www.zdnet.com Open in urlscan Pro
2a04:4e42:4d::666  Public Scan

21 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 110

• https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CNr39K7w4PQCFRRB4AodHBAFhw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)

Request Chain 139

• https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CIvaga_w4PQCFYOSdwodtnUL9A;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)

Request Chain 141

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 156

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 158

• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1 HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1&C=1

Request Chain 159

• https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
• https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbdKEPDyw9gMfWWaTGeFLgAA HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1

Request Chain 160

• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
• https://ib.adnxs.com/setuid?entity=101&code=CAESEAA0eWqmeRHeNWObmLkTycc&google_cver=1 HTTP 307
• https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAA0eWqmeRHeNWObmLkTycc%26google_cver%3D1

Request Chain 161

• https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
• https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ4MjEyOTE3NzkwMTU2MDM1NA%3D%3D

231 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/	237 KB 94 KB	264ms 227ms	Document text/html	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3b152d5296ffaa888c33bfacf1274714af4120fd9c0971b52b05181157f7b49e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-encoding gzip content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-type text/html; charset=UTF-8 expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" link <https://www.zdnet.com/a/fly/css/core/main-70f6a50f0c-rev.css>; rel="preload"; as="style"; nopush referrer-policy no-referrer-when-downgrade x-content-type-options nosniff x-frame-options SAMEORIGIN x-tx-id 0cb6fbb9-3bec-40b8-bd72-1625d34edd80 x-xss-protection 1; mode=block date Mon, 13 Dec 2021 13:26:38 GMT via 1.1 varnish cache-control max-age=5400, private expires Mon, 13 Dec 2021 14:49:48 GMT strict-transport-security max-age=63072000; includeSubDomains; preload accept-ranges bytes vary Accept-Encoding, User-Agent content-length 95331
GET H2	200	main-70f6a50f0c-rev.css www.zdnet.com/a/fly/css/core/	304 KB 52 KB	11ms 11ms	Stylesheet text/css	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/core/main-70f6a50f0c-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash d80aaa2d2f494faaa641a5f7023eed7c3b0ffb4fd04051ddf96c8300c3abecc1 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:38 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 53381 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:34 GMT server ContentServer x-frame-options SAMEORIGIN etag "7e243333aadd51ea153bc9a7a280f756" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 16 Dec 2021 14:56:19 GMT
GET H2	200	inlineMedia_core.js Show response static.myfinance.com/widget/	184 KB 63 KB	89ms 41ms	Script application/javascript	2606:4700:3037::6815:2b8a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia_core.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b8a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c2898711aa44688968b5769b7ca3a50be196c4897657ab6ce34f215b07f455d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4049 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id 1PHGRHDNDSXVWJ5C x-amz-id-2 udGKZpw9Mxc1b9v/KMLF3y4EIAFvbaTZ2FD0dXSvPwMzwBBmrsaTwpiCST4dU+yz6dWU5iPgHJg= last-modified Thu, 09 Dec 2021 19:58:40 GMT server cloudflare etag W/"874805badaa992bae7fba35738ee6edc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PHyOsfVBLnFroSjD2G2UMo34VdfBrgJTHVG%2BWiX3PCi7D%2FEtouLI5fsILe5vWhCy0RCKJ6VPs1DB7SJ0ews2pG9Ie0L4m073D9fCXWO1jNckeeic77X6e76He2IbyBI2cYdY%2Frt1DfHOn%2BBm4UxyHTYdjw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript vary Accept-Encoding cache-control max-age=14400 cf-ray 6bcf867e093259b3-MXP
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	19 KB 7 KB	36ms 15ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4d2a74d8b25e1ccd4b1294b0b937804bc24aeea7f46edad3f3c1f91604d2708c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 BXRr8anumVFsMvgN5QlueA== age 7736 vary Accept-Encoding content-length 6508 x-ms-lease-status unlocked last-modified Mon, 06 Dec 2021 03:28:56 GMT server cloudflare etag 0x8D9B86889468A14 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id 55378f6e-501e-0105-6c65-ea6acc000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bcf867ddba54eb5-FRA expires Mon, 13 Dec 2021 17:26:39 GMT
GET H2	200	optanon-v1.1.0.js Show response www.zdnet.com/a/privacy/optanon/	36 KB 10 KB	8ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/privacy/optanon/optanon-v1.1.0.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a0a97a5a7dc2b30e9a76ff211332f36d435293c19ed91ca1ad6a66adc1dc50cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 10444 x-xss-protection 1; mode=block last-modified Thu, 04 Mar 2021 19:22:21 GMT server ContentServer x-frame-options SAMEORIGIN etag "46e2aa30cbebb708b5fc468d57d56d8b" strict-transport-security max-age=31536000 content-language en via 1.1 varnish cache-control public, max-age=86400 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type application/javascript expires Thu, 18 Nov 2021 07:05:01 GMT
GET H2	200	controls-8709731aba-rev.css www.zdnet.com/a/fly/css/video/htmlPlayerControls/	25 KB 4 KB	8ms 8ms	Stylesheet text/css	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/css/video/htmlPlayerControls/controls-8709731aba-rev.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 6ee9b0827bc829a1c4b5bad2cb2f77ae06d7ee3bacf2a79a4c2892672968def7 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 4313 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:35 GMT server ContentServer x-frame-options SAMEORIGIN etag "5ff7e9f773085863b5103c32efd784db" strict-transport-security max-age=31536000 content-type text/css via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 16 Dec 2021 14:56:23 GMT
GET H2	200	inlineMedia.css static.myfinance.com/widget/	3 KB 2 KB	65ms 39ms	Stylesheet text/css	2606:4700:3037::6815:2b8a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.myfinance.com/widget/inlineMedia.css Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b8a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c50d5d10df377bd960648973b53891bfcaf48f457503eed023ad2c29f28e49b2 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6548 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-amz-request-id E76KD9X4369F809W x-amz-id-2 I9BCNhq0gyVdNzbblL6qPJ0SC3f2+Z8AtMKFBBafXrZQ4acHVQyzXrqKxTuU4HKyzLKxIVuN2Ds= last-modified Mon, 12 Jul 2021 14:22:18 GMT server cloudflare etag W/"528a38ce39fc58a866c1226253bbb189" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MBTaYKOSmkrkrHaGmkg%2FnHOzzOh40G6STiy26ln%2FvMHzspmoKepcnIN0X0kNwc4fLbYHG053vhyUyHEgBGsOMzCYO%2BP57hb70qU4%2FVrUZcrVUACM7%2Bol%2Bh%2F5PjXSeZ0bYBZ1GRC2uFmRIQxZGvnrG7X4Cw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css vary Accept-Encoding cache-control max-age=14400 cf-ray 6bcf867e093459b3-MXP
GET H/1.1	200 OK	YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Show response c.go-mpulse.net/boomerang/ Frame BFF5	205 KB 50 KB	61ms 18ms	Script application/javascript	2a02:26f0:6c00:1bb::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 13 Dec 2021 13:26:39 GMT Content-Encoding br Last-Modified Thu, 14 Oct 2021 03:09:47 GMT Server Akamai Resource Optimizer Vary Accept-Encoding Content-Type application/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=604800, s-maxage=604800 Connection keep-alive Timing-Allow-Origin * Content-Length 50393
GET DATA	200 OK	truncated /	31 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f3e2e0f12c5badfe408d69bf6c0fa9ce6247f9a45c849851a53b8647637cfcd0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash dfd272053c730cd470302af475eb401d9be41c81f0081c20d7910f6c12732c9d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 95783bf43b78701a92daf5ec7268db97c7144599c774821126b8cc5396724bfa Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	headshot-2.jpg www.zdnet.com/a/img/resize/f0bbe46eb924a42c2089410d297965cfcf5caf8a/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/	640 B 774 B	8ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/f0bbe46eb924a42c2089410d297965cfcf5caf8a/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/headshot-2.jpg?width=50&height=50&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 390f3fdc72e993d038e98d93fe33da4e69352543996f53cf64d51f874033bac8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 varnish fastly-io-info ifsz=28670 idim=280x280 ifmt=jpeg ofsz=640 odim=50x50 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638183284258 fastly-stats io=1 content-length 640 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "30tCV37TZpEekDE4q+VB0E2jr0qSpSHoYpgXeHEbnNM" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Mon, 06 Dec 2021 01:40:22 GMT
GET H2	200	headshot-2.jpg www.zdnet.com/a/img/resize/3b698b059a0b6f3de3d965c35f085ecfb983f2be/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/	958 B 1 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/3b698b059a0b6f3de3d965c35f085ecfb983f2be/2019/10/28/e1751fe3-e83c-4bc5-b425-4f3cfa6f6748/headshot-2.jpg?width=70&height=70&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash be4f0a635682a22c9abf3684f48086f9fcba76da5a31b8e0c598375e65c42be3 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 varnish fastly-io-info ifsz=28670 idim=280x280 ifmt=jpeg ofsz=958 odim=70x70 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588638183284258 fastly-stats io=1 content-length 958 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "PAlFLl1omnYqeAy+Vf5j9K6Z8BJouLnIzRVuN589oYw" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Mon, 06 Dec 2021 01:40:22 GMT
GET H2	200	2020-03-18-at-12-23-32-pm.jpg www.zdnet.com/a/img/resize/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d/2020/03/18/7c2e2258-7566-4e66-9059-a1a8aedf00b4/	4 KB 5 KB	8ms 8ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d/2020/03/18/7c2e2258-7566-4e66-9059-a1a8aedf00b4/2020-03-18-at-12-23-32-pm.jpg?width=220&height=165&fit=bounds&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash dac7f77e8f8d62e6ff2ebb7fa1a77a719fc6c8beb3a28c51f732b6b6c0ce17a1 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=105669 idim=1642x1096 ifmt=jpeg ofsz=4578 odim=220x147 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599085316373399 fastly-stats io=1 content-length 4578 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "EYD+MTccJhCUsUmnK78CInjnMf9vFiT5s71uUkjD1qA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Sat, 27 Nov 2021 23:26:10 GMT
GET H2	200	require-2.1.2.js Show response www.zdnet.com/a/fly/js/libs/	16 KB 6 KB	7ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/require-2.1.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash a70d5b9ad136255942779acf94da5cc72316fde5c10c5e7707d6f1888f43dcb8 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 6169 x-xss-protection 1; mode=block last-modified Tue, 07 Dec 2021 17:55:55 GMT server ContentServer x-frame-options SAMEORIGIN etag "19dc27d905113e7a42282e0817bbd59d" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 14 Dec 2021 18:20:59 GMT
GET H2	200	logo.png www.zdnet.com/a/fly/1639061512-asset/bundles/zdnetcss/images/core/	4 KB 4 KB	7ms 7ms	Image image/png	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/fly/1639061512-asset/bundles/zdnetcss/images/core/logo.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/css/core/main-70f6a50f0c-rev.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/a/fly/css/core/main-70f6a50f0c-rev.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://*.zdnet.com:* via 1.1 varnish last-modified Thu, 09 Dec 2021 14:54:40 GMT server ContentServer x-frame-options SAMEORIGIN date Mon, 13 Dec 2021 13:26:39 GMT vary Accept-Encoding, Accept content-type image/png cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes timing-allow-origin * content-length 4105 x-xss-protection 1; mode=block expires Thu, 16 Dec 2021 14:56:19 GMT
GET H2	200	Regular.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	11ms 10ms	Font font/woff2	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Regular.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 7fa1c7b1686f9f116183456c39f7b3ed9cce063cfb428e575fe4a29ae05c4fa6 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 varnish vary Accept-Encoding, Accept content-length 20256 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:30 GMT server ContentServer x-frame-options SAMEORIGIN etag "2d636d9395b2da27ce67040250333ca4" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 16 Nov 2022 18:20:56 GMT
GET H2	200	Semibold.woff2 www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/	20 KB 20 KB	8ms 7ms	Font font/woff2	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/bundles/zdnetcss/fonts/Proxima%20Nova/Semibold.woff2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 21c9c7889404394d4e4c780022b56b5fa39e83b19c34eb0508561a115a1dcc6a Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 varnish vary Accept-Encoding, Accept content-length 20344 x-xss-protection 1; mode=block last-modified Fri, 12 Nov 2021 15:35:29 GMT server ContentServer x-frame-options SAMEORIGIN etag "a96ff4477074c6395b7305d2d98fde8e" strict-transport-security max-age=31536000 content-type font/woff2 access-control-allow-origin * cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 16 Nov 2022 18:20:56 GMT
GET H2	200	e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/	3 KB 2 KB	63ms 25ms	XHR application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/e70f246a-fd9b-4805-9fd4-fcd89020aca5.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eaf765d314b24473895a9ece61135d31023528c3b65129051b2c5a471d780604 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 xkIaWO5Hr0+rNu9IdoYHdw== age 452 vary Accept-Encoding content-length 1425 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:53 GMT server cloudflare etag 0x8D94223473B0939 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 06042b04-c01e-000f-0c15-b63510000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bcf867e8b9e839a-MXP expires Mon, 13 Dec 2021 17:26:39 GMT
