jFKJM9dqp1ZqWkydvFmt9rhBYULM_M2RRU2e58GwF1Oc7PlyV2wscWIvZ83c8nc--dhNDV7nOZA-eimpnPnKv0g1VV37B04-oTZ_wzC5Hg84Gwujg08RB77krsvU05-n4vl1ETjZHu3HvvioMX_BZcaCY0tizsIGvy9krh9LOL6Hyj2n4-wT52bt_IEHg9sCSHKgNwa6At_BVk4PT2uZuueNnb1meNiuo1rp_oJ-2UH7PQVNmQdF9jW5akhRKmZc3QCVWUL82KyA3wLU6xIrpo9LSvsy0s64otvxEIrLJE4bjCuzPmf__RlTbX1XZk4cnQfoK9Q7_b-rtKUm5l4vsWyNgZAkKFr04AwUpW_35Aymp2f3qLhhYEoDuuDIFz-F3h63kGH7rSCB4xTjAsxiwVzzU6NHC-yS2LwlzrmwKXEPljIjR_FZR0XDXWTfp9gwj6-_dRVtY7OV4S20PmnSyQzHJOvatbRWrxzr0UEqSBVc_iDq31yXZZrn6GSy4yaqw-et3DnyjVQ4Tzcb117JSMqyYrgiYVuO9FLGAoiLuLeZLX0VpX0ibLrAuBTHqMIfIZPSy-7X7e4QY8ISKjGT1Aib71YWQ0L7HSkFgIU50MyTSgyC6Tf-P9786dhAiZTLSFaQRyQQWn0_WxVObsNj-1AF2yQvWSvkuKJz_Aq58k-QimcCS725_hsftwG5qKTgp1JyhV87fy5aAh3UiIR3W_sgWpdfV6Pn35_jZAtZAfmuQu1p1b0w_bK1zSu8dqe-VUaqwhOzf_uWe8awrIYyTPjd54tuoGMg4XGFinhu-q2xuXEibTuEVVX_AvbBcp_6T-HK7eabNcSeRTz4f7ACj2VGArxsmzxIbnVdjSYBUuof1QgYJ7vu4BXV-rf7PWqYYId5Aqi3-kNWX-9BkoIFPiXSuVeb5rDOWmpHSFNyIvi2U31brWXMq_0b-17SMoV6RWIjZl-vDETDhf1DPMMbUYsm2Bd27d0BbEZ8qCawqNxwuKq_puoRqT3aLfHc8y8Z-9bB-ANPTJTL9N4fnxq8fbWTypNpgKbz0fD_UGDH9cIVvOaDba5UbiFGLdCHbHo-KMMOwo-dUZ7XH8MLxbgSW2GjOoZKoscOMBJFg0ZJiLD9MVvaiG5eD7I2tKJ8vOSyfi6TlA1U8bFWKiICBZJtUooaRX2t2U48i8TI-VmbiSb2aHAoKkW8IaX6TwDNoe8-jPwrQPeRtR1pR-K1CHoqB2N6s3Ia6F3vK8VBdzTGoeLbx08w0H4vrIFfjnuP29qu1NOjnjVE6Q1rVx6YylmQtFIF3XKSyebDLQbrplERA_dT-8jYHMFW0y3iTLzPvBipygVbe374S2iTQcAJgthyVkhZnWrOS5L0fLwLkL_t1UB6bbL2nO5sXRudEkZTNfsBgoDAM2qxeueVHa8Uv_X7hB87VtzryrOqC5cbqjzw3HOD-g-vDT0MV6oBnMXSBZaXr5tMl9i5jyh8zjTRUzIdxjfZHfg6H1cl_uum6Mg3If3z0yNUJwZ8x6qOaQ-D1e1HAh_JyVKb7_u4DWzqY-Khun203rT6VayC6lLFiIlZYF-D7dyijyR9ssavypvIDKsqHkHyMIkxhW0d3Zh0keXyuVkkMATo_2uuB3txOhB43U_W4dR0tTRmYW6Z62x9qPpzRTgOGb-RU-Odk9B5EF4qF8ESO-uV--ZegWJfJOGCCBE6xp4k8RV9-0iN3ea3o7J_6vnIHt3WkIf0sty7tX-mlnRa0FJyFoF1pH-GM23qDinsaS69yydfH4ls8_WDlRnIL-FAS5hmmaylnAUvXFRTPNdVQ-fqpuGf5yttYoxZlEtKxmY47K8SLG2EnnWBFxMmi-hHHkd7VK5u8u4qsRWRvTCk3_QEq5ALkBkTMvnep9ticGA4hKi0cUbn1vG2J0mXJzo3k91ccD5n1a7maPl6EujXoZjf2cig0X5tep12aIraABejrjAhsWAT8VPD41MgH2j4tzuCXQjGrNAW8PTj0vY6QGa4E7nqEmx&cid=CAASFeRoMt5Mh3JyX6QToICf15GzGNpHrw&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%252F%240 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version date Wed, 15 Dec 2021 11:27:18 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 1DB7	41 KB 15 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 12:52:35 GMT content-encoding gzip x-content-type-options nosniff age 81283 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 14 Dec 2022 12:52:35 GMT
GET H3	200	f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response pagead2.googlesyndication.com/bg/ Frame 79A2	35 KB 13 KB	12ms 9ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 21:32:16 GMT content-encoding br x-content-type-options nosniff age 50102 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13559 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 14 Dec 2022 21:32:16 GMT
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame 514B	0 23 B	60ms 44ms	Ping image/gif	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvqb-Gc2R0BdNEdg51DdwFiDhCCkceq1ErUYIF3_CrpkVMhulUcqkCi9U2a_A0-lYRdhIRlXzTKANV1RUShKW0Bu4t6XRUgBKV_czrVxFXiTV7_nOY0myCt6kjAGg40dYW0c_Jryh7BBq9vQNSFWzNW&sig=Cg0ArKJSzDdmggPwGzcoEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=111&vt=11&dtpt=110&dett=2&cstd=0&cisv=r20211207.24063&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: ad.doubleclick.net URL: https://ad.doubleclick.net/ddm/adj/N1153793.3518201CBSINTERACTIVEUK/B26699368.318185658;dc_ver=81.236;sz=300x600;u_sd=1;nel=1;dc_adk=545849083;ord=pvtke2;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstPyQGIs0gIVOYMtZnfsxgOcLwlAZi-id1VhaaCptYdgfy2YRxmxeGE93TOMHPUy5Y-LBS6FLVO989zjzHKhhRuEqupPm9vLK9FW_L4OjQdcBLAVNt2RuSt8lcxcliD2sYPyHuEgLcjva83Lxddi2-D72d4bRnH2nqBeD-f2vvM3dXHDj42GIvglhKVDD2h6zdaO_F-jdpczFRlkaq_PB4thv3EgUfudnxJR_SCuC0vJsDSlAzsaLEGAdOzVWziq4dzfuPpM7Ibn7IXRb2JjJMF69RelYmOGMc4A1xLOomPejufI9wflD99nqzGhAMfqtJf9O_ajoS_2WWlbm4raKrXpIiiMe6z8xkUkx002xr43USWmg%26sai%3DAMfl-YRHup6PyXWkAS2cpG270uCvZIowqaMzAqG9KXQ5016b60kRx-KUN9EKh62qnzqh-PU_scuP0yAESU2InvjdCR0E65gji0zSAs5Ud8ENv9h2tCdk332KAgsVCsliXS-G%26sig%3DCg0ArKJSzH_Zg9sZRPYbEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=1,https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68$0;xdt=0;crlt=s!Ha(jb6nw;sttr=92;prcl=s Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 514B	0 0	43ms 43ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssCmj1-1ZSGNBXBnqEXCiYa1Y-conAki_VKTXxfgunyQ3ltJNCaGAj_FxYAFboynMu1v9Ld9AJPNDq_YHdNSeCPT3ruR7rzyqKhIrPxSL6HihhjTCodgGD7hDrwx81fsu-9HAHpRagk13-ZIp2SEx_D6zN75HayOsEXkjprMjI6syOuYMvW8u8wX5hD66wZ0XVmupPUvgA6rq7tn0qE0CATJr6vTRq6WeSCB-tmx8VDNzE1HhpqCX496E5_FWB_zkqfccQpfyPRRHE_kjwlKtC8lF2MQLkrmy44L4p6C2uUPPM-rWWiDhnFFwEu5APQ_fPWcJdV9gpohm6NjgvKn0x6UoNW4t9wKtw9YEZI8d9bWi8SWBBHenEO&sai=AMfl-YRMYrDu0SDIjkz-DPjUYpSZyMDEjlPl7owavEyS-bjBgGND9edEYOvcOM-hPKDQz-zZDWZMzbUK4QvEQnoWg78bJv69uvPP3mntpLEvhMYNW2MnoijUSIF-6CnolM1G&sig=Cg0ArKJSzBuQIGU_QyFYEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Wed, 15 Dec 2021 11:27:18 GMT