GET H2	200	main.default.js Show response www.zdnet.com/a/fly/aa418b-fly/js/	223 KB 70 KB	8ms 8ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash b6af40778c8d4f0df4e6e379dddeee880536f489874fc99fdd22157201b7a37e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 71762 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:26 GMT server ContentServer x-frame-options SAMEORIGIN etag "67184fa63492fcb48a1cdae46165bc70" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 16 Dec 2021 14:56:19 GMT
OPTIONS H2	204	record a.myfidevs.io/ Frame	0 0	312ms 102ms	Preflight	52.73.158.59 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.73.158.59 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-73-158-59.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,x-api-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT access-control-allow-origin * access-control-allow-credentials true access-control-allow-methods POST access-control-allow-headers * server Python/3.7 aiohttp/3.7.4.post0
OPTIONS H2	200	v1.5 www.myfinance.com/api/au/ Frame	0 0	168ms 133ms	Preflight text/html	2606:4700:3037::6815:2b8a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvaGFja2Vycy1wcmV0ZW5kaW5nLXRvLWJlLWlyYW5pYW4tZ292dC11c2Utc21zLW1lc3NhZ2VzLXRvLXN0ZWFsLWNyZWRpdC1jYXJkLWluZm8tY3JlYXRlLWJvdG5ldC8= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b8a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-type text/html; charset=utf-8 vary Origin access-control-allow-credentials true access-control-allow-origin https://www.zdnet.com access-control-allow-headers x-requested-with, content-type, accept, origin, authorization, x-csrftoken, x-api-key, Access-Control-Allow-Origin access-control-allow-methods DELETE, GET, OPTIONS, PATCH, POST, PUT access-control-max-age 86400 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6S2yzaBl%2BDK%2BkM9%2BRU2HqfTGl4vhaMj3xSIxKLBeBMOrMaPVzjbC%2Fu1R%2FqoBXHmcGfVNEzLKUnTtiYlVMAoVW0QpGiFa8LaCcm%2FWDIjjmW5ruGXixQJxJlvTJSBHOnaKoCSSWOZXuiGDOmtQHAjw6w%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15552000 x-content-type-options nosniff server cloudflare cf-ray 6bcf867ed8ae2b4d-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
POST H2	204	record Show response a.myfidevs.io/	0 166 B	141ms 141ms	XHR text/plain	52.73.158.59 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.myfidevs.io/record Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.73.158.59 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-73-158-59.compute-1.amazonaws.com Software Python/3.7 aiohttp/3.7.4.post0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 x-api-key yuH27H1QId6afXAojow6Tafi7Vw9v1spaLD5Yznw Content-Type application/json Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:39 GMT access-control-allow-credentials true server Python/3.7 aiohttp/3.7.4.post0 access-control-allow-headers * access-control-allow-methods POST
POST H2	200	v1.5 Show response www.myfinance.com/api/au/	1 KB 1 KB	237ms 236ms	XHR application/json	2606:4700:3037::6815:2b8a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.myfinance.com/api/au/v1.5?imre=aHR0cHM6Ly93d3cuemRuZXQuY29tL2FydGljbGUvaGFja2Vycy1wcmV0ZW5kaW5nLXRvLWJlLWlyYW5pYW4tZ292dC11c2Utc21zLW1lc3NhZ2VzLXRvLXN0ZWFsLWNyZWRpdC1jYXJkLWluZm8tY3JlYXRlLWJvdG5ldC8= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b8a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9a86a83b64c50cf90b69f6d55838bf5b767b6f2bdb6c6a178d3bccb79967a6a5 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept application/json Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-type application/json alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 allow POST, GET server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yvrnbI7GTOrrldCNY3B%2FS%2FJfq36UkNkuTtppC6zmpMq%2B56B%2BHfoJr5O3sx5wIBYLCgf4OR%2FJEo2w0gK3SzIRL1nPxrGemSu%2FB0B2VJPZe6%2FNEABT9uOB6d55Gx4yLh5M4%2BISlGmyXtNOC18sKEgpcA%3D%3D"}],"group":"cf-nel","max_age":604800} content-language en-us access-control-allow-origin https://www.zdnet.com vary Accept, Accept-Language, Origin, Cookie cache-control max-age=0, no-cache, no-store, must-revalidate access-control-allow-credentials true cf-ray 6bcf867fba9b2b4d-FRA expires Mon, 13 Dec 2021 13:26:39 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	193 B 399 B	86ms 45ms	Script text/javascript	2606:4700:10::6814:b844 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 09b7ece464c01f640c13fdceb08bb12ab4a2db787f36a8253c109ea3d4f7d9f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript strict-transport-security max-age=31536000; includeSubDomains; preload cf-ray 6bcf867efbfd83a6-MXP
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/ Frame BFF5	2 KB 1 KB	220ms 205ms	XHR application/json	2a02:26f0:6c00:1bb::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5464673&v=1.720.0&if=&sl=0&si=9e603146-4e1e-4e96-b367-ef5b2b03bfd1-r422of&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao= Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash be561f205170ab9e74a8ebdc7a84343e1dfbf60053c4f67caecd8a6b360dfaf0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 13 Dec 2021 13:26:39 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 809
GET H2	200	bidbarrel-zdnet-rv.min.js Show response at.adtech.redventures.io/lib/dist/prod/	607 KB 177 KB	49ms 8ms	Script application/javascript	151.101.2.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/dist/prod/bidbarrel-zdnet-rv.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 6c0cd7b80611259d4ccce9165e8b5dd062aad43e3e3e19a404fe967c49795d03 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 d8e97d2c28917e4c41ab79bb1e94b845.cloudfront.net (CloudFront), 1.1 varnish age 111 x-cache Hit from cloudfront, HIT content-encoding gzip content-length 180330 x-served-by cache-hhn4053-HHN last-modified Thu, 28 Oct 2021 17:15:17 GMT server AmazonS3 x-timer S1639401999.207532,VS0,VE1 etag "873be44731952ce6844f825d0be702dd" vary Accept-Encoding, Origin content-type application/javascript cache-control max-age=900, public, must-revalidate x-amz-cf-pop FRA6-C1 accept-ranges bytes x-amz-cf-id VGH47jj9fjjwylFArcjvMsNzTAq38EztRwkp5ZRsemFUnWuRMR1s8Q== x-cache-hits 1
GET H2	200	urs.js Show response urs.zdnet.com/sdk/	50 KB 50 KB	139ms 114ms	Script application/javascript	34.120.203.121 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://urs.zdnet.com/sdk/urs.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.203.121 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 121.203.120.34.bc.googleusercontent.com Software / Resource Hash fb7a86f12d2f0ac2f4111c147415ab30f9c7d84c5e15faba3875fce7ce590127 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 google last-modified Tue, 12 Jan 2021 17:00:48 GMT etag "5ffdd5c0-c803" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes alt-svc clear content-length 51203
GET H2	200	mpulse-1.0.2.js Show response www.zdnet.com/a/fly/js/libs/	61 KB 12 KB	7ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/libs/mpulse-1.0.2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ea7373d7059ab32d4304249b48a91311f91d2dce5e1ebf10450f33f9a8c5f5ec Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 12449 x-xss-protection 1; mode=block last-modified Mon, 06 Dec 2021 15:33:25 GMT server ContentServer x-frame-options SAMEORIGIN etag "72d81f5ba3fbad2161c566ebb60b0618" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 14 Dec 2021 05:39:11 GMT
GET H/1.1	200 OK	config.json Show response c.go-mpulse.net/api/v2/	2 KB 1 KB	187ms 174ms	XHR application/json	2a02:26f0:6c00:1bb::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1639401999198&s=aae8d68734b3fac13bded752b1313ce393533e1e224b46e7cbbf65fde31df0af Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:1bb::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 645296bffa0a257a62ef49995d7cf9555fd85bbcb7c5b1f6836b5aeacd195910 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 13 Dec 2021 13:26:39 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private, max-age=300, stale-while-revalidate=60, stale-if-error=120 Connection keep-alive Timing-Allow-Origin * Content-Length 816
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.20.0/	376 KB 84 KB	15ms 14ms	Script application/javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/otBannerSdk.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 295c66c14524b77dd1271317457dec037b5ef0943da346b9b73681e54da826e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 jOOTzA5W9ewbfwCUPpt/mw== age 4799948 vary Accept-Encoding content-length 86053 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:48 GMT server cloudflare etag 0x8D941124BEC2620 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * x-ms-request-id b5562596-701e-0174-096c-c418f5000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bcf867f3e084eb5-FRA
OPTIONS H2	200	diff at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/ Frame	0 0	142ms 120ms	Preflight text/html	151.101.2.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers cat,content-type,variant,version Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers content-type text/html; charset=utf-8 x-dns-prefetch-control off x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-download-options noopen x-content-type-options nosniff x-xss-protection 1; mode=block access-control-allow-origin https://www.zdnet.com access-control-allow-headers * allow GET,HEAD etag W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg" x-cloud-trace-context 818e56ae7762a52bab4cde17df21ef79 server Google Frontend accept-ranges bytes date Mon, 13 Dec 2021 13:26:39 GMT via 1.1 varnish x-served-by cache-hhn4047-HHN x-cache MISS x-cache-hits 0 x-timer S1639401999.314466,VS0,VE114 vary Accept-Encoding, Origin content-length 8
GET H/1.1	200 OK	config.js Show response confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/	169 KB 33 KB	32ms 7ms	Script text/javascript	151.101.1.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/J3UXFee1xclY-bfFlWh1mIZ_phU/gpt_and_prebid/config.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 2d61e6f0b4b19f8d7484098faa1ec0d1aaceb0c752967428addd4c652e7014ad Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 13 Dec 2021 13:26:39 GMT Content-Encoding gzip Age 1730 X-Cache HIT Connection keep-alive Content-Length 33228 x-amz-id-2 huzGmFSpqUWiMldyV7jR3nu2LTV6ss96ockI58ORQmsm0km91rQ69EmsrRqKLI4YG6DZcDAmXaY= X-Served-By cache-hhn4051-HHN Last-Modified Mon, 13 Dec 2021 12:41:16 GMT Server AmazonS3 X-Timer S1639401999.288242,VS0,VE0 ETag "cc605827b114fd0d8b04e711f8041b18" x-amz-request-id AGHS52E39GHP5YZJ Via 1.1 varnish Cache-Control public, max-age=900, stale-while-revalidate=3600 Accept-Ranges bytes Content-Type text/javascript X-Cache-Hits 60
GET H2	200	diff Show response at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/	26 KB 3 KB	8ms 7ms	Fetch application/json	151.101.2.154 FASTLY
General Check archive.org Show headers Download Go to Full URL https://at.adtech.redventures.io/lib/api/v1/zdnet-rv/prod/config/diff?variant=core Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.154 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Google Frontend / Resource Hash f7faf9d2efd98353cd4923de5f2359d97cbc3021eadce27e0a91f3e97cccf66f Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers cat 5zTciER5s Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Accept application/json Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ variant core version rv2.25.6 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff age 670 x-dns-prefetch-control off x-cache HIT ttl 900s content-length 2717 x-xss-protection 1; mode=block x-served-by cache-hhn4047-HHN access-control-allow-origin * server Google Frontend x-timer S1639401999.435925,VS0,VE0 x-frame-options SAMEORIGIN date Mon, 13 Dec 2021 13:26:39 GMT x-download-options noopen vary Accept-Encoding, Origin content-type application/json; charset=utf-8 via 1.1 varnish x-cloud-trace-context afb6dee4e1d7473afa0d267d0b8cf171 cache-control max-age=900 etag W/df18d6e4c252b4ac97da72a5c7d9d8900a2166b5 accept-ranges bytes access-control-allow-headers * x-cache-hits 4
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	78 KB 27 KB	49ms 23ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 1907478e8fa62801a1db26be87cab0755288131c9c8e80320582e560825df3cc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1069 / 607 of 1000 / last-modified: 1639397097" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26912 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 13 Dec 2021 13:26:39 GMT
GET H2	200	en.json Show response cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/	93 KB 20 KB	29ms 29ms	Fetch application/x-javascript	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/e70f246a-fd9b-4805-9fd4-fcd89020aca5/069e0a06-a1be-44f5-9a8f-926f2985d489/en.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c83de3876b70820a0a835648010dc49a5600d6c3dd65f1a1e19ff44d33663083 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 AlmWtxV11YCExQkuyz0PJA== age 2138 vary Accept-Encoding content-length 20136 x-ms-lease-status unlocked last-modified Thu, 08 Jul 2021 15:15:59 GMT server cloudflare etag 0x8D942234AE979B3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/x-javascript access-control-allow-origin * x-ms-request-id 3343f274-d01e-0054-6315-b6326c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bcf867fcf70839a-MXP expires Mon, 13 Dec 2021 17:26:39 GMT
GET H/1.1	200 OK	wrap.js Show response confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/	189 KB 61 KB	7ms 7ms	Script application/javascript	151.101.1.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 80da370ad41bee2716b42d1583e139eac39f5c7c243c5fe6439b9754013116c6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 13 Dec 2021 13:26:39 GMT Content-Encoding gzip Age 758 X-Cache HIT Connection keep-alive Content-Length 61460 x-amz-id-2 iwAx4iKGRwd+v8dDXmwzmmj+nVWJy1tpmwOmsUTjA4TvL8ZqnxLx97mJCcJzED1QU09BRpmROyM= X-Served-By cache-hhn4051-HHN Last-Modified Thu, 02 Dec 2021 17:00:39 GMT Server AmazonS3 X-Timer S1639401999.322595,VS0,VE0 ETag "0bad6e8b774e2623401e436c2a44f48e" x-amz-request-id 2BM9GQY9G42P8W1F Via 1.1 varnish Cache-Control public, max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 X-Cache-Hits 1141
GET H2	200	article-6ebc50982c-rev.js Show response www.zdnet.com/a/fly/js/pages/	102 KB 26 KB	10ms 9ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/pages/article-6ebc50982c-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 5b6e97cf069d0d1a67390ad12ef50237963c77addfd1c8f15399b916993dd143 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 26736 x-xss-protection 1; mode=block last-modified Tue, 07 Dec 2021 15:21:47 GMT server ContentServer x-frame-options SAMEORIGIN etag "e810346447b48a5e6cc2cd6871a6be70" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 14 Dec 2021 15:23:17 GMT
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/6.20.0/assets/	13 KB 3 KB	26ms 26ms	Fetch application/json	2606:4700::6810:9440 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.20.0/assets/otFlat.json Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 /OL7qnwFOarng5AW29V9Pw== age 4798241 vary Accept-Encoding content-length 2950 x-ms-lease-status unlocked last-modified Wed, 07 Jul 2021 06:41:42 GMT server cloudflare etag 0x8D94112485FC2D3 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/json access-control-allow-origin * x-ms-request-id aa0c218f-101e-00ca-536c-c44b2b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 6bcf86801859839a-MXP
GET H3	200	pubads_impl_2021120601.js Show response securepubads.g.doubleclick.net/gpt/	348 KB 117 KB	33ms 16ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 119476 x-xss-protection 0 last-modified Mon, 06 Dec 2021 09:34:20 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 13 Dec 2021 13:26:39 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	217 B 153 B	31ms 16ms	XHR application/json	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 12717f96c61a500136a8564d666db9b960869a71dd3176a438b53fb08be5c7bb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 128 x-xss-protection 0 expires Mon, 13 Dec 2021 13:26:39 GMT
GET H2	200	cohesion-latest.min.js Show response cdn.cohesionapps.com/cohesion/	77 KB 21 KB	58ms 16ms	Script text/javascript	65.9.83.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/cohesion-latest.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.83.36 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-83-36.ams1.r.cloudfront.net Software AmazonS3 / Resource Hash 6201fd33404c553291f0a3673daee5824cd2ab90da3803a1943431041e566798 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-version-id null content-encoding gzip etag W/"efa7bec082ecc457c1dd10cd441d66ec" last-modified Thu, 02 Dec 2021 21:10:56 GMT server AmazonS3 age 95988 x-amz-server-side-encryption AES256 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript via 1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront) date Sun, 12 Dec 2021 21:11:05 GMT x-amz-cf-pop AMS1-C1 x-amz-cf-id noHbgnQJYgn5Bui-dsVM1Lp5ukPa8OACxSBJMHZ-dMx8036Bgn9p7A==
GET H2	200	moatheader.js Show response z.moatads.com/redventuresgamheader644747280705/	240 KB 82 KB	74ms 20ms	Script application/x-javascript	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash ba5c9b5823ef1377da70e73357b85ef2dca7ade9afe70c93d0aa163c61c9bf03 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip last-modified Thu, 02 Dec 2021 16:10:34 GMT server AmazonS3 x-amz-request-id DG2H92XYZRQZ4RSV etag "33d2b31f29685690d6e2e3d016555f04" vary Accept-Encoding content-type application/x-javascript cache-control max-age=60873 accept-ranges bytes content-length 83699 x-amz-id-2 TnGeV4HtYB4NVPsPbHr+b5g34xbNmb7VjpQ7zI9/ywXjEabCjusxmRc+mMFbdi/bypbtdhI7jN0=
GET H2	200	integrator.js Show response adservice.google.de/adsid/	107 B 792 B	40ms 17ms	Script application/javascript	2a00:1450:4001:82f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 549 B	41ms 17ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	52 KB 12 KB	395ms 394ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2421186219939079&correlator=3211312454639656&output=ldjh&impl=fifs&eid=44756717&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211213&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90%7C970x66%7C5x5&prev_scp=pos%3Dnav%26sl%3Dnav-ad-plus-leader%253FT-1000%26iid%3Dunit%253Dnav-ad-plus-leader%257Cvguid%253Dd8d276c4-244f-43be-be76-be6e9f7629be%257Cpv%253D1&eri=1&cust_params=test%3Dbest_list%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cgovernment%252Ccyber-threats%252Capplications%26tag%3Dcyber-security%26prodtype%3Dcards%252Capplicator%26mfr%3Dcheck-point%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D3%26session%3Db%26pv%3D1%26vguid%3Dd8d276c4-244f-43be-be76-be6e9f7629be&cookie_enabled=1&bc=31&abxe=1&lmt=1639401999&dt=1639401999675&dlt=1639401998967&idt=651&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=50&adks=3529097836&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x100&msz=1600x100&ga_vid=1961307111.1639402000&ga_sid=1639402000&ga_hid=2134894213&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e47ff37b5e10beee57c897a51fc7ae7959c28191b311df35fea05b6f9a32417e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11967 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html Show response 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8A48	6 KB 4 KB	79ms 14ms	Document text/html	2a00:1450:4001:82b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 13 Dec 2021 13:26:39 GMT expires Tue, 13 Dec 2022 13:26:39 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	59 KB 12 KB	581ms 580ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2421186219939079&correlator=4160188164425660&output=ldjh&impl=fifs&eid=44756717&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211213&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Dtop%26sl%3Dmpu-plus-top%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-plus-top%257Cvguid%253Dd8d276c4-244f-43be-be76-be6e9f7629be%257Cpv%253D1&eri=1&cust_params=test%3Dbest_list%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cgovernment%252Ccyber-threats%252Capplications%26tag%3Dcyber-security%26prodtype%3Dcards%252Capplicator%26mfr%3Dcheck-point%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D3%26session%3Db%26pv%3D1%26vguid%3Dd8d276c4-244f-43be-be76-be6e9f7629be&cookie_enabled=1&bc=31&abxe=1&lmt=1639401999&dt=1639401999711&dlt=1639401998967&idt=651&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=477&adks=1139850431&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x280&msz=370x30&ga_vid=1961307111.1639402000&ga_sid=1639402000&ga_hid=2134894213&ga_fc=false&fws=4&ohw=370&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash efd8464d356aa66d3f65cb2ae795217ad3bd20e63d45264249eb6352b80fb920 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12625 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	14 KB 8 KB	457ms 457ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2421186219939079&correlator=1288525611102022&output=ldjh&impl=fifs&eid=44756717&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211213&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&prev_scp=pos%3Dmiddle%26sl%3Dmpu-middle%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-middle%257Cvguid%253Dd8d276c4-244f-43be-be76-be6e9f7629be%257Cpv%253D1&eri=1&cust_params=test%3Dbest_list%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cgovernment%252Ccyber-threats%252Capplications%26tag%3Dcyber-security%26prodtype%3Dcards%252Capplicator%26mfr%3Dcheck-point%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D3%26session%3Db%26pv%3D1%26vguid%3Dd8d276c4-244f-43be-be76-be6e9f7629be&cookie_enabled=1&bc=31&abxe=1&lmt=1639401999&dt=1639401999713&dlt=1639401998967&idt=651&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=1360&adks=3640736402&ucis=3&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x30&msz=370x30&ga_vid=1961307111.1639402000&ga_sid=1639402000&ga_hid=2134894213&ga_fc=false&fws=4&ohw=370&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 2086ef0b8d026dbbe57999f65eb465be8f403e8de2b852616476811ad0908dfb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7891 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	305ms 98ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	304ms 98ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	301ms 99ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	300ms 99ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	299ms 99ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	115ms 112ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 4a63cbb594796a33a07afd8015ec46ab5fc6173dce26034c86aa44f420b7c5f8 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	114ms 112ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash b54348fb0f3372c9ab8ceb7af96d078a9e999b86710e05f6ad4834c93523b766 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	126ms 125ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 71edb6e0e65110d7e28138179f65979e511fc46dc3958474230c5cd6e47695fa Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	137 B 270 B	123ms 122ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash c0d9e3a374d1fe0a36fd275879263b609498048d53a48f3ee55b4993f14501b6 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 137 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	116ms 115ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash d1a82419803249d2eb7f2f438fae05a469195042e59a901c0583187afca148a6 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H2	200	xs1.html Show response cdn.cohesionapps.com/cohesion/ Frame 6086	2 KB 1 KB	14ms 13ms	Document text/html	65.9.83.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs1.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.83.36 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-83-36.ams1.r.cloudfront.net Software AmazonS3 / Resource Hash afac3a301d848688d0748228296ec7ae26369f67c2df29f3f480ef3ab0bc6ef9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers content-type text/html date Sun, 12 Dec 2021 19:40:33 GMT last-modified Thu, 02 Dec 2021 21:10:57 GMT etag W/"10b2c1751c2247b1aeccc91060f971cf" x-amz-server-side-encryption AES256 x-amz-version-id null server AmazonS3 content-encoding gzip vary Accept-Encoding x-cache Hit from cloudfront via 1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-C1 x-amz-cf-id LqYAo5zuNfckIhO7XxD58rLPXa0bitNdYAWfZBtaodec5HT1eoLiiw== age 63967
GET H2	200	public Show response taggy.cohesionapps.com/implementations/	8 KB 8 KB	105ms 104ms	XHR application/json	18.211.163.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://taggy.cohesionapps.com/implementations/public Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.211.163.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-211-163-90.compute-1.amazonaws.com Software / Express Resource Hash 1057d5fd733028374c07f587279e61230771eddfd056ce12fb75492fd1224ffd Request headers Source-Key src_1kYsAcdpfzbZ8UlNLYht1RPg3m2 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Page-URL https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/#ftag=RSSbaffb68 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT x-powered-by Express etag W/"202f-WDoQOp1rO0z7TI9x4+12ERK4udk" content-length 8239 content-type application/json; charset=utf-8
OPTIONS H2	204	public taggy.cohesionapps.com/implementations/ Frame	0 0	321ms 104ms	Preflight	18.211.163.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://taggy.cohesionapps.com/implementations/public Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.211.163.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-211-163-90.compute-1.amazonaws.com Software / Express Resource Hash Request headers Accept */* Access-Control-Request-Method GET Access-Control-Request-Headers content-type,page-url,source-key Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:40 GMT x-powered-by Express access-control-allow-origin * access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE vary Access-Control-Request-Headers access-control-allow-headers content-type,page-url,source-key
GET H/1.1	204 No Content	/ Show response 02179916.akstat.io/	0 354 B	254ms 217ms	XHR image/gif	2a02:26f0:6c00:291::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://02179916.akstat.io/?h.pg=article&h.ab=best_list_control_1&when=1639401999695&cdim.Site_View=desktop&t_other=custom4%7C268&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=d264c7d7a52ed348ca310cfe8d4b480392b11a0e-f66472f4-800602a4&h.t=1639401999303&http.initiator=api&rt.start=api&rt.si=e7603cfa-5361-4871-813a-88f7322f64b1&rt.ss=1639401999695&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:291::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:39 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 13 Dec 2021 13:26:39 GMT
GET H2	200	v2 Show response mb.moatads.com/yi/	317 B 492 B	156ms 65ms	Script text/html	34.252.133.182 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-sUdVZ1Vo8OQdpO6sSX9z7tLEdt1JXu2DKy1rcUrt9QAOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-NM4Tcd8kLtBk3A%3D%3D&sc=1&os=1-0w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=493648219705&callback=MoatNadoAllJsonpRequest_44213950 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.252.133.182 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-252-133-182.eu-west-1.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 2f5a7824db199e3fb9d760271c55cdd6a37bf95c8b900407b4ecf0cb3f02cf07 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "6ff5cb9ac34252f218883322619f7f4ea7a4203d" content-length 317 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	82 B 255 B	90ms 28ms	Script text/html	18.171.9.184 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-sUdVZ1Vo8OQdpO6sSX9z7tLEdt1JXu2DKy1rcUrt9QAOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-NM4Tcd8kLtBk3A%3D%3D&sc=1&os=1-0w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=493648219705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639401999752&de=982442837605&m=0&ar=8ab009d7785-clean&iw=04a0275&q=1&cb=0&cu=1639401999752&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A390%3A390%3A0%3A332&jk=-1&jm=-1&fs=195979&na=1311706209&cs=0&ord=1639401999752&jv=1354778889&callback=DOMlessLLDcallback_44213950 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.171.9.184 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-171-9-184.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 6c8672ad7d4e5be3a94bb36ecf3fc2a56491cd317c76b740944e712f15087cc1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "b9c256ffc6e460d4324b39166699e1dabd023637" content-length 82 content-type text/html; charset=UTF-8