GET DATA	200 OK	truncated / Frame 514B	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0488462e8c56be5e0c8bbe8f87095fef3319cdc2f12ca5434803d910da6ec4a8 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	14ms 13ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1639567638315&de=151056995922&m=0&ar=cc97a930ec1-clean&iw=101177c&q=12&cb=0&ym=0&cu=1639567638315&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5029661432%3A2929336068%3A5821501893%3A138370174589&zMoatW=300&zMoatH=600&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A402%3A402%3A1373%3A399&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=195926&na=1961037714&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	68ms 25ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5821501893&L4id=138370174589&S1id=22308610192&S2id=22654085702&ord=1639567638315&r=151056995922&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	64ms 21ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5821501893&L4id=138370174589&S1id=22308610192&S2id=22654085702&ord=1639567638315&r=151056995922&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	59ms 16ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=3&fi=1&apd=5&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5821501893&L4id=138370174589&S1id=22308610192&S2id=22654085702&ord=1639567638315&r=151056995922&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame 1DB7	0 23 B	49ms 49ms	Ping image/gif	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvcysPnEkK7wmBZrCKLCKKQdv8USBUBZYI7TwlrCejele9x16XagYr1F6C-bdhZBcFaYBS5yxlHqtsJgDR2A9zJz_u21rlpHH0SD2IWL5AvCfBH_JTMItu4tNkpVJaints4TKzyUa4bZCpNvRzOyN-x2KIoFge8v8iJA3tRFOVAORDHUP2w5gIgl97LQm9Dv3kvVYQUuYtv5Hln9WTOPouqLC-35IPV9h05IPle0WXEnA-GPspn_YV_tyXlJhDRc43atIRfJv133-IK-lsy8GwweaZfAAP-kUnbASVJ9FyWjcahVFLrBNOO0T1bXYF47ztm_dpZ6EAiyBXqigqCFRO5kxr9fuLVQbLY8DnlOxejCNcGCSIOaAOhThdjZIVsXvxjHJ3ZWI6wfyiwHhwep5QzC7qYVY1kHlrVDYi2w2Fzjki4HKu4Pz_Lj5cJTC6WY4CT45U0-F9QAQMjeSIGaIBzz52FVhWNQIH1ex_vA-hcUzPdG2bDmyCnYv_ofRBG79t6WN_rnEWKonp0OcAF6ujvzz0CECg22AF0stS_ujloubO7wnJIy0XvxBk9N7bnFShRlxT8UQ_zqHphW6EKkWHp0dKfTrt4SHOplXNXYrsYehVHFEmPXRFpEdJieslzRnm3ESjpvA7jFxZr9YsN5hxuZRDUa5Je3QDmtl0E9j6Z8skfB6YaMajzHm9Uvo3VGqEAQuwQIps2ku73Fx5nCo8Ah1EPsb0nTR66y31nU4RNirP9uSJ9GriLoSpzQCl1Rmmud1dhbWnCuH6eJRfXvwdNg0twKp4TcJhWwF4rMY7C-nep5BtkxHZYJAKOFa5pagbXM7Vv44s7wHTEGPeSiU6U7R4bwbhHBzASSKNzjQqwslYvp9w3A3uEnppnZVR-ZUKDoUaENVJt2v74Ds3L6LgG1uGt1Fn7Ju_lGoibS7zw3EMuEUdif80Osx8wf_hv8bwLalxxWMPXsqq4Z3T6zRmSHsh2g5ITH5IvTeZxEaQd8q2eTAkJm5OVJEBFubqlDlNWUe1l0FtKUAC3gIK7WKiKydjAxZELzmipP0OXhgELNp4GWARuMBw-xeFnGNHp2N5SWjkTRcjW-spffpFlPr5eDt5c0lDNYEBvrgd5rxR0D_geZBygjbAQRArMADIx7pUhyFT8cdjB9X5n1SJ9zkkaYT1Z5mtPrsYtgS7Hg4KOzTOM-OzbmYKr3Rcy5Tb1jTnqXX79jIWeX0cDAs0rgcUlsZpb4hN4lAJD2XONM9ML&sai=AMfl-YTjTuJEeS9tA5zGzTZG674Nup5p4f-eIJ6BIRK8h6N6fhQmu2j8mTNjB8kglsXhGAy4tXOOIbymGfTicq26wiUc-OxcpaHTLRc7GjBoIcsiO8x9LvNDi0TuyIIrH3K9SkBMUQocfwoNuPGsVrDXo1M86z2kdBhw-RyVZ5E&sig=Cg0ArKJSzEhOoQRyir9JEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=64&vt=11&dtpt=63&dett=2&cstd=0&cisv=r20211207.05804&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cad9XNJITZjeyMNqpKrcVgPQpRzuQf_qKUF1H_jSB7bQWAttDj6cyiy7PTGf9lM7rSpWvzUA26L3pL4viBhR_6f4aAvdFFGe2tnK5csygjg8p7LUbQjINpPGH0YS124fDLD0EmtRaDHb6FnRGwn3S9HQOGmA&dbm_d=AKAmf-BJ8SsdAWGtuVhgXPX2Ukf8UFN53Tq7Gzjc5Aac7SrQOv8E6IAmkfDWpz3i4WDY2hTs9vWxZ8xWeL8d5lJmZh3PTBNfLe-AE4JUSlK1H6AwsoCC47IQ4a1YjWVG1NmgTLpxg1ctk_RYbNCkq7tpg4KtTUgDq9sRS9AAbWsAJGt4OscitH9-ozWW4opDpCzwUR23o7xHeGBJA0YuWobr9VuCnyINeUlHC4E5pe5mJr5zy0cSaDS52cDmaAh9bqj5m1fVtr_siB9pZZvYL7Z_nBTD_6VKOkXqRa1bi1Poz-Ay3-JCKLTyo6uvk28uoBtjbuG0qIXUJDiG1QmDrc3QWnDBBhPCBif1rIsy1zxdogzvF2XxFeg2fMeOaAdc8Sgqn_NAvSD7yx3PPQBPZ4nmTkFcGv--VTmCnxUQSf6Snch-FZbX-Ftxnwtfso96H48XZLoJqhL71SASfAY8wQLyjr1urzBmn2fkkqsYrpcG7UQSPfnIUMJTt6b20xMKCQJ0dFMYRqV4OORAna5aOsU_Fc8T2_W-NXPWgoRqU3r7_o_HfzQn5Jh5lRWr4DI-4G0aKCYYFZx2YiMRmtwzg2WDm_LVTFZHu9Ucw1Lo0_sfQEAYPckUf5Hl2mjxj5iGfKhgj5VGJA8HMbnSAn_Vmwr0Hzq6OpV8UEXGNG3ccqM91jibLDQCPuyvExt8w9kmNwA2ChaXJjpjnvEF5KZsG7_NFdbTzgA-yk9AoNUxH-hZ7qghoRw7rZ_oyhEp07_oLH7w44P97CWyr4IeiiCNTL5I5Xfdms5uvJw78q9j4G5ND7JG-mYbebgnv79mloRt27Y6Iru3vaAyb9lzM8jhWkP1xBe5gj_rarapm_DzaCM5nJyfTSN7Dqu4t0Ypcs2LLWZIwFglKuynKQ45UlN3UQsop-x98rZxnY_3x_GnJbFXYcCCb9dRNlpVPOd-xLymHZhGyobpSzX5cR15q4C6TKhdN-gas1wCXsDfwfvquhcMOGINhMiM5jWlZXyaPQ4zaJkQQmTjwb8FoMg0Hslqufiv-q_iwAdIQljdvxiTEfatjHwpNEdc7XaCXcNS-QsxVDphl9lO1al7jKKdD4vqqmk5AQ4PD-A_mHFE2R89D1WI7q1hhqbm-LNzpdhFFgDA1P_2bWfk-7kf3r71UQBM5lz6PaHmsz26asAbssht5fRhbwex4xrrsNVxmPpCU_lsjxluO1oclU90xVQOHUAbcJ0YLt27iRve2po1Vfbz5m_BFlWOH_hDNiikxadJ3yAMtrAmMdfYfaCCdRC3WsWEPlg_MF_H8flhQWB2eN4q2uEjnhbHB1ZykZllYVkFE_GR0Lv7Rnbbl26lE6ogfc3sxECipeM4wFlDNAMRb87nUvPKiCPkxhUND7Gj26MsB5EZUMtEuXuMxSVX_-S7uWqHleIkpdJDngaMqLjrv_x35jFKJM9dqp1ZqWkydvFmt9rhBYULM_M2RRU2e58GwF1Oc7PlyV2wscWIvZ83c8nc--dhNDV7nOZA-eimpnPnKv0g1VV37B04-oTZ_wzC5Hg84Gwujg08RB77krsvU05-n4vl1ETjZHu3HvvioMX_BZcaCY0tizsIGvy9krh9LOL6Hyj2n4-wT52bt_IEHg9sCSHKgNwa6At_BVk4PT2uZuueNnb1meNiuo1rp_oJ-2UH7PQVNmQdF9jW5akhRKmZc3QCVWUL82KyA3wLU6xIrpo9LSvsy0s64otvxEIrLJE4bjCuzPmf__RlTbX1XZk4cnQfoK9Q7_b-rtKUm5l4vsWyNgZAkKFr04AwUpW_35Aymp2f3qLhhYEoDuuDIFz-F3h63kGH7rSCB4xTjAsxiwVzzU6NHC-yS2LwlzrmwKXEPljIjR_FZR0XDXWTfp9gwj6-_dRVtY7OV4S20PmnSyQzHJOvatbRWrxzr0UEqSBVc_iDq31yXZZrn6GSy4yaqw-et3DnyjVQ4Tzcb117JSMqyYrgiYVuO9FLGAoiLuLeZLX0VpX0ibLrAuBTHqMIfIZPSy-7X7e4QY8ISKjGT1Aib71YWQ0L7HSkFgIU50MyTSgyC6Tf-P9786dhAiZTLSFaQRyQQWn0_WxVObsNj-1AF2yQvWSvkuKJz_Aq58k-QimcCS725_hsftwG5qKTgp1JyhV87fy5aAh3UiIR3W_sgWpdfV6Pn35_jZAtZAfmuQu1p1b0w_bK1zSu8dqe-VUaqwhOzf_uWe8awrIYyTPjd54tuoGMg4XGFinhu-q2xuXEibTuEVVX_AvbBcp_6T-HK7eabNcSeRTz4f7ACj2VGArxsmzxIbnVdjSYBUuof1QgYJ7vu4BXV-rf7PWqYYId5Aqi3-kNWX-9BkoIFPiXSuVeb5rDOWmpHSFNyIvi2U31brWXMq_0b-17SMoV6RWIjZl-vDETDhf1DPMMbUYsm2Bd27d0BbEZ8qCawqNxwuKq_puoRqT3aLfHc8y8Z-9bB-ANPTJTL9N4fnxq8fbWTypNpgKbz0fD_UGDH9cIVvOaDba5UbiFGLdCHbHo-KMMOwo-dUZ7XH8MLxbgSW2GjOoZKoscOMBJFg0ZJiLD9MVvaiG5eD7I2tKJ8vOSyfi6TlA1U8bFWKiICBZJtUooaRX2t2U48i8TI-VmbiSb2aHAoKkW8IaX6TwDNoe8-jPwrQPeRtR1pR-K1CHoqB2N6s3Ia6F3vK8VBdzTGoeLbx08w0H4vrIFfjnuP29qu1NOjnjVE6Q1rVx6YylmQtFIF3XKSyebDLQbrplERA_dT-8jYHMFW0y3iTLzPvBipygVbe374S2iTQcAJgthyVkhZnWrOS5L0fLwLkL_t1UB6bbL2nO5sXRudEkZTNfsBgoDAM2qxeueVHa8Uv_X7hB87VtzryrOqC5cbqjzw3HOD-g-vDT0MV6oBnMXSBZaXr5tMl9i5jyh8zjTRUzIdxjfZHfg6H1cl_uum6Mg3If3z0yNUJwZ8x6qOaQ-D1e1HAh_JyVKb7_u4DWzqY-Khun203rT6VayC6lLFiIlZYF-D7dyijyR9ssavypvIDKsqHkHyMIkxhW0d3Zh0keXyuVkkMATo_2uuB3txOhB43U_W4dR0tTRmYW6Z62x9qPpzRTgOGb-RU-Odk9B5EF4qF8ESO-uV--ZegWJfJOGCCBE6xp4k8RV9-0iN3ea3o7J_6vnIHt3WkIf0sty7tX-mlnRa0FJyFoF1pH-GM23qDinsaS69yydfH4ls8_WDlRnIL-FAS5hmmaylnAUvXFRTPNdVQ-fqpuGf5yttYoxZlEtKxmY47K8SLG2EnnWBFxMmi-hHHkd7VK5u8u4qsRWRvTCk3_QEq5ALkBkTMvnep9ticGA4hKi0cUbn1vG2J0mXJzo3k91ccD5n1a7maPl6EujXoZjf2cig0X5tep12aIraABejrjAhsWAT8VPD41MgH2j4tzuCXQjGrNAW8PTj0vY6QGa4E7nqEmx&cid=CAASFeRoMt5Mh3JyX6QToICf15GzGNpHrw&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%252F%240 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame A0A8	22 KB 8 KB	10ms 9ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Tue, 14 Dec 2021 12:52:35 GMT expires Wed, 14 Dec 2022 12:52:35 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 81283 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated / Frame 1DB7	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e09a710b0638a594252c6dad1886b0d0d224ef62391570ba44f83c8ce4073f97 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame 8495	22 KB 8 KB	19ms 18ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://f87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Tue, 14 Dec 2021 12:52:35 GMT expires Wed, 14 Dec 2022 12:52:35 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 81283 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	11ms 10ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2Fsimgad%2F2522686165059468884&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639567638315&de=151056995922&cu=1639567638315&m=15&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3573&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A402%3A402%3A1373%3A399&as=0&ag=3&an=0&gf=3&gg=0&ix=3&ic=3&ez=1&aj=1&pg=100&pf=0&ib=1&cc=0&bw=3&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5821501893%3A138370174589&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DOMSEARCH&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=3&jm=-1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=195926&na=440530357&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H/1.1	200 OK	dv-measurements1940.js Show response cdn.doubleverify.com/ Frame 8BD7	490 KB 89 KB	21ms 20ms	Script application/javascript	2a02:26f0:6c00:2b2::4469 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn.doubleverify.com/dv-measurements1940.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Microsoft-IIS/10.0 / Resource Hash a017571443bb27ca29ee2d9221639df656b0b5f3b0f370fc68aac31fa98ef30c Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:18 GMT Content-Encoding gzip Last-Modified Tue, 07 Dec 2021 09:41:32 GMT Server Microsoft-IIS/10.0 ETag "02ee99d4eebd71:0" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=946080900 Connection keep-alive Accept-Ranges bytes Content-Length 91098
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	21ms 13ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=114&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=ransomware&ord=1639567637387&r=17701651727&t=meas&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=80aacfc0-c333-458b-867d-5889a83a97c9&gpt_target_ptype=article&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Ftechnology%2Fsecurity%2Fcyber-threats%2Fransomware&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	20ms 13ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=114&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=ransomware&ord=1639567637387&r=17701651727&t=nht&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=80aacfc0-c333-458b-867d-5889a83a97c9&gpt_target_ptype=article&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Ftechnology%2Fsecurity%2Fcyber-threats%2Fransomware&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	12ms 11ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&zMoatAdUnit4=cyber-threats&wf=1&ra=3&pxm=&sgs=3&vb=5&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ff87d57b8ef8c78d20697e225217e1623.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&zMoatpos=middle&zMoatvguid=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatptype=article&zMoatsl=mpu-middle%3FLL%7CT-1000&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=250&w=300&rm=1&fy=1050&gp=1602.203125&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639567637387&de=17701651727&cu=1639567637387&m=1080&ar=8ab009d7785-clean&iw=04a0275&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1602.203125&lb=3573&le=1&lf=102&lg=1&lh=17&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A402%3A402%3A1373%3A399&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=114&cd=0&ah=114&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=ransomware&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&jk=2&jm=-1&tc=0&fs=195979&na=791237571&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H3	200	b_8rsBg2pSAE7OSEuXeXkmKAJRzK7XLbOE8Wp2RNR2Q.js Show response pagead2.googlesyndication.com/bg/ Frame A0A8	35 KB 13 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/b_8rsBg2pSAE7OSEuXeXkmKAJRzK7XLbOE8Wp2RNR2Q.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6fff2bb01836a52004ece484b97797926280251ccaed72db384f16a7644d4764 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 10:32:08 GMT content-encoding br x-content-type-options nosniff age 89710 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13622 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 14 Dec 2022 10:32:08 GMT
GET H3	200	f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Show response pagead2.googlesyndication.com/bg/ Frame 8495	35 KB 13 KB	9ms 9ms	Script text/javascript	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/f8gou5y2Dfq0zn72-W9hYw99gWviw2ua4IRi-orcC78.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7fc828bb9cb60dfab4ce7ef6f96f61630f7d816be2c36b9ae08462fa8adc0bbf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 14 Dec 2021 21:32:16 GMT content-encoding br x-content-type-options nosniff age 50102 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13559 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 14 Dec 2022 21:32:16 GMT