GET H2	200	n.js Show response geo.moatads.com/	86 B 260 B	86ms 25ms	Script text/html	18.171.9.184 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://geo.moatads.com/n.js?e=35&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-sUdVZ1Vo8OQdpO6sSX9z7tLEdt1JXu2DKy1rcUrt9QAOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-NM4Tcd8kLtBk3A%3D%3D&sc=1&os=1-0w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=493648219705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&i=REDVENTURES_GAM_HEADER1&hp=1&wf=1&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639401999752&de=982442837605&m=0&ar=8ab009d7785-clean&iw=04a0275&q=2&cb=0&cu=1639401999752&ll=2&lm=0&ln=0&em=0&en=0&d=undefined%3Aundefined%3Aundefined%3Aundefined&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=undefined&bd=undefined&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&pe=1%3A390%3A390%3A0%3A332&jk=-1&jm=-1&fs=195979&na=1681347006&cs=0&callback=MoatDataJsonpRequest_44213950 Requested by Host: z.moatads.com URL: https://z.moatads.com/redventuresgamheader644747280705/moatheader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.171.9.184 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-171-9-184.eu-west-2.compute.amazonaws.com Software TornadoServer/4.5.3 / Resource Hash 723395ff2797c808a6928bec39c0b43a3f925ac610757bdeccc829f003566d5f Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT cache-control max-age=900 server TornadoServer/4.5.3 timing-allow-origin * etag "cc0dc3d6be66bef2fb0baf17841ec19105e217b8" content-length 86 content-type text/html; charset=UTF-8
GET H2	200	xs2.html Show response cdn.cohesionapps.com/cohesion/ Frame 6086	473 B 833 B	13ms 13ms	Document text/html	65.9.83.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.cohesionapps.com/cohesion/xs2.html Requested by Host: cdn.cohesionapps.com URL: https://cdn.cohesionapps.com/cohesion/xs1.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.83.36 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-83-36.ams1.r.cloudfront.net Software AmazonS3 / Resource Hash 88b8a3cb9df436d6910440c58428516accee080be4fa556d3cf10ec6905cf1b9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://cdn.cohesionapps.com/cohesion/xs1.html Response headers content-type text/html content-length 473 last-modified Thu, 02 Dec 2021 21:10:57 GMT x-amz-server-side-encryption AES256 x-amz-version-id null accept-ranges bytes server AmazonS3 date Mon, 13 Dec 2021 10:29:50 GMT etag "ffa03bed298484a7755ca23c5431cb28" x-cache Hit from cloudfront via 1.1 bda076aae92eaf83374971b76c395857.cloudfront.net (CloudFront) x-amz-cf-pop AMS1-C1 x-amz-cf-id OEH_0LcXaE47SVsygHGddDtcA0_SQSvrtih0rVpZdkDuy8MYh3V2iA== age 10610
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	167ms 100ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
OPTIONS H2	200	t ingest.make.rvapps.io/v2/ Frame	0 0	165ms 100ms	Preflight	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers authorization,content-type Origin https://www.zdnet.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Sec-Fetch-Mode cors Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-length 0 access-control-allow-credentials true access-control-allow-headers Authorization, Content-Type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 900 vary Origin Access-Control-Request-Method Access-Control-Request-Headers
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	125ms 124ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash 3ab317275be4025da792ae6e7fdc0964ae6fb1016c25cb5ab23a0aec15da8f02 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
POST H2	200	t Show response ingest.make.rvapps.io/v2/	138 B 271 B	127ms 126ms	XHR application/json	34.235.197.155 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://ingest.make.rvapps.io/v2/t Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.197.155 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-197-155.compute-1.amazonaws.com Software / Resource Hash fb858c5841cd33eb697edeed1a73380fdf7933847abf21758eca40316cc75ee5 Request headers User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 Authorization Basic d2tfMWtZc0FkSHN4MVhWd1Q1RWJYOU9RWWw0bkpNOg== Content-Type application/json;charset=UTF-8 Response headers access-control-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT access-control-allow-credentials true content-length 138 vary Origin content-type application/json
GET H2	200	nr-spa-1212.min.js Show response js-agent.newrelic.com/	44 KB 17 KB	23ms 7ms	Script application/javascript	151.101.130.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-spa-1212.min.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-version-id wY72Ah.NJX5KzzqRFK3uhSo3Jh07tDe4 content-encoding gzip etag "8bd93bf0ecb2f4e971a2055a41402bb6" x-amz-request-id ANVX8WPYJ9NM99FD x-cache HIT cross-origin-resource-policy cross-origin content-length 16636 x-amz-id-2 //pISD16Bm7/1PDlW0ghswvgTyyOyXNw/emHSr2czJPEUE1eLcqp61M3L9P610qmdidTDtCabTk= x-served-by cache-hhn4065-HHN last-modified Thu, 04 Nov 2021 21:16:16 GMT server AmazonS3 x-timer S1639402000.989126,VS0,VE0 date Mon, 13 Dec 2021 13:26:39 GMT vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 8191
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 9 KB	44ms 23ms	XHR application/json	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021120601&st=env Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a6ad3c821d4262773c0bd1476010c7c3fdbe9d3ac91ec8d8acb724b78b353543 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8548 x-xss-protection 0
GET H2	200	/ Show response www.zdnet.com/components/breaking-news/xhr/	1 KB 1 KB	117ms 116ms	XHR application/json	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a34a18af13300304d71edccb561a24a876f08721b2151e5dc257ccd4b1bed8c9 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-c31885330964d2d4----1639401999991 traceparent 00-933d4ad5535053c10202c5c23c42b080-c31885330964d2d4-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiYzMxODg1MzMwOTY0ZDJkNCIsInRyIjoiOTMzZDRhZDU1MzUwNTNjMTAyMDJjNWMyM2M0MmIwODAiLCJ0aSI6MTYzOTQwMTk5OTk5MSwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff last-modified Mon, 13 Dec 2021 13:25:24 GMT vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFtcXRQODFJfQzkGQ1NSCQ8NBW8MXRVLGhgCHVUJUQFRH1JKBgNSX1EUHgFIQwcOBQFVUwIOAFMEVFJTVQlAFF5VXkAAZA== x-frame-options SAMEORIGIN date Mon, 13 Dec 2021 13:26:40 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id 86ed6694-6a8c-429b-b6d8-cc1516a9fe35 content-type application/json via 1.1 varnish cache-control max-age=5400, private accept-ranges bytes expires Mon, 13 Dec 2021 14:55:24 GMT
GET H2	200	track-cwv-72dfb3ae38-rev.js Show response www.zdnet.com/a/fly/js/components/	239 B 336 B	8ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/track-cwv-72dfb3ae38-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 9b7909cb9edd007095b41a13617b66208e4210fff9c5e411a7db116efefc8e71 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 199 x-xss-protection 1; mode=block last-modified Wed, 08 Dec 2021 21:25:59 GMT server ContentServer x-frame-options SAMEORIGIN etag "c9a7fcd1b409a8885e607521d8760279" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Wed, 15 Dec 2021 22:42:12 GMT
GET H2	200	author-modal-d55d4e857c-rev.js Show response www.zdnet.com/a/fly/js/components/	573 B 425 B	15ms 15ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/author-modal-d55d4e857c-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 06c00948dd5d4c3109c9e00bb6c44938e1251feae65e2b7c2591f333ab230d9b Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:39 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 311 x-xss-protection 1; mode=block last-modified Mon, 06 Dec 2021 15:21:02 GMT server ContentServer x-frame-options SAMEORIGIN etag "849e75d0e3e5d37b8f2e58eb13934932" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 13 Dec 2021 15:22:56 GMT
GET H2	200	disqus-loader-17293b5282-rev.js Show response www.zdnet.com/a/fly/js/components/	1 KB 851 B	13ms 13ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/disqus-loader-17293b5282-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0aee86f10613d80ea0542d89047ea3467747db993379daeb592178ebf943b534 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 684 x-xss-protection 1; mode=block last-modified Thu, 09 Dec 2021 14:54:40 GMT server ContentServer x-frame-options SAMEORIGIN etag "1e5f048735ffba851865782fc08a4a43" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Thu, 16 Dec 2021 17:11:51 GMT
GET H2	200	front-door-carousel-dcdcc78ebc-rev.js Show response www.zdnet.com/a/fly/js/components/	5 KB 2 KB	13ms 13ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/front-door-carousel-dcdcc78ebc-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 0f23aaa9d0fec5942a9907b88ad801ff3eff3abede69bf286d869061201c67fe Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 1651 x-xss-protection 1; mode=block last-modified Tue, 07 Dec 2021 17:56:02 GMT server ContentServer x-frame-options SAMEORIGIN etag "3cc885a239f18b2a8cb1eb1852ca5386" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 14 Dec 2021 18:20:57 GMT
GET H2	200	gettyimages-cyber-dude-laptops.jpg www.zdnet.com/a/img/resize/5481509c36cafea7e6b9e55ecb8937af1b6d0ac2/2021/04/16/a6a75218-3366-4758-affa-493811134a0d/	2 KB 2 KB	16ms 13ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/5481509c36cafea7e6b9e55ecb8937af1b6d0ac2/2021/04/16/a6a75218-3366-4758-affa-493811134a0d/gettyimages-cyber-dude-laptops.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 142c8e986c2e743affcd3c7486f4544203514fcb01bcd5944fb706b1434d95f0 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=126885 idim=2198x1363 ifmt=jpeg ofsz=2136 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1618537354389305 fastly-stats io=1 content-length 2136 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "zHmqc1HKZoAL2IHuBEfaeDYimyA8ngbGXGGAnXerfY4" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 14:13:42 GMT
GET H2	200	gettyimages-close-up-of-fingers-typing-on-glowing-red-backlight-keys-on-a-computer-keyboard.jpg www.zdnet.com/a/img/resize/2bcca569c447ab7814de68bec1335e5db1f9f081/2021/12/13/6af65f57-2326-4a2f-9f6f-035fd5fbd2db/	5 KB 6 KB	15ms 12ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/2bcca569c447ab7814de68bec1335e5db1f9f081/2021/12/13/6af65f57-2326-4a2f-9f6f-035fd5fbd2db/gettyimages-close-up-of-fingers-typing-on-glowing-red-backlight-keys-on-a-computer-keyboard.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c7f60459f4466a5840ec76c9c6582bb9e3a11f0ce1367d285e82f64cf03961bd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1745268 idim=2121x1414 ifmt=jpeg ofsz=5534 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5534 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Za4EGD/Lq/2YYmCjLM9RVrxbprFqkqaT03pY7s7ZiY4" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 13:22:51 GMT
GET H2	200	istock-12457481571.jpg www.zdnet.com/a/img/resize/3bb4b71db7407bb613a5adc4613e35eb5e2b168d/2020/06/18/8795205e-246b-4241-859f-13d4bdf3f225/	5 KB 5 KB	15ms 12ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/3bb4b71db7407bb613a5adc4613e35eb5e2b168d/2020/06/18/8795205e-246b-4241-859f-13d4bdf3f225/istock-12457481571.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c3a0eaa531dec94d5c31e7084f362cf1eee571457e7006bdefe14124be2c316f Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish fastly-io-info ifsz=46842 idim=770x368 ifmt=jpeg ofsz=4768 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599085560588717 strict-transport-security max-age=31536000 content-length 4768 x-xss-protection 1; mode=block fastly-io-warning Failed to apply profile server ContentServer x-frame-options SAMEORIGIN etag "L1YRI4chV0dE8rGfwxMpDTB2tCAHzE1Is2YgKv4TrZw" vary Accept-Encoding, Accept content-type image/webp fastly-stats io=1 cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 06:40:26 GMT
GET H2	200	kiribati-gettyimages.jpg www.zdnet.com/a/img/resize/41d36b0b6d28d653540873eee5c700be9af55ba9/2021/12/12/e980dc8b-9265-4827-a57b-d83ea2296601/	4 KB 4 KB	14ms 12ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/41d36b0b6d28d653540873eee5c700be9af55ba9/2021/12/12/e980dc8b-9265-4827-a57b-d83ea2296601/kiribati-gettyimages.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 016c8e95d84837bcc270e273163e1335867d5a2c1a8d98d959e18955be410e46 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=139911 idim=1024x683 ifmt=jpeg ofsz=3712 odim=170x128 ofmt=webp fastly-stats io=1 content-length 3712 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "RIbNDkeNT/loVuWgg0xE32bYSH8KRVJpLzF70qPFnxY" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 00:51:55 GMT
GET H2	200	mozilla.jpg www.zdnet.com/a/img/resize/eaf8b07bdffd018992f265c39d6c5cb73176c584/2021/11/01/c240c8fa-eb6d-401d-816d-c8706d9a27ad/	5 KB 6 KB	14ms 12ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/eaf8b07bdffd018992f265c39d6c5cb73176c584/2021/11/01/c240c8fa-eb6d-401d-816d-c8706d9a27ad/mozilla.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bc25b41e910e88fd9e667a84a8f53e046d0ab8ef8459d02ec551f90053bb498c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1244215 idim=1600x1069 ifmt=jpeg ofsz=5586 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5586 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "AIIbQ3x8mLvTyppdyJjxiiwTVC6jT0pCGhXg67B6Neo" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 06 Dec 2021 02:12:08 GMT
GET H2	200	shutterstock-1751628242.jpg www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/	2 KB 3 KB	20ms 18ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/shutterstock-1751628242.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ee6665447bf60c13dcfb2a7e8f3e80d231f2f5cb180995889956ef93eebd8549 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=11768242 idim=6000x4000 ifmt=jpeg ofsz=2488 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2488 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Co54q6atr81IOHkwJ/WxG4xFMcCEePDgjnujOhrERQI" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 23:22:03 GMT