GET H/1.1	200 OK	visit.js Show response tps.doubleverify.com/ Frame 8BD7	2 KB 2 KB	98ms 16ms	Script text/javascript	34.149.12.213 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=72&ttfrms=29&bridua=3&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5DK5%3F6E%5D4%40%3ETau2CE%3A4%3D6Tau%3C9%40%3FD2C%3A%5CC2%3FD%40%3EH2C6%5C%3AC2%3F%3A2%3F%5C8C%40FA%5C%3F6%3E6D%3AD%5C%3C%3AEE6%3F%5CD66%3F%5C6IA%3D%40%3AE%3A%3F8%5C%3D%408c%3BTauTab7E28Tbs%23%24%2432773egU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5DK5%3F6E%5D4%40%3ETar9EEADTbpTauTauHHH%5DK5%3F6E%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=326&ddur=153&uid=1639567638528815&jsCallback=dvCallback_1639567638528529&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F96.0.4664.93%20Safari%2F537.36&htmlmsging=1&chro=0&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&dvp_isOnHead=1&jsver=1940&tgjsver=1940&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F&fwc=0&fcl=1772&flt=14&fec=889&fcifrms=9&brh=2&sdf=2&dvp_epl=325&noc=4&ctx=3758893&cmp=26699368&sid=5755331&plc=318185658&crt=160249888&btreg=510963286&btadsrv=doubleclick&adsrv=1&advid=9640137&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=327232508.47916096&dvp_tukv=74950105745.67442&dvp_uuid=99960323666.44945&dvp_tuid=16720175626 Requested by Host: cdn.doubleverify.com URL: https://cdn.doubleverify.com/dv-measurements1940.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.149.12.213 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 213.12.149.34.bc.googleusercontent.com Software / Resource Hash 33386a7cf883f1684586ba57bb6cf51448de6e8b175200ab58110770bdcb86e0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:18 GMT Cache-Control max-age=0 Connection keep-alive Content-Type text/javascript Transfer-Encoding chunked Expires 12/14/2021 11:27:18
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	8ms 8ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=233&fi=1&apd=235&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5821501893&L4id=138370174589&S1id=22308610192&S2id=22654085702&ord=1639567638315&r=151056995922&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=4&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	8ms 8ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=210&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=ransomware&ord=1639567637387&r=17701651727&t=hdn&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=80aacfc0-c333-458b-867d-5889a83a97c9&gpt_target_ptype=article&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Ftechnology%2Fsecurity%2Fcyber-threats%2Fransomware&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:18 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	43ms 43ms	Image image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2021120601&jk=3841504468304820&bg=!W1ilWBzNAAZKWFskSlg7ACkAdvg8WkqiK8u4hbIpW6u31RI1G91fqgS6ZTwT4WP-a8ileSydMpeVGQIAAAFhUgAAACRoAQeZArAA8zvMwRPCbfCXznx_7YxZXyGYGNWQWCNhoN6HxwHPcHJH3tawq1udIJB476apG3sgqjG_ift5fEMi_mHn-UugYY4TPLqTI81ZLgCnzdsxjey2f1yfmp2rklSyjoBqjJhAEbH-lJbt1TZuwD6x9MdsZz4nryNPsjVxf_2ePGEaRdcRE7Oy9niEzgN6VN82zaTCYzua3pTrecXK5I2t4Tv-i7hXTaR-zOri1DkJTiUTNzwl12vW6dApeMgHa2Gg3b57x3ANjMuiA1IXUi9ncyNzS2u_snSEhm3p16DgHryt55rMzod3m2S0Snz6PUcbopjd0qslioqAE1XtB0WQtj0mgun0PQb4gyR3Jz62elQo6P8TXNrTY6tPw_SzgM28fR61KoBbVvQmsUopBiTmc6Ew69Ki8efZPX_fGPPx-VQDXus0u2y_UrseAgah0theyOCcw9aCglINt4wP9sihZs-HCwRGF4c_d0Pk5cjnCGsxWRR-B9-ttpTRvUGfspkxXFUJ8WTsc03zG6V7j3zuSU-gxTSwCszht6QuhgrYnGkhENto6d6HdOrcNmRP-TNeGJYEF_ozFxD9Qx_d-Sd8e-cL8678BwIaHomtP0jDUiznHW-PCQOYn4P2NssF8A04B68ccwfou2X-VcSxa6Gip030rYFTBrSfl3yFbg5lGV94Y0cLYvAO3TdVjZn8GmnPfPjDkDOwEZxKNEtq05-rJs-_K66it1aCvjWFPBQ9cHAHQQbVUGecX6JIJcvUxKUPIuUt_dBihCCMuLRaByg4rqvcvnYF6WxOipnZg6sWR_s-QxEKuo9u5S7rS98bBn0nFP8zRVQ5lfIk9KDZDCMCNtTVQtDB0b-hAzwuF7Mc1fGIaN6ZZVAT0YaWBzhoB9znFqEgPZ8pwEiLLABRZBHAzdPj Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame A0A8	0 20 B	44ms 44ms	Image image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=By75vFtG5YYO6BbyV9u8P-K6XQAAAAAA4AeAEAg&bg=!5-Sl5KDNAAZKWFskSlg7ACkAdvg8Wlld9Ny10dcHp3q54m3gFohGk3goqYN5sxS1ubrSFSPMduZtigIAAAD1UgAAABFoAQcKAHlOAMdjpcND5w0b1DfGLxAxX65PKA0fR753wHeOlPQY7Omu_uH1nBvtMJI0UUChJ3YQoWCQ0rpNKovE4mKPOKvZQ8ouNdq6I_lnD8g2zcY1dyL4x3zcxkJcKvBlS1irfglKJd9JCoKkD-HLCJhfN6gtP9zb4GFTQ_C5mQLjEvAEMGRcX3SAu6pZVLPDI5JfjNOkXpj0T6Fdknehuze_ZMkX9_kie3aVf4A6siNBfysdABl4nDleNqVlXACvXxR2eV_GHLyvzZMY2Hz0w1w9AMXKPTNXkPgz5lEuG_LbRfITj8SkGicX263dLQ38Qz4zpc77vyl1wtrayl8fcm_0YcCFXBVhkhxmTd_wjRbot-HP_bQ7p6-n_VzwNz4UKVztQb5NXZ50mv_JKQNKXvTvTCpjKoZlmvzZnPfR3y7nYu4HBvchcowe2LyD4g4nQlB_awvoVQOBi6NrrCGl4mZAmDtqW4vj5hUQbBP6F8FfVQS4ptv-nIfVfj2twb7JR49OQdyGybDMoLB6Z-TbXd6c7we2aoxImCWsNSCHhw9aCMC9YsoWk62PxC4qoe8xZioi-cyzWNYkLd3LrHWrL0a1WOUYCagdFoSht0ZV0VqO2CQh-6DQd-PMHBtu82-KZkJY2GL8J8rBhpmau5hzyZI0i_00UGrhTq58tKHgWiXgRTSihDsv_MwyGabzqLpq06aWaG53einZwSpEzJhEJ1oWKGVPwR2R1KWF_TkQnX45UpN7HCwUlLBOgd0_Z2_5iwzEdCLpT3KhpS8MOuOGUCd1tSvssPXe890bGx6b0d2e7JObr0Yp5zSvsbIce9WkMQAyna8WaSw_Ug3M5RrGyZrk7XfPgjedNjzNLi8OeWKhfsWBvmUsygqzX2-3PmkGFd-JSenHtUBikgrhU7p06OiLkv9WGtCDX1z7jAJyu1zGWXsih6nWdADgXTmZbYsbso6lsuPi7I8zDtcOHe-gpVJWYgFqKUVDsoGbq0t5M4Mr8FyPj5xmjlrWsdxgLZKoL1mwRZeCTHL5-KYGZFl6a_VVNnE6fK--mEy50RFq1NwpytLh1ngMmhrYLkBzeYOmE67dCXO-AjH-kpAtnyTs5umav90irBNFMt30AyuAHgVNaWHifWH3fZdcFHkqohZqv-epQw Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 8495	0 20 B	43ms 43ms	Image image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BD-BEFtG5Yd7VCMn87_UPrf6rmA4AAAAAOAHgBAI&bg=!kJOlk9fNAAZKWFskSlg7ACkAdvg8WogkhqSI1JEve160pqyFw-UZNOF2113xtCnhXSFtlp_JoFPWfQIAAAD-UgAAAA5oAQcKAClx9LSHglWtVSTeQnC3D4PvLtJYBCU_7EINxXNBsuBG5pP6eFDnUdi0XJkC71W4Zl9awRXzdphs-tJMitJTYt6BSxr_0k-2d30WVJKnmn7yqnPYdqcRqQP98DWiudE5PeJXCEiP_XGcu_pyp0Q14-g6XQN9QV4eFTWp1TMYlnZ6HyTKPScB9DXEIwfGWwuaI-AU48W0HDh_d3VM0lYRNEReO1f4GLJ_GMVizUzAdvT5KhjlvGJrgv7aRSKtGrtrmY2cRqW7-JzIZ5M56lMeCS04glVYbuLk3zkA2ljQCLrXOOVh_BbExVu68MotPiB5JUXdxVtRmdnowF7t2skXyLV_3YuG1y1ysBLMz6PbHgV9spoygtodJM-XHiW4jMHcM83J_n3g8SN1iLxlLTHVanHbXhMSR6n6vX4Ep8ObYZ3OKHTGleY0q2hMPWVibeaemYqtCaQOzwlsD_qdKlSN1wGBrZobvdaaFhb9Lox41LWXsbQ4qUdPsneK_urKxVrdlx48gCVuKuMWlYtlK3a7jeeD8ZBld-PTcrzICmlugDS5-rVbeTDZhFDCG15DaEQC8AIUP-KAE0iLRrZRnf4SX8TGpUyj5U__GeN4aqcI9Vjkk9QQgFlZsmAGkr6UGAREaNZhHJjFXJH7ihqyaMwikN-2F1EC6i-Kjg0Z1pEdHB1oUTNpfDsm8YYsp92rnmamn5DTjxJZlfY-OMd6qTJLUXJ2KCF6oKN1dCOUxXhGA1fGNef7y8gU7d8XpcEDNJDJM2rL6AX24O6nU7-GbO8xX57AjXvkIfBnFNoRyRn5u9yLOxDcH9Xr6hLvnyPyiqjlk9klBeBS5_yO1XMZSVLJr4YtbRC6BWLlgWDLYcsLt0tdwVTLqdACqvTfOX6cSynzoaqj2Ox5LStJjP_b2_7P5CX1haB5TjuREA6Y8WXIO_Gx0r9Pz-hkOEGTChhpQn9ujojtqZeGgu6lYahWxjfEXqUxZjkv4xvvVNYAUhDnAMNHcWaqX6VtLpxVIzG-51Pe_SEqgqK3C21rvKWGiPfDXJffu2jBHndOyTKEyo0 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:18 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview pagead2.googlesyndication.com/pcs/ Frame 6F69	42 B 64 B	46ms 45ms	Image image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsupu607sv7Fr9HJRqT7WcJsg8w-D77na1B5C1wUMPmPNb-xFZJuWqMoQr2j0ZisnRmiQRzia753bQLuhHl3OUyRROXQAuTIaabK8sMdGvVKvWm7I9VmyQ&sai=AMfl-YTA_HoxL91FkUCLPtP3ZNzUwR10otuz74K2NqIhS7J8tdUtE-6Gblq3h4IikldoXJu3y2lWGugN8Sx5uD4nADBwfjBd7YUetHq0T7xMPoqip45X3qwhEiiipquAl1g&sig=Cg0ArKJSzLeQEHor9WPWEAE&id=ampim&o=436,5&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=194&tls=1195&g=100&h=100&tt=1195&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=3155022550 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 514B	42 B 64 B	60ms 42ms	Fetch image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvGCY6-PXG1wlmZyri-YQJbfL_cmIVJBa1yl_dAReFlwGvUEnm09a1lUrvDMGzVWdtheWdFePeAUo61DBXGlPQ9N2-dKllaYgzPQhZhLUy2o2f39GHV&sig=Cg0ArKJSzO5sdP_vlS7gEAE&id=lidar2&mcvt=1000&p=451,1050,1051,1350&mtos=892,1000,1000,1000,1000&tos=892,108,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=2925621730&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639567637864&rpt=435&isd=0&lsd=0&met=ie&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 514B	42 B 64 B	59ms 42ms	Fetch image/gif	2a00:1450:4001:810::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvrnL0lR-ShRd_QgOcp5pKrk4ZIQMuitqCvSoUfjgTFC-Z1-6Il9mZ2syVsRCffhN7-ExYaHbCz-_SxasnIhl04WMPD_AAg5Is&sig=Cg0ArKJSzNzoizPZKSV-EAE&id=lidar2&mcvt=1001&p=0,0,600,300&mtos=893,1001,1001,1001,1001&tos=893,108,0,0,0&v=20211202&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=545849083&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1639567637864&rpt=439&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	19ms 18ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639567638315&de=151056995922&cu=1639567638315&m=1057&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3423&le=1&lf=0&lg=1&lh=29&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A402%3A402%3A1373%3A399&as=1&ag=1051&an=3&gi=1&gf=1051&gg=3&ix=1051&ic=1051&ez=1&ck=1051&kw=852&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1051&bx=3&ci=1051&jz=852&dj=1&aa=0&ad=933&cn=0&gk=933&gl=0&ik=933&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=852&cd=5&ah=852&am=5&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5821501893%3A138370174589&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=195926&na=1886451370&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:19 