GET H2	200	julian-assange-norfolk-btl-zaw2.png www.zdnet.com/a/img/resize/f8a521e05e5b37a00c54b443a18f0c454ffa6324/2014/10/04/6297ebad-4bb1-11e4-b6a0-d4ae52e95e57/	29 KB 30 KB	13ms 12ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/f8a521e05e5b37a00c54b443a18f0c454ffa6324/2014/10/04/6297ebad-4bb1-11e4-b6a0-d4ae52e95e57/julian-assange-norfolk-btl-zaw2.png?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 06ae225065f8274975d52c1816b3c7939efa7ade5c8185cea4480c61e0419064 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish fastly-io-info ifsz=486459 idim=620x312 ifmt=png ofsz=30140 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588634731138322 fastly-stats io=1 content-length 30140 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "8PLgcw16PBxvC8CR8nQJim5YJrAx8wY1AeQGVyIwyZg" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Fri, 10 Dec 2021 18:05:57 GMT
GET H2	200	cma-cgm-shipping-cargo.jpg www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/	8 KB 8 KB	19ms 17ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/cma-cgm-shipping-cargo.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f267f9c57ffe8ff134eee5ec282089ff9c4c0669ea8c8af414d38fe501410e9e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=117362 idim=1000x500 ifmt=jpeg ofsz=8254 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1601311989734263 fastly-stats io=1 content-length 8254 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "GpD9eEagf1IBcPIW0iapNx6zp8GVyVxnL0QII+RW2xA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 17:41:38 GMT
GET H2	200	cyberattack.jpg www.zdnet.com/a/img/resize/03c839069dcb6d6290fd8f9a152b8b9ef9cae67e/2021/09/29/1900e4c7-5110-4b73-a556-0123cdf71305/	5 KB 5 KB	19ms 17ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/03c839069dcb6d6290fd8f9a152b8b9ef9cae67e/2021/09/29/1900e4c7-5110-4b73-a556-0123cdf71305/cyberattack.jpg?width=170&height=128&fit=crop&auto=webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f700b4bcfa6fe55f3c1d773dde9ca6b1e0a15463d186a1d06290045f91852055 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1247623 idim=1600x1069 ifmt=jpeg ofsz=4908 odim=170x128 ofmt=webp fastly-stats io=1 content-length 4908 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "rubdyHe35n8cis4C9gGoVoEd9jUALhUbQ+6BRiR0tbw" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Wed, 01 Dec 2021 14:18:13 GMT
GET H2	200	/ Show response www.zdnet.com/newsletter/xhr/widget-login/	2 KB 1 KB	177ms 176ms	XHR application/json	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash f99bb672e6651c8834ad107597f95b6e8294794a4e23cb93ebe4a69cc289cbf6 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers X-NewRelic-ID VgEBVlJWCRAGXVRVDwMDUlc= tracestate 78034@nr=0-1-2767451-695782612-4b3eb4c71529d652----1639402000009 traceparent 00-ef4244faf007706b6af9f3b62184a300-4b3eb4c71529d652-01 Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 newrelic eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI3Njc0NTEiLCJhcCI6IjY5NTc4MjYxMiIsImlkIjoiNGIzZWI0YzcxNTI5ZDY1MiIsInRyIjoiZWY0MjQ0ZmFmMDA3NzA2YjZhZjlmM2I2MjE4NGEzMDAiLCJ0aSI6MTYzOTQwMjAwMDAwOSwidGsiOiI3ODAzNCJ9fQ== Accept application/json, text/javascript, */*; q=0.01 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ X-Requested-With XMLHttpRequest Response headers content-security-policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval' data:; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:; content-encoding gzip x-content-type-options nosniff vary Accept-Encoding, User-Agent x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade x-newrelic-app-data PxQFVlBUDAYBR1dbAgYPVFAFBRFORDQHUjZKA1ZLVVFHDFYPbU5yARBfWA86TFZWRxcNB0NFUhQ7Rl9XBQMXPUMKVxVnVFtVWgsbTQFPA1JUBgdNVk0IBgBRUU4aABtEUAkEClpXWlsCWgxQDA8NBhFJXwBdElY/ x-frame-options SAMEORIGIN date Mon, 13 Dec 2021 13:26:40 GMT expect-ct max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly" strict-transport-security max-age=63072000; includeSubDomains; preload x-tx-id a96bbba0-c36c-41b5-ab05-973bc0b5738f content-type application/json via 1.1 varnish cache-control max-age=0, must-revalidate, private accept-ranges bytes expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	40ms 18ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" etag "1637097310169751" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6386 x-xss-protection 0 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	julian-assange-norfolk-btl-zaw2.png www.zdnet.com/a/img/resize/f8a521e05e5b37a00c54b443a18f0c454ffa6324/2014/10/04/6297ebad-4bb1-11e4-b6a0-d4ae52e95e57/	29 KB 30 KB	8ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/f8a521e05e5b37a00c54b443a18f0c454ffa6324/2014/10/04/6297ebad-4bb1-11e4-b6a0-d4ae52e95e57/julian-assange-norfolk-btl-zaw2.png?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 06ae225065f8274975d52c1816b3c7939efa7ade5c8185cea4480c61e0419064 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish fastly-io-info ifsz=486459 idim=620x312 ifmt=png ofsz=30140 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1588634731138322 fastly-stats io=1 content-length 30140 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "8PLgcw16PBxvC8CR8nQJim5YJrAx8wY1AeQGVyIwyZg" vary Accept-Encoding, Accept strict-transport-security max-age=31536000 content-language en cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes content-type image/webp expires Fri, 10 Dec 2021 18:05:57 GMT
GET H2	200	mozilla.jpg www.zdnet.com/a/img/resize/eaf8b07bdffd018992f265c39d6c5cb73176c584/2021/11/01/c240c8fa-eb6d-401d-816d-c8706d9a27ad/	5 KB 6 KB	8ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/eaf8b07bdffd018992f265c39d6c5cb73176c584/2021/11/01/c240c8fa-eb6d-401d-816d-c8706d9a27ad/mozilla.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash bc25b41e910e88fd9e667a84a8f53e046d0ab8ef8459d02ec551f90053bb498c Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1244215 idim=1600x1069 ifmt=jpeg ofsz=5586 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5586 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "AIIbQ3x8mLvTyppdyJjxiiwTVC6jT0pCGhXg67B6Neo" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 06 Dec 2021 02:12:08 GMT
GET H2	200	kiribati-gettyimages.jpg www.zdnet.com/a/img/resize/41d36b0b6d28d653540873eee5c700be9af55ba9/2021/12/12/e980dc8b-9265-4827-a57b-d83ea2296601/	4 KB 4 KB	8ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/41d36b0b6d28d653540873eee5c700be9af55ba9/2021/12/12/e980dc8b-9265-4827-a57b-d83ea2296601/kiribati-gettyimages.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 016c8e95d84837bcc270e273163e1335867d5a2c1a8d98d959e18955be410e46 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=139911 idim=1024x683 ifmt=jpeg ofsz=3712 odim=170x128 ofmt=webp fastly-stats io=1 content-length 3712 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "RIbNDkeNT/loVuWgg0xE32bYSH8KRVJpLzF70qPFnxY" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 00:51:55 GMT
GET H2	200	istock-12457481571.jpg www.zdnet.com/a/img/resize/3bb4b71db7407bb613a5adc4613e35eb5e2b168d/2020/06/18/8795205e-246b-4241-859f-13d4bdf3f225/	5 KB 5 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/3bb4b71db7407bb613a5adc4613e35eb5e2b168d/2020/06/18/8795205e-246b-4241-859f-13d4bdf3f225/istock-12457481571.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c3a0eaa531dec94d5c31e7084f362cf1eee571457e7006bdefe14124be2c316f Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish fastly-io-info ifsz=46842 idim=770x368 ifmt=jpeg ofsz=4768 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1599085560588717 strict-transport-security max-age=31536000 content-length 4768 x-xss-protection 1; mode=block fastly-io-warning Failed to apply profile server ContentServer x-frame-options SAMEORIGIN etag "L1YRI4chV0dE8rGfwxMpDTB2tCAHzE1Is2YgKv4TrZw" vary Accept-Encoding, Accept content-type image/webp fastly-stats io=1 cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 06:40:26 GMT
GET H2	200	gettyimages-close-up-of-fingers-typing-on-glowing-red-backlight-keys-on-a-computer-keyboard.jpg www.zdnet.com/a/img/resize/2bcca569c447ab7814de68bec1335e5db1f9f081/2021/12/13/6af65f57-2326-4a2f-9f6f-035fd5fbd2db/	5 KB 6 KB	8ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/2bcca569c447ab7814de68bec1335e5db1f9f081/2021/12/13/6af65f57-2326-4a2f-9f6f-035fd5fbd2db/gettyimages-close-up-of-fingers-typing-on-glowing-red-backlight-keys-on-a-computer-keyboard.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash c7f60459f4466a5840ec76c9c6582bb9e3a11f0ce1367d285e82f64cf03961bd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1745268 idim=2121x1414 ifmt=jpeg ofsz=5534 odim=170x128 ofmt=webp fastly-stats io=1 content-length 5534 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Za4EGD/Lq/2YYmCjLM9RVrxbprFqkqaT03pY7s7ZiY4" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 13:22:51 GMT
GET H2	200	gettyimages-cyber-dude-laptops.jpg www.zdnet.com/a/img/resize/5481509c36cafea7e6b9e55ecb8937af1b6d0ac2/2021/04/16/a6a75218-3366-4758-affa-493811134a0d/	2 KB 2 KB	8ms 8ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/5481509c36cafea7e6b9e55ecb8937af1b6d0ac2/2021/04/16/a6a75218-3366-4758-affa-493811134a0d/gettyimages-cyber-dude-laptops.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 142c8e986c2e743affcd3c7486f4544203514fcb01bcd5944fb706b1434d95f0 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=126885 idim=2198x1363 ifmt=jpeg ofsz=2136 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1618537354389305 fastly-stats io=1 content-length 2136 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "zHmqc1HKZoAL2IHuBEfaeDYimyA8ngbGXGGAnXerfY4" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Mon, 13 Dec 2021 14:13:42 GMT
GET H2	200	cyberattack.jpg www.zdnet.com/a/img/resize/03c839069dcb6d6290fd8f9a152b8b9ef9cae67e/2021/09/29/1900e4c7-5110-4b73-a556-0123cdf71305/	5 KB 5 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/03c839069dcb6d6290fd8f9a152b8b9ef9cae67e/2021/09/29/1900e4c7-5110-4b73-a556-0123cdf71305/cyberattack.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f700b4bcfa6fe55f3c1d773dde9ca6b1e0a15463d186a1d06290045f91852055 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=1247623 idim=1600x1069 ifmt=jpeg ofsz=4908 odim=170x128 ofmt=webp fastly-stats io=1 content-length 4908 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "rubdyHe35n8cis4C9gGoVoEd9jUALhUbQ+6BRiR0tbw" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Wed, 01 Dec 2021 14:18:13 GMT
GET H2	200	cma-cgm-shipping-cargo.jpg www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/	8 KB 8 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/fc04cce82984a695c132fe002e4a797c7d51fbca/2020/09/28/ee8dbfe1-2027-497b-8e60-8d70f47df60c/cma-cgm-shipping-cargo.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash f267f9c57ffe8ff134eee5ec282089ff9c4c0669ea8c8af414d38fe501410e9e Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=117362 idim=1000x500 ifmt=jpeg ofsz=8254 odim=170x128 ofmt=webp x-goog-meta-x-goog-reserved-source-generation 1601311989734263 fastly-stats io=1 content-length 8254 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "GpD9eEagf1IBcPIW0iapNx6zp8GVyVxnL0QII+RW2xA" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 17:41:38 GMT
GET H2	200	shutterstock-1751628242.jpg www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/	2 KB 3 KB	7ms 7ms	Image image/webp	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.zdnet.com/a/img/resize/45b4951298807677f6190dbe83c047c44a1ec468/2021/12/10/f51f9371-75c9-4c47-8557-99fd4932ecdf/shutterstock-1751628242.jpg?width=170&height=128&fit=crop&auto=webp Requested by Host: www.zdnet.com URL: https://www.zdnet.com/a/fly/aa418b-fly/js/main.default.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash ee6665447bf60c13dcfb2a7e8f3e80d231f2f5cb180995889956ef93eebd8549 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT via 1.1 varnish vary Accept-Encoding, Accept fastly-io-info ifsz=11768242 idim=6000x4000 ifmt=jpeg ofsz=2488 odim=170x128 ofmt=webp fastly-stats io=1 content-length 2488 x-xss-protection 1; mode=block server ContentServer x-frame-options SAMEORIGIN etag "Co54q6atr81IOHkwJ/WxG4xFMcCEePDgjnujOhrERQI" strict-transport-security max-age=31536000 content-type image/webp cache-control max-age=31536000 content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes expires Fri, 10 Dec 2021 23:22:03 GMT
GET H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/1/	49 B 714 B	207ms 165ms	Script text/javascript	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=1365&ck=1&ref=https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/&ap=281&be=294&fe=1269&dc=332&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1639401998700,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:14,%22c%22:14,%22s%22:19,%22ce%22:36,%22rq%22:37,%22rp%22:264,%22rpe%22:278,%22dl%22:267,%22di%22:332,%22ds%22:332,%22de%22:332,%22dc%22:1269,%22l%22:1269,%22le%22:1278%7D,%22navigation%22:%7B%7D%7D&fp=390&fcp=390&at=GkEWQAhCSx5HAxIDThwe&jsonp=NREUM.setToken Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Mon, 13 Dec 2021 13:26:40 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/javascript Access-Control-Allow-Origin * Transfer-Encoding chunked Cross-Origin-Resource-Policy cross-origin Connection keep-alive access-control-allow-credentials true CF-Ray 6bcf8684b8feede3-CDG
GET H2	200	core-web-vitals-16efe3ae21-rev.js Show response www.zdnet.com/a/fly/js/managers/	545 B 623 B	7ms 7ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/managers/core-web-vitals-16efe3ae21-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 82f947d14a0a198dfe3cec2fde7896f6e332eb798cc193dad8da9ed2225277cd Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 366 x-xss-protection 1; mode=block last-modified Tue, 07 Dec 2021 17:56:03 GMT server ContentServer x-frame-options SAMEORIGIN etag "97c90999c3821165a77181123b19f0e8" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Tue, 14 Dec 2021 18:20:57 GMT