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	25ms 25ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=852&tet=1051&fi=1&apd=1053&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5029661432&L2id=2929336068&L3id=5821501893&L4id=138370174589&S1id=22308610192&S2id=22654085702&ord=1639567638315&r=151056995922&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatPS=top&zMoatPT=article&zMoatSL=mpu-plus-top%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=5&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:19 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	13ms 12ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639567638315&de=151056995922&cu=1639567638315&m=1060&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3423&le=1&lf=0&lg=1&lh=29&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A402%3A402%3A1373%3A399&as=1&ag=1051&an=1051&gi=1&gf=1051&gg=1051&ix=1051&ic=1051&ez=1&ck=1051&kw=852&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1051&bx=1051&ci=1051&jz=852&dj=1&aa=0&ad=933&cn=933&gk=933&gl=933&ik=933&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=852&cd=852&ah=852&am=852&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5821501893%3A138370174589&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=195926&na=1592001954&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:19 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	11ms 11ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639567638315&de=151056995922&cu=1639567638315&m=1061&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3423&le=1&lf=0&lg=1&lh=29&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A402%3A402%3A1373%3A399&as=1&ag=1051&an=1051&gi=1&gf=1051&gg=1051&ix=1051&ic=1051&ez=1&ck=1051&kw=852&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1051&bx=1051&ci=1051&jz=852&dj=1&aa=0&ad=933&cn=933&gk=933&gl=933&ik=933&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=852&cd=852&ah=852&am=852&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5821501893%3A138370174589&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=4&jm=-1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=195926&na=1467995102&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:19 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	9ms 9ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x600&zMoatPS=top&zMoatSZPS=300x600%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=5&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=-&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-ODyHsWUP%2FoUsOmg7a7FqTWME4Q6dwotBXKPgx%2FCwrOl2tvmQftrLjI5jaRxplbfkuwe%2B&rs=1-ltsW7OXurgpsfw%3D%3D&sc=1&os=1-Yg%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=799912607017&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639567638315&de=151056995922&cu=1639567638315&m=1263&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3423&le=1&lf=0&lg=1&lh=29&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A402%3A402%3A1373%3A399&as=1&ag=1257&an=1051&gi=1&gf=1257&gg=1051&ix=1257&ic=1257&ez=1&ck=1051&kw=852&aj=1&pg=100&pf=100&ib=1&cc=1&bw=1257&bx=1051&ci=1051&jz=852&dj=1&aa=1&ad=1139&cn=933&gn=1&gk=1139&gl=933&ik=1139&co=1139&cp=1053&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1053&cd=852&ah=1053&am=852&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5029661432%3A2929336068%3A5821501893%3A138370174589&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=600&zMoatVGUID=80aacfc0-c333-458b-867d-5889a83a97c9&zMoatSN=c&zMoatSL=mpu-plus-top%3FLL%7CT-1000&zMoatMMV_MAX=na&zMoatSlotId=mpu-plus-top&zMoatCURL=zdnet.com%2Farticle%2Fkhonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j&zMoatDev=Desktop&zMoatDfpSlotId=mpu-plus-top&hv=DCM%20ins&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tz=mpu-plus-top&iq=na&tt=na&tu=&tp=&tc=0&fs=195926&na=1328303010&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 15 Dec 2021 11:27:19 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Wed, 15 Dec 2021 11:27:19 GMT