GET H2	200	show-hide-1.0-2b8cfc35ab-rev.js Show response www.zdnet.com/a/fly/js/components/	2 KB 846 B	7ms 6ms	Script application/javascript	2a04:4e42:4d::666 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.zdnet.com/a/fly/js/components/show-hide-1.0-2b8cfc35ab-rev.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:4d::666 , United States, ASN54113 (FASTLY, US), Reverse DNS Software ContentServer / Resource Hash 1a703d617fb31d56238372d5bf78e9861b3a09b7447a0184bd5f1c178461ed12 Security Headers Name Value Content-Security-Policy default-src https://*.zdnet.com:* Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip vary Accept-Encoding, Accept content-length 710 x-xss-protection 1; mode=block last-modified Mon, 06 Dec 2021 15:21:02 GMT server ContentServer x-frame-options SAMEORIGIN etag "e58b9e4990b9ed6a6b5f03642fcd0fba" strict-transport-security max-age=31536000 content-type application/javascript via 1.1 varnish cache-control max-age=604800,no-transform content-security-policy default-src https://*.zdnet.com:* accept-ranges bytes timing-allow-origin * expires Mon, 13 Dec 2021 15:22:57 GMT
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012111011823000/ Frame E6FF	189 KB 55 KB	62ms 7ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 499187 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 55592 x-xss-protection 0 server sffe date Tue, 07 Dec 2021 18:46:53 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "11dee2040f5fc1d7" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 07 Dec 2022 18:46:53 GMT
GET H2	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame E6FF	13 KB 5 KB	71ms 17ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 486064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4992 x-xss-protection 0 server sffe date Tue, 07 Dec 2021 22:25:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "858600ba27ef7413" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 07 Dec 2022 22:25:36 GMT
GET H2	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame E6FF	89 KB 28 KB	72ms 17ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 501009 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28555 x-xss-protection 0 server sffe date Tue, 07 Dec 2021 18:16:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a64e482645fd262b" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 07 Dec 2022 18:16:31 GMT
GET H2	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame E6FF	5 KB 2 KB	74ms 20ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 167045 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1731 x-xss-protection 0 server sffe date Sat, 11 Dec 2021 15:02:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "cb4f0e89d7d37d9b" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 11 Dec 2022 15:02:35 GMT
GET H2	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame E6FF	40 KB 13 KB	75ms 20ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 142505 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12826 x-xss-protection 0 server sffe date Sat, 11 Dec 2021 21:51:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f02165e023e70703" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 11 Dec 2022 21:51:35 GMT
GET H2	200	css fonts.googleapis.com/ Frame E6FF	3 KB 1 KB	37ms 16ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 13 Dec 2021 12:04:00 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Mon, 13 Dec 2021 13:26:40 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 13 Dec 2021 13:26:40 GMT
GET H/1.1	200 OK	pixel protected-by.clarium.io/	68 B 345 B	44ms 13ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6NzI4eDkw&v=5&s=v31fmpvijno&sb=-1&h=www.zdnet.com&cb=7481353&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZOekk0ZURrdyIsIndkIjp7Im8iOjI4NzA3ODYwNzUsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H3	200	en_bl.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6FF	2 KB 2 KB	25ms 9ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Sun, 12 Dec 2021 20:16:06 GMT x-content-type-options nosniff server cafe age 61834 etag 11660698925711390587 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2471 x-xss-protection 0 expires Mon, 13 Dec 2021 20:16:06 GMT
GET H3	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6FF	295 B 319 B	24ms 9ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 05:43:34 GMT x-content-type-options nosniff server cafe age 27786 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Tue, 14 Dec 2021 05:43:34 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame E6FF	0 0	40ms 14ms	Image text/html	2a00:1450:4001:828::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaTc8su7hhL-Ma0HOqYe8U963nPoweexcVVlf230HYlcP8JJlRzu7pWxfQGOSRCq5PWw42YxhKU42y9ytOVJTUGaEyG3Ww Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	B25164142.293110099;dc_pre=CNr39K7w4PQCFRRB4AodHBAFhw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame E6FF Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdid=;tag_for_child_directed_treatmen... https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CNr39K7w4PQCFRRB4AodHBAFhw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdi...	42 B 63 B	41ms 26ms	Image image/gif	172.217.18.102 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CNr39K7w4PQCFRRB4AodHBAFhw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Server 172.217.18.102 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s42-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CNr39K7w4PQCFRRB4AodHBAFhw;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=2446191987;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame E6FF	0 0	51ms 51ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CpYcHD0q3YbGRLO_L7_UPtsGYyAL-mqSIZ8n6o5bYDNvZHhABIPe7x4MBYJXikIKgB6ABlNbu1QPIAQbgAgCoAwGqBMkCT9CrBwOdcvqpK3REkjvU0AoL-7qgBU8By3njOMXuPzlIAWgMPlVWnmnQyQwKN6SPvjwiXDBeE2gKv-l2uD682eZruO19z-fIxMYoh0IGa5VHIa1kQ1MhvGJXhluTm4ND9xV8TEA5sC4XtKuGAHrQt_-Tw_18FNC3ybbFWLEO5O-vI6xbJqevhNNN4aPuQHN--Tp4638f7r4ySt-83fZFW2Cjb6ENAafTw9D-CBJ9Z0lAUkyurzEb3dzUCLg3mzXI40uE4OADfifk3btsPzjp-xGE4fRuTqmOOS0jj_mJvy-K7nCOewSmNe8uOR5jxDjLhJxcSKfWgN5To0I1AF4n-Mcdm9iqap9nlqSvnbzAXkJgQ4Mh0Uq9rTOkManoV1kMDO3vChUfau657uiin48mlT34XjLne2IxVH6QkRE9olR24LYfDgZu897ABJSf4Lu6A-AEAZIFBAgEGAGSBQQIBRgEgAfUqZEqqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ6f9H0ggJCIjhgBAQARgdgAoDyAsB2BMMiBQB0BUBmBYBgBcBshceChwIABIUcHViLTg4MjAzNjI2MDU3MTExOTYYyZt6&sigh=SP7hCiBXZ8w&uach_m=[UACH]&template_id=492&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET DATA	200 OK	truncated / Frame E6FF	216 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 73969c75b43b5280351e275b72ba73d331cd995f6ca7675e8cede41267ec75b1 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	35ms 19ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639401999752&de=712666489538&rx=493648219705&m=0&ar=8ab009d7785-clean&iw=04a0275&q=3&cb=0&cu=1639401999752&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=nav&zMoatvguid=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatptype=article&zMoatsl=nav-ad-plus-leader%3FT-1000&pe=1%3A390%3A390%3A1279%3A332&jk=-1&jm=-1&fs=195979&na=184922542&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H3	200	integrator.js Show response adservice.google.de/adsid/	107 B 122 B	34ms 16ms	Script application/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	integrator.js Show response adservice.google.com/adsid/	107 B 122 B	35ms 17ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	20 KB 9 KB	55ms 54ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2421186219939079&correlator=2021690010579679&output=ldjh&impl=fifs&eid=44756717&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211213&iu_parts=22309610186%2Caw-zdnet%2Ctechnology%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&prev_scp=pos%3Dbottom%26sl%3Dmpu-bottom%253FLL%257CT-1000%26iid%3Dunit%253Dmpu-bottom%257Cvguid%253Dd8d276c4-244f-43be-be76-be6e9f7629be%257Cpv%253D1&eri=1&cust_params=test%3Dbest_list%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cgovernment%252Ccyber-threats%252Capplications%26tag%3Dcyber-security%26prodtype%3Dcards%252Capplicator%26mfr%3Dcheck-point%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%26env%3Dprod%26user%3Danon%26userGroup%3Dfirst_impression%26type%3Dgpt%26region%3Daw%26subses%3D3%26session%3Db%26pv%3D1%26vguid%3Dd8d276c4-244f-43be-be76-be6e9f7629be%26m_data%3D1%26m_safety%3Dunsafe%26m_categories%3Dgs_entertain%252Cgs_finance%252Cgs_tech%252Cgs_tech_phones%252Cmoat_unsafe%252Cgs_tech_computing%252Cgv_crime%26m_mv%3DnoHistData%26m_gv%3DnoHistData&cookie=ID%3D24b5cacfc80d9c3d-229f453a05cd00a1%3AT%3D1639401999%3AS%3DALNI_MYLqv8sVrRyFWQOI2HKLykFIno-2w&bc=31&abxe=1&lmt=1639402000&dt=1639402000161&dlt=1639401998967&idt=651&frm=20&biw=1600&bih=1200&oid=2&adxs=1050&adys=1550&adks=606318677&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=370x250&msz=370x30&ga_vid=1961307111.1639402000&ga_sid=1639402000&ga_hid=2134894213&ga_fc=false&fws=4&ohw=370&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 2b8d6ab981337620e2a4641c5eff457ff1f74474528f5d500f0e220eb02a863f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9115 x-xss-protection 0 google-lineitem-id 5688542871 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138349983448 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame E6FF	21 KB 22 KB	29ms 7ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 07 Dec 2021 20:07:29 GMT x-content-type-options nosniff age 494351 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21424 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:24 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 07 Dec 2022 20:07:29 GMT
GET H2	200	4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame E6FF	21 KB 21 KB	33ms 13ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 07 Dec 2021 10:56:24 GMT x-content-type-options nosniff age 527416 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21660 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:07:18 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 07 Dec 2022 10:56:24 GMT
GET H3	200	container.html Show response 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C7F6	6 KB 3 KB	23ms 8ms	Document text/html	2a00:1450:4001:82b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 13 Dec 2021 13:26:39 GMT expires Tue, 13 Dec 2022 13:26:39 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 1 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/225/ Frame EBD1	13 KB 5 KB	7ms 7ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5046 date Mon, 13 Dec 2021 13:15:24 GMT expires Tue, 13 Dec 2022 13:15:24 GMT last-modified Mon, 21 Jun 2021 20:47:05 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 676 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	aframe Show response www.google.com/recaptcha/api2/ Frame 6CB4	783 B 534 B	35ms 17ms	Document text/html	2a00:1450:4001:828::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 96fffc8a9ff6ee2e1ee85f7dd46d6d8f89462392d416b8a6373416bedc3e2770 Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-Nes+YiRqwgLOtxXZbT90gw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Mon, 13 Dec 2021 13:26:40 GMT date Mon, 13 Dec 2021 13:26:40 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-Nes+YiRqwgLOtxXZbT90gw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 512 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 9EC0	0 0	44ms 43ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuqoCZ6UgyCtHFaiertQABGgrKJ7pTYCBw7NRoo50j-XLIRS1ej4YSt18sd1SamsEOaCNA1KkXYTYOewTkqPt_-ZFUIzZnxJ3xHf5GrrIOmbu4g4qsDWXZsRdcm0ZWcxGnpFhLMNAp1pfWoVX8BM2cLCCQifuVuLWzFrz_o3tIvknFjbM-jFyfJajILWtteP-gBxsNMTvesFONhD5yyCYY0sumSAYv1uK1DSRCYeSjuKI26f6tx6stp313zKnKwJKTQ_y56Uii8nfKOpRGwE1yNw0QXJQOZsdLMORvAFZKf4cg6qexK9XxUoMqfCPkJXXfgpMB_C57VPb8&sig=Cg0ArKJSzDKrErbfFiG6EAE&uach_m=[UACH]&urlfix=1&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/ Frame 9EC0	78 KB 26 KB	17ms 16ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 1907478e8fa62801a1db26be87cab0755288131c9c8e80320582e560825df3cc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1069 / 978 of 1000 / last-modified: 1639397097" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 26912 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 9EC0	119 KB 37 KB	2161ms 2137ms	Script text/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:42 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 13 Dec 2021 13:26:42 GMT
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/ Frame 9EC0	335 KB 112 KB	40ms 39ms	Script application/x-javascript	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip last-modified Thu, 09 Dec 2021 16:36:30 GMT server AmazonS3 x-amz-request-id G85B7X4BDG3XQXNK etag "9c75e5b0c5bc0a53e0cdef53eae89c77" vary Accept-Encoding content-type application/x-javascript cache-control max-age=9018 accept-ranges bytes content-length 114446 x-amz-id-2 dFEXSaK1YIFJMrG2zCIjWW/53ykIcfzya/4OqOjSodPQdVoUN0oOf9sBWW+rTddw8uFpja+dVfc=
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	50ms 49ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639401999752&de=254949030031&rx=493648219705&m=0&ar=8ab009d7785-clean&iw=04a0275&q=4&cb=0&cu=1639401999752&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=middle&zMoatvguid=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatptype=article&zMoatsl=mpu-middle%3FLL%7CT-1000&pe=1%3A390%3A390%3A1279%3A332&jk=-1&jm=-1&fs=195979&na=2105051611&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H3	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012111011823000/ Frame BDBB	189 KB 54 KB	25ms 8ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 98ba8f881333898d751dabe4f8b4cacc4489a9f5b6b4fd1fc67c571dbfec95cf Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 499187 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 55592 x-xss-protection 0 server sffe date Tue, 07 Dec 2021 18:46:53 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "11dee2040f5fc1d7" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 07 Dec 2022 18:46:53 GMT
GET H3	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame BDBB	13 KB 5 KB	36ms 19ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-ad-exit-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 65f6185cfe1cf88fa7981160dd6fa443e111887215b72953718ea70f8e2ba9f2 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 486064 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4992 x-xss-protection 0 server sffe date Tue, 07 Dec 2021 22:25:36 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "858600ba27ef7413" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 07 Dec 2022 22:25:36 GMT