GET H/1.1	200 OK	results.txt Show response jyx5ahqxg6q4synz2elq-pibfvk-3c24126f3-clientnsv4-s.akamaihd.net/eum/ Frame 0C93 Redirect Chain https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pibfvkc51 https://jyx5ahqxg6q4synz2elq-pibfvk-3c24126f3-clientnsv4-s.akamaihd.net/eum/results.txt	8 B 312 B	318ms 9ms	XHR text/plain	23.55.161.201 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://jyx5ahqxg6q4synz2elq-pibfvk-3c24126f3-clientnsv4-s.akamaihd.net/eum/results.txt Protocol HTTP/1.1 Server 23.55.161.201 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-55-161-201.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:20 GMT Last-Modified Wed, 08 May 2013 07:51:12 GMT Server AkamaiNetStorage ETag "402e7a087747cb56c718bde84651f96a:1367999472" Content-Type text/plain Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 8 Redirect headers Location https://jyx5ahqxg6q4synz2elq-pibfvk-3c24126f3-clientnsv4-s.akamaihd.net/eum/results.txt Date Wed, 15 Dec 2021 11:27:19 GMT Server AkamaiGHost Connection keep-alive Access-Control-Allow-Origin * Content-Length 0
GET H/1.1	200 OK	results.txt Show response fiaqj6abkaqaqkqce3ygyaaaabq3tuiy-pibfvk-f3244754b-clienttons-s.akamaihd.net/eum/ Frame 0C93 Redirect Chain https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pibfvkc51 https://fiaqj6abkaqaqkqce3ygyaaaabq3tuiy-pibfvk-f3244754b-clienttons-s.akamaihd.net/eum/results.txt	8 B 312 B	364ms 8ms	XHR text/plain	2a02:26f0:6c00::210:ba13 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://fiaqj6abkaqaqkqce3ygyaaaabq3tuiy-pibfvk-f3244754b-clienttons-s.akamaihd.net/eum/results.txt Protocol HTTP/1.1 Server 2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 11:27:20 GMT Last-Modified Wed, 08 May 2013 07:51:12 GMT Server AkamaiNetStorage ETag "402e7a087747cb56c718bde84651f96a:1367999472" Content-Type text/plain Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 8 Redirect headers Location https://fiaqj6abkaqaqkqce3ygyaaaabq3tuiy-pibfvk-f3244754b-clienttons-s.akamaihd.net/eum/results.txt Date Wed, 15 Dec 2021 11:27:20 GMT Server AkamaiGHost Connection keep-alive Access-Control-Allow-Origin * Content-Length 0
POST H/1.1	204 No Content	/ 684dd32c.akstat.io/	0 354 B	335ms 315ms	Ping image/gif	2a02:26f0:7100:199::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://684dd32c.akstat.io/ Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:7100:199::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Wed, 15 Dec 2021 11:27:20 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Wed, 15 Dec 2021 11:27:20 GMT
POST H/1.1	204 No Content	event.png tpsc-eu3.doubleverify.com/ Frame 8BD7	0 254 B	47ms 10ms	Ping text/plain	34.149.12.213 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpsc-eu3.doubleverify.com/event.png?impid=3228c00673ae48eabc48a495b3850aba&gdpr=&gdpr_consent=&vdur=99&eoid=8&msrjs=1940&pltfrm=Linux%20x86_64&sdf=2&vit=2&isvelg=1&tltms=153&tetms=8&msltms=31&vltms=99&sei=290&vetms=102&engms=1&engisel=1&ttfurm=2229&mpt=1639567640732786 Requested by Host: cdn.doubleverify.com URL: https://cdn.doubleverify.com/dv-measurements1940.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.149.12.213 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 213.12.149.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.zdnet.com Pragma no-cache Date Wed, 15 Dec 2021 11:27:20 GMT Cache-Control max-age=0 Access-Control-Allow-Credentials true Connection keep-alive Expires 12/14/2021 11:27:20
POST H/1.1	204 No Content	event.png tpsc-eu3.doubleverify.com/ Frame 8BD7	0 254 B	11ms 11ms	Ping text/plain	34.149.12.213 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpsc-eu3.doubleverify.com/event.png?impid=3228c00673ae48eabc48a495b3850aba&gdpr=&gdpr_consent=&msrcanlm=394&msrcannum=4&eoid=10&ismms=44&isumms=43&isvelg=1&nvr=6&elmtp=3&isbxdms=2243&b11=2316&adhgt=600&adwdth=300&norwdth=300&norhgt=600&engisel=1&vsos=9&dvp_vsosnmr=16&dvp_mvpw=device-width&dvp_mvpiss=0&lftb=2316&sftb=2316&msrdp=5&naral=2&vct=1&vphgt=1200&vpwdth=1600&chgt=600&cwdth=300&invcs=false&scrhgt=1200&scrwdth=1600&strp=100&advisonl=true&isiabvms=943&isuiabvms=943&ispmxpms=943&iscvmvms=1943&engalms=43&dvp_hdnAd=0&dvp_dpr=1&mpt=1639567641731974 Requested by Host: cdn.doubleverify.com URL: https://cdn.doubleverify.com/dv-measurements1940.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.149.12.213 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 213.12.149.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.zdnet.com/article/khonsari-ransomware-iranian-group-nemesis-kitten-seen-exploiting-log4j/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Access-Control-Allow-Origin https://www.zdnet.com Pragma no-cache Date Wed, 15 Dec 2021 11:27:21 GMT Cache-Control max-age=0 Access-Control-Allow-Credentials true Connection keep-alive Expires 12/14/2021 11:27:21