GET H3	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame BDBB	89 KB 28 KB	36ms 19ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-analytics-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9e97fc43ecd2f16948c3a8d2de65e0e5483db4ed5ab174058c178ca1c8665d0b Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 501009 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28555 x-xss-protection 0 server sffe date Tue, 07 Dec 2021 18:16:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "a64e482645fd262b" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Wed, 07 Dec 2022 18:16:31 GMT
GET H3	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame BDBB	5 KB 2 KB	38ms 22ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-fit-text-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d76ab4ac854cafef51bbbb5177ea75816df90e3c775294991a016404f2b6bb5 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 167045 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1731 x-xss-protection 0 server sffe date Sat, 11 Dec 2021 15:02:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "cb4f0e89d7d37d9b" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 11 Dec 2022 15:02:35 GMT
GET H3	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012111011823000/v0/ Frame BDBB	40 KB 13 KB	39ms 22ms	Script text/javascript	2a00:1450:4001:828::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012111011823000/v0/amp-form-0.1.mjs Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9a630b852e94f20cb8140704fd830bf40bfea0a2effaa67d06a0eadafbf3d508 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 142505 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12826 x-xss-protection 0 server sffe date Sat, 11 Dec 2021 21:51:35 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "f02165e023e70703" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Sun, 11 Dec 2022 21:51:35 GMT
GET H3	200	css fonts.googleapis.com/ Frame BDBB	3 KB 580 B	31ms 16ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700 Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 76ca98643b0229d7a50626e2ed31a2ba5663b0697c880420fc3e4c6ca82684ca Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 13 Dec 2021 12:36:54 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Mon, 13 Dec 2021 13:26:40 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 13 Dec 2021 13:26:40 GMT
GET H3	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame BDBB	295 B 319 B	7ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: confiant-integrations.global.ssl.fastly.net URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202112021159/wrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 05:43:34 GMT x-content-type-options nosniff server cafe age 27786 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Tue, 14 Dec 2021 05:43:34 GMT
GET DATA	200 OK	truncated / Frame BDBB	209 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3a663467e111fd2237a1bc5255e8d702b099f29cb553ecab24efe98cbf898b5d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated / Frame BDBB	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash def9548a4fadd8cb6efb8af1a05a1fb41aad236a87debe3c078634fcc5cc5800 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	pixel protected-by.clarium.io/	68 B 345 B	12ms 12ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6MzAweDYwMA==&v=5&s=v31fmpvijuv&sb=-1&h=www.zdnet.com&cb=8354241&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZNekF3ZURZd01BPT0iLCJ3ZCI6eyJvIjoyODcwNzg2MDc1LCJ3IjoiMzAwIiwiaCI6IjYwMCJ9LCJ3ciI6Mn0= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H3	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame BDBB	2 KB 2 KB	8ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Sun, 12 Dec 2021 20:15:16 GMT x-content-type-options nosniff server cafe age 61884 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Mon, 13 Dec 2021 20:15:16 GMT
GET H3	204	l www.google.com/ads/measurement/ Frame BDBB	0 0	17ms 16ms	Image text/html	2a00:1450:4001:828::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaTppolI4q59bXsfQMRpocAiq2wRplS0Nc3h6NLwJ1EsJxtaJD-qLSupIV5vTaeuqXDapuYLKkk_9aQu7MI9uD2VMMqQGA Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	B25164142.293110099;dc_pre=CIvaga_w4PQCFYOSdwodtnUL9A;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/ Frame BDBB Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdid=;tag_for_child_directed_treatmen... https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CIvaga_w4PQCFYOSdwodtnUL9A;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdi...	42 B 63 B	27ms 27ms	Image image/gif	172.217.18.102 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CIvaga_w4PQCFYOSdwodtnUL9A;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Server 172.217.18.102 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s42-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N46002.134426GOOGLEDISPLAYNETW3/B25164142.293110099;dc_pre=CIvaga_w4PQCFYOSdwodtnUL9A;dc_trk_aid=486104933;dc_trk_cid=142452121;ord=3914610404;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame BDBB	0 0	50ms 49ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CRUNcD0q3Yer_LbGilQfO4aOAAv6apIhnyfqjltgM29keEAEg97vHgwFgleKQgqAHoAGU1u7VA8gBBuACAKgDAaoE0AJP0DbBAfXENUs0iV2kzGf41mfOo2X3ab22m1xjfYJagZ39nl9CXFWBwiC9Rq6TamA3fejd0tpO9nea3c5GAW1IwNFroL6mLZt-IOG84jAornytlD3-SOan5WeFIPXTgvT8zP_Xil0g13PPaMYvsYHcCXq-ugdZY4963Ry8dNk8XNW5dCNq3lghVr-j-bx8mmrclTVawRjLmeQgnJ8iPXq3eq8VC7eC47I_VqW-iTeS3R2XFubG8_U5TLDEZLfniGIitIFltfDKqUs6aamQF54qc2p1S0ypFCqYtJWzP9glNJoAkCjV3kRqXANdW_BkZljwCV9m2iZRXlxRyVyfanvARBNp29rRTh_IS0rghqitV9SF3b-JmiF_TaEQ8LsWQ6cbCyOz-5Z-b5ZGJ2cgjMj9h1D2o86uzhiESbl1qvQuGP6Jibv6bvV-0-n8FkFMQRnABJSf4Lu6A-AEAZIFBAgEGAGSBQQIBRgEgAfUqZEqqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQpNxU0ggJCIjhgBAQARgdgAoDyAsB2BMMiBQB0BUBmBYBgBcBshceChwIABIUcHViLTg4MjAzNjI2MDU3MTExOTYYyZt6&sigh=d2iiGRTBLao&uach_m=[UACH]&template_id=5020&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness) Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H2	200	si googleads.g.doubleclick.net/pagead/drt/ Frame E6FF Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	0 0	66ms 65ms	Image text/html	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Protocol H2 Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Redirect headers date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3	200	en_bl.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6FF	2 KB 2 KB	7ms 6ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en_bl.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e1a3c83144fa5752c8668ca056742ec9e6d6dfe5cfb75a97a9e53d1150068f91 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Sun, 12 Dec 2021 20:16:06 GMT x-content-type-options nosniff server cafe age 61834 etag 11660698925711390587 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2471 x-xss-protection 0 expires Mon, 13 Dec 2021 20:16:06 GMT
GET H3	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E6FF	295 B 319 B	7ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012111011823000/amp4ads-v0.mjs Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 05:43:34 GMT x-content-type-options nosniff server cafe age 27786 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Tue, 14 Dec 2021 05:43:34 GMT
GET H3	200	4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame BDBB	21 KB 21 KB	23ms 8ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 07 Dec 2021 20:07:29 GMT x-content-type-options nosniff age 494351 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21424 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:24 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 07 Dec 2022 20:07:29 GMT
GET H3	200	4UabrENHsxJlGDuGo1OIlLV154tzCwY.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame BDBB	21 KB 21 KB	26ms 12ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLV154tzCwY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C700 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bbbc44e5ebb0694e2faa4b84737dc33d6b8fa9d0eaa8b5f63ac3537130cb07bf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.zdnet.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 07 Dec 2021 11:17:04 GMT x-content-type-options nosniff age 526176 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21444 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:20 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 07 Dec 2022 11:17:04 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	20ms 18ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_HEADER1&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1639401999752&de=252797791752&rx=493648219705&m=0&ar=8ab009d7785-clean&iw=04a0275&q=5&cb=0&cu=1639401999752&ll=2&lm=0&ln=0&em=0&en=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&zMoatAType=content_article&zMoatTest=zdnet&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&bo=aw-zdnet&bd=security&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=redventuresgamheader644747280705&fd=1&ac=1&it=500&zMoatpos=top&zMoatvguid=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatptype=article&zMoatsl=mpu-plus-top%3FLL%7CT-1000&pe=1%3A390%3A390%3A1279%3A332&jk=-1&jm=-1&fs=195979&na=1990932656&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	pixel Show response googleads.g.doubleclick.net/xbbe/ Frame B1EC	624 B 838 B	42ms 18ms	Document text/html	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY0_n8uQEwAQ&v=APEucNWHGMcAQaM6As34_lXEHIH7yaj6050iXVX3_BNenQsfRoV_0yQXAYlH6jQgd0fb7lDM_rnUmQdo3DnaL1sijZaI9ny8xFzIqpI_2Wr1G3ICnt5gz5JaD3GOq-rr3ZrcrXTRFxTEQjWIaSgmn76IRvp4QMNZZQ Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Mon, 13 Dec 2021 13:26:40 GMT server cafe cache-control private content-length 276 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	ad Show response googleads.g.doubleclick.net/dbm/ Frame C7F6	74 KB 30 KB	80ms 60ms	Script text/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A1nuvkJ_82rCx4oT0E86hPw35g-obetJdGkx5WyahWO3PVqwFh_fU-4g3ykxG3VObMSTiPTu0wbbglDLjv78ePZ1S2FFxRK7CtQjNj5eL3NScch2ARlz83fcMfokhUpyfbuT8RlDfdxKfmuWdWp1ZZj1IaTg&dbm_d=AKAmf-DxnRoN99v5FbZEue6rtusia-1sFmflq2qeT66XtkDO27weaA3jRVIdbp7LP4cPcAii4-g0I_X6S9o1Q5hJn8fk3RTYMqu0PlfyrX8fgnTtcMJZdX216xaKnk2TUTuxIBmCzJ8L7spiJ593MdopLkxGtqb65zgCLiaS-4PlU9uZIyMP35p-G-lsL8xw9UbvBU1JBwUQyDIfAYyqzssdJ_ENPp_fjH8N9krbWH7wVkMqmeNtJSvHvKdnomAgVbC3DBss2JbE-uexeN08Y429498ut5G00Pr8V3MWrL_ASJiJHkKrb1n0Fw8LgeCeGjl2dwzBJOx6Docup2Mf7tYY81U6C2RAFHWGe0yrG_VmRpYzqLTLXsfaxMsdjJyMD24c6VxZT2t01Orgt945VXjL9f1tsVBL3H3VXTw7iVZjeOOc3vnhUDDh4Q4P0-ykzy-50EOUzL-BgddhXmk1Wi3Es5MfRwilKbtchIDtvmRcU2fD0NYLxnR99bVTIqwrdmKBIZFw3hx1A_ntyRezhg7CNyFV-zj-cKlecP0tvvf87ISXfUVuDlw9M0VJEloOwP1IFsTCYLUI6ZIYggTDuStA8wKuaJz4iALR7PBaHPcrL3r7LN912Q9yYjqDJeWQI3Bvh_ZH34ue2sast8lRUEwnR9GbykW1Q1msDrcE_KstTTu35uvLEXBiGQlgA399pUKDhE7eHA0gSihOrBAXSr77vq2dGtBslhJJvmr0ueAzQ23Tqjl7yUr_KjPv1kYp8p-v8rAhsHtGCJeg-sWK51IhMeIvym1F-fIo1zA5F7gDbkW5rLM7L5_u45KW0tGCTk8NLmQJYXT8b-w7GC0X7kc0f8KsKCueiX3DqvE6QjwZEW1yWeTSrNO46eiz_M4Urlcpxchq-bsXZfKYthlY3MW4h484YGmh2Byd28kgq8pfTQtgpIqS_ZOtonbuKoBgxeXyRSBeCg2FWIb95kjxHFO9PBj9SL27ivr52LIaO6TBwgNyu_RqH1RKvYPaM6QE-Re6nihkm6G2Jjg8iLbZL-tE7KO_2jLVzt1DKrgs36Z4_eO3rKSJLcvkET1o_zQT0F2t0bfC3sOpXDZtSLmb8IV1BJRDmN0ZYfcqKWc7B9SglEj7AWy6Os80Cjpv8a8Yx0fxvDllnyiak-uSq_NCvqaXaEYPXyTME-J-OoAsQ7oC52XMuSR9V5Y-imYvoi7VUxZs6F3joMC-P34G3or4gXOj8GGf_cLMkGdFAPen0Jo_aYVQse7D1JTIRnjwwaLyofKoQC1U0272otR_Z3lCrRII1cRICUSnSy40fh8CfN-m4V7OL2SB96adQPBMcSx0htzVm3tk3XvLHaoq9kUFEMC01zWcdXo_vB8Qb6UkUqHe5X4ZG0qtM0ezoo1YEgxZm8OG6mON3rEgjaLxaen1W9tyTMaO5mMXHTJuqS_Zq4wLLVO67QepZr54b3z39dgS3fZd7qHQfrdc1lAdjNGu3v00l8CVdiFRhFQyTMOOBrVflMctTdPg7HYkira3bsS0TR3zwMRCEvqXDFj1TlSoF5SPVjdBvowVIfmZedlldtnXRKfF8UROkwH0TVjPfUgFZwVzfuNi8WLEvPfaHcB74YmGTLxm3RvK3MI2q79NxHWVipPQbyK3GEc0dfF97tVpMAbqwQJl312qr_lR6bjlMlH3h-adKhnC9-Seh_JF9W5NjRSKJ61thyhvsD1Fhw_VYbSBf6R2G5g2LAJ86UGOT_WEtYd8m7AjZITghercHIi-67vQrqDK6B5LOYvziNVttQHy68srtOAR-g0FCAwOymXn6JGPbXb_RPsdFbqW2sLm_WjF2C7-SJDwJpJWvxYMq686y_Tx47peCzD32FLHMAqxywfKOoYzSRoXE9zJP86Li9nw1XcwW06OWQs2_QOwseezBLYdazNIxy-OCPTzDdLlg3eEqGzPZqrONPyhWgOCEQc2lpNvKy5Q2SjfVjS-38K388KlQuQAf8if2HJmTWGc1mnp5kgRFWe4Pt7-mLIvL15gh5vZpJ1dImLEMYxeVheKcxW0zcsUJuHZy7f9sVz3o4DMSpwq4i84GcJSHpexnNS0ZKhZCsFcznbqe0ePbhddVu_qXaLKcSExlHBZtf2GYgQ6U8dAPNdre32zvPKWdAqtY30YvDCMKN9dAhE-8gPJVN2svzboPbAPigbghc5JZ6eLZCEUIx91NPq-dqKXk0POGHL5KEuqe4e2HGCJGVJrhOopYYsEASUSUEbdexNV3XzSkgpn8_uhnB5naSc_0eR7d-dVjpsWCxZr5P60_fRQQYk1aT1kgsycHurFgwwuMbxfC9u1yq88A5GxJMXc998pr8Wbpdb4EuT_T-PqIVsHxA14BoHO7RkxMoIv1pHJZpMgSUw3LzAzKq1zRb_0s0pDNcJ6d2_OMbfnljdasWFJPFzvYP4SwPJ2hJVU1QYdE9oEQF0tepmWjDgV_7FzkVWrkIP2Oel9FvzgOHyJ8hOdjy7-HWj6-BxbfXUf5LWZgtDjNSG-nnKhLbBQw5YIFT9TEVffNgqNmdBZCdinOyZ7rj3igsOWas1T3qChZvaiRaHrsHPZ-v5CwQOVSjyW5ukpBfgzmRqyyCYaN0i6IZNvIsJSgVHZqJVKQiTRsmj-XO27GCv0tR-PsyTw2SZKMyMELMfV7ASRFeeHVCngfN0FP8FQ-cG3R_Do02r0MsCMw_xi6fSt9UXonTm32SATaRwsIYChZnmY7hStaFaALCNutvEDKCGqPuZggu4GC2nLRA9q4Egnw0HvS_ijulGYQmv5AZwiVaKiULiUAtUiHjkHpqp_7Hp_cP-zFVMdBP3iIJJ80UxaGDUxH0ER6MpFDR-yXR326ioMQiailyjT-bZuN7NAY3Op6qW3wX93LF2Lu7bwKgH-Evy4xwXXjdAji49jiEfiX4p41W2rYuRmFJVoNi-AaMEdildTDPhnrhB68WGhH_y0Fsd25GlciOHHmzw2wARR_UoUST3R-AMhMQR1uL5GUFiTK7nBR_nt_PRx_RqPV7wWA_kIvc2ny0TF7gHFrOYFZAnVTpHA1v4vWegK9Ljv47xRUBJCNHAl8wgvsa1tpoinMrapm4ByiPsbKLupbGH0fKnsyhGspRJqWlFzO8O_7hgu3MsvIzF9vztpOFv_Gx1l20vAyLsEzwsuGYqUJBMg-_AMyumMnz23Q0gSKyP1IlLcOdy7DgFYhbgls77dVSZ7DSP8QH40r-l0Wozv3QWEs0uOp3u0mWcX7FYzMFEd0uM83Hv3EFa-l_f82Wex-netR2W1s7JJSyqLt5htiocXoC4&cid=CAASFeRo5gS4wIqMyCVd4Se8yUUw1u5l7A&rfl=1%2Chttps%253A%252F%252Fwww.zdnet.com%252Farticle%252Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%252F%240 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 77e288295a73f71ac5d79efddb032c5297a2d7e6295df6b699ed2da647cb9c0d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT content-encoding br x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30947 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	gen_204 pagead2.googlesyndication.com/pagead/ Frame C7F6	42 B 63 B	54ms 39ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BZO_7O1bIBzMq7Yl9HEjNAaEgRGfp77p_9KeL2AM86IJ-U5_LFG7fbG8Ef_et-qnQqTFTrTKx7NLtlTGiqCHvdxY7_x8Nj_U3Tej6wO_Iztzlz3AQ Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame C7F6	2 KB 1 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:22:04 GMT content-encoding gzip x-content-type-options nosniff age 276 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 27 Dec 2021 13:22:04 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame C7F6	119 KB 37 KB	1956ms 1956ms	Script text/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:42 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 13 Dec 2021 13:26:42 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame C7F6	15 KB 6 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:16:29 GMT content-encoding gzip x-content-type-options nosniff age 611 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6464 x-xss-protection 0 server cafe etag 15715955993838318253 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 27 Dec 2021 13:16:29 GMT
GET H/1.1	200 OK	pixel protected-by.clarium.io/ Frame C7F6	68 B 345 B	12ms 11ms	Image image/png	18.157.213.64 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://protected-by.clarium.io/pixel?tag=wt_SjNVWEZlZTF4Y2xZLWJmRmxXaDFtSVpfcGhVLzI4NzA3ODYwNzU6MzAweDI1MA==&v=5&s=v31fmpvik2g&id=eyJkZnAiOnsiYWQiOjUwMjQ0OTY5MTEsImMiOm51bGwsImwiOjAsIm8iOjI4NzA3ODYwNzUsIkEiOiIvMjIzMDk2MTAxODYvYXctemRuZXQvdGVjaG5vbG9neS9zZWN1cml0eSIsInkiOjI4OTA3MiwiY28iOjAsInMiOiJtcHUtbWlkZGxlIn19&sb=undefined&cb=9488358&h=www.zdnet.com&d=eyJ3aCI6IlNqTlZXRVpsWlRGNFkyeFpMV0ptUm14WGFERnRTVnBmY0doVkx6STROekEzT0RZd056VTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyODcwNzg2MDc1LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0= Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.157.213.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-157-213-64.eu-central-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT Server nginx/1.14.0 (Ubuntu) Content-Type image/png Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection keep-alive Content-Length 68 Expires Sat, 26 Jul 1997 05:00:00 GMT
GET H3	200	pubads_impl_2021120601.js Show response securepubads.g.doubleclick.net/gpt/ Frame 9EC0	348 KB 117 KB	16ms 16ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software sffe / Resource Hash 2d5ae5a515a688823dc98d032242c2ed6f490a74c4281bdd599567898f9fa675 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 119476 x-xss-protection 0 last-modified Mon, 06 Dec 2021 09:34:20 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Mon, 13 Dec 2021 13:26:40 GMT
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 6CB4	0 0	43ms 43ms	Image text/html	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2021120601&jk=2421186219939079&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	si googleads.g.doubleclick.net/pagead/drt/ Frame BDBB Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	0 0	99ms 84ms	Image text/html	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Redirect headers date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
POST H/1.1	200 OK	NRBR-a22c617a7b2aab2da1c Show response bam-cell.nr-data.net/events/1/	24 B 501 B	155ms 155ms	XHR image/gif	162.247.243.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRBR-a22c617a7b2aab2da1c?a=695782443&v=1212.e95d35c&to=NgYBNkBYWEEEAURQWg9MIgFGUFlcSgNCTVwCDwY9QVBYVQkH&rst=1867&ck=1&ref=https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 content-type text/plain Response headers Date Mon, 13 Dec 2021 13:26:40 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com access-control-allow-credentials true Connection keep-alive CF-Ray 6bcf86879d5eede3-CDG Content-Length 24
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame B1EC Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1 https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1&C=1	43 B 894 B	25ms 25ms	Image image/gif	2.18.234.21 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1&C=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY0_n8uQEwAQ&v=APEucNWHGMcAQaM6As34_lXEHIH7yaj6050iXVX3_BNenQsfRoV_0yQXAYlH6jQgd0fb7lDM_rnUmQdo3DnaL1sijZaI9ny8xFzIqpI_2Wr1G3ICnt5gz5JaD3GOq-rr3ZrcrXTRFxTEQjWIaSgmn76IRvp4QMNZZQ Protocol HTTP/1.1 Server 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-234-21.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 13 Dec 2021 13:26:40 GMT Redirect headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT Server Apache P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1&C=1 Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type text/html; charset=iso-8859-1 Content-Length 308 Expires Mon, 13 Dec 2021 13:26:40 GMT
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame B1EC Redirect Chain https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YbdKEPDyw9gMfWWaTGeFLgAA https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1	43 B 894 B	26ms 26ms	Image image/gif	2.18.234.21 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY0_n8uQEwAQ&v=APEucNWHGMcAQaM6As34_lXEHIH7yaj6050iXVX3_BNenQsfRoV_0yQXAYlH6jQgd0fb7lDM_rnUmQdo3DnaL1sijZaI9ny8xFzIqpI_2Wr1G3ICnt5gz5JaD3GOq-rr3ZrcrXTRFxTEQjWIaSgmn76IRvp4QMNZZQ Protocol HTTP/1.1 Server 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-234-21.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT Server Apache Vary Is-Traffic-Usersync P3p policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 13 Dec 2021 13:26:40 GMT Redirect headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKEf9C6uU-j0XsGiI0W5_44&google_cver=1 cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 313 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	bounce ib.adnxs.com/ Frame B1EC Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm https://ib.adnxs.com/setuid?entity=101&code=CAESEAA0eWqmeRHeNWObmLkTycc&google_cver=1 https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAA0eWqmeRHeNWObmLkTycc%26google_cver%3D1	43 B 1 KB	61ms 61ms	Image image/gif	185.33.220.100 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAA0eWqmeRHeNWObmLkTycc%26google_cver%3D1 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY0_n8uQEwAQ&v=APEucNWHGMcAQaM6As34_lXEHIH7yaj6050iXVX3_BNenQsfRoV_0yQXAYlH6jQgd0fb7lDM_rnUmQdo3DnaL1sijZaI9ny8xFzIqpI_2Wr1G3ICnt5gz5JaD3GOq-rr3ZrcrXTRFxTEQjWIaSgmn76IRvp4QMNZZQ Protocol HTTP/1.1 Server 185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT X-Proxy-Origin 185.232.23.180; 185.232.23.180; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid bb7cd50e-64fc-48dc-8e3a-cabb4b661798 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin * Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT X-Proxy-Origin 185.232.23.180; 185.232.23.180; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 62be316e-7951-4d1a-804d-76910f996607 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAA0eWqmeRHeNWObmLkTycc%26google_cver%3D1 Cache-Control no-store, no-cache, private Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame B1EC Redirect Chain https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ4MjEyOTE3NzkwMTU2MDM1NA%3D%3D	170 B 188 B	17ms 16ms	Image image/png	142.250.74.194 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ4MjEyOTE3NzkwMTU2MDM1NA%3D%3D Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI3YtQIQrNz6rAIY0_n8uQEwAQ&v=APEucNWHGMcAQaM6As34_lXEHIH7yaj6050iXVX3_BNenQsfRoV_0yQXAYlH6jQgd0fb7lDM_rnUmQdo3DnaL1sijZaI9ny8xFzIqpI_2Wr1G3ICnt5gz5JaD3GOq-rr3ZrcrXTRFxTEQjWIaSgmn76IRvp4QMNZZQ Protocol H3 Server 142.250.74.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s02-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:40 GMT X-Proxy-Origin 185.232.23.180; 185.232.23.180; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com AN-X-Request-Uuid 8a76bdf7-6f24-4a9e-a67c-503af4e28e84 Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ4MjEyOTE3NzkwMTU2MDM1NA%3D%3D Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3	200	integrator.js Show response adservice.google.de/adsid/ Frame 9EC0	107 B 122 B	17ms 16ms	Script application/javascript	2a00:1450:4001:828::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	integrator.js Show response adservice.google.com/adsid/ Frame 9EC0	107 B 122 B	16ms 15ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 9EC0	0 20 B	45ms 45ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sra_setclickurl&pvsid=1004953407530916&lenfreqs=449%3A1&vrg=2021120601&nw_id=22309610186&nslots=1&eid=31060033&pub_url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/ Frame 9EC0	30 KB 12 KB	51ms 51ms	XHR text/plain	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1004953407530916&correlator=3084049475876926&output=ldjh&impl=fif&eid=31060033&vrg=2021120601&ptt=17&sc=1&sfv=1-0-38&ecs=20211213&iu_parts=22309610186%2Caw-rv%2Civt&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuP8yGZgkjt0JLyFj8tB4eiSwx7Ups4aj0DrhXyfYluEwVQnx0dqrIhIurUb_OAO6KdBv8YlFW6YA6k9Dk7ttXu8lJAB8zEG1nvOHll8aCUa3RqvAhX5_GnhaMI2H09fTC2mP7LACLybQie5i_-ACxABaBdPNy5YaBcl2_KDu5WsMHoIHWLCUCr9W7MlkUQ17ZpmZ5j6tU76M4-WVeQzRj9g6p0oL79D02IxMDAK0Wvsgsnej24lpGQHAZnHXtdTDwh4FYAVxFO2VivoH8j4eGqn8MRxgcsiNvayuAT3rwURhnq25lwlmNGnAWivwNUjxFeQOqfpTY%26sig%3DCg0ArKJSzL4GIUeKvjmIEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&prev_scp=campaign%3D5677026463&cookie=ID%3D1da59b05b6e2859d-2295b5a006cd0084%3AT%3D1639401999%3AS%3DALNI_Mal4h8FpFn04FOpXEHGeAzlqf_DGg&cdm=www.zdnet.com&bc=31&abxe=1&lmt=1639402000&dt=1639402000591&dlt=1639402000256&idt=327&ea=0&frm=23&biw=1600&bih=1200&isw=300&ish=250&oid=2&adxs=1050&adys=1955&adks=1319207525&ucis=lvriepgc1jlt&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=300x0&ga_vid=1391105685.1639402001&ga_sid=1639402001&ga_hid=1077989664&ga_fc=false&fws=256&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 178636767630e4873f446ad083a20e0353fe44de7285b1b508e4de3947a580ae Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12477 x-xss-protection 0 google-lineitem-id 5677026463 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138355023537 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.zdnet.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html Show response 8589743d42d94f3a811df79914d14da1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E0DB	6 KB 3 KB	45ms 14ms	Document text/html	2a00:1450:4001:82b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://8589743d42d94f3a811df79914d14da1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Mon, 13 Dec 2021 13:26:40 GMT expires Tue, 13 Dec 2022 13:26:40 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	html_inpage_rendering_lib_200_275.js Show response s0.2mdn.net/879366/ Frame C7F6	169 KB 59 KB	59ms 7ms	Script text/javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ Origin https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sun, 12 Dec 2021 23:38:39 GMT content-encoding gzip x-content-type-options nosniff age 49681 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60173 x-xss-protection 0 last-modified Mon, 27 Sep 2021 18:44:51 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 13 Dec 2021 23:38:39 GMT
GET H3	200	omrhp.js Show response pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/ Frame C7F6	8 KB 3 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/elements/html/omrhp.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:23:11 GMT content-encoding gzip x-content-type-options nosniff age 209 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3140 x-xss-protection 0 server cafe etag 17163059639670574047 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 27 Dec 2021 13:23:11 GMT
GET H3	200	abg_lite.js Show response pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame C7F6	24 KB 9 KB	12ms 12ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a1b000b433199bfd60632e61b74bb2c4abd074dce072784e7acd55b1e4158cee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:23:05 GMT content-encoding gzip x-content-type-options nosniff age 215 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 9516 x-xss-protection 0 server cafe etag 14328493792227503680 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 27 Dec 2021 13:23:05 GMT
GET H3	200	A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Show response pagead2.googlesyndication.com/bg/ Frame EBD1	35 KB 13 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 037b12d07ffce84bbca6821a50f249c54429b20c0f2fd67469a0bb5937113051 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:21:47 GMT content-encoding br x-content-type-options nosniff age 293 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13610 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 13 Dec 2022 13:21:47 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame FC15	0 0	42ms 42ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvgtmy6TazSMSCxYOgk5gpNjRGxqQzpt8btUBTGskBVdnOifcXS3Yg9b1D1AqlsbSQEm1hN-65dxxWpVaqnRRDcupctSwWCLwDMPD6NIiQaSLCiNpIDnMM4aDkrAzIhB8fTMD-9maNf7RyqR04YZI_f2yxukPOnDjcva72NnE5RAZV01a9mcj7nnvfpAw_SOhL_IIKXDTYVWOVB2Xuj6tMPsvf4jIuH42z-0egsw9saSiRHIt-XnIBp2MC1fIPAkuhNNtiIDzVmLl6NC75MAqMIs89Md9lalV-v_Sgb7QbzJA1FKQMx2g&sig=Cg0ArKJSzB3C4Bdgepi6EAE&uach_m=[UACH]&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame FC15	2 KB 1 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:22:04 GMT content-encoding gzip x-content-type-options nosniff age 276 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Mon, 27 Dec 2021 13:22:04 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame FC15	119 KB 37 KB	1772ms 1771ms	Script text/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:42 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Mon, 13 Dec 2021 13:26:42 GMT
GET H3	204	l www.google.com/ads/measurement/ Frame FC15	0 0	20ms 19ms	Image text/html	2a00:1450:4001:828::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRl8PBfvzOecQvueIiWf1wPqdoQKIXhD9DtLYEUBfnVMEoop0psCcfOZnk7c0M1YqR9eKZ677aO36qI6NajR4pzg8Kmag Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H2	200	moatad.js Show response z.moatads.com/redventuresgamdisplay60805146916/ Frame FC15	335 KB 112 KB	26ms 25ms	Script application/x-javascript	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://z.moatads.com/redventuresgamdisplay60805146916/moatad.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash ec3300dff5a35315ea608c5dc57e965957897133eb6a543533566d6e2c35ed07 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:40 GMT content-encoding gzip last-modified Thu, 09 Dec 2021 16:36:30 GMT server AmazonS3 x-amz-request-id G85B7X4BDG3XQXNK etag "9c75e5b0c5bc0a53e0cdef53eae89c77" vary Accept-Encoding content-type application/x-javascript cache-control max-age=9018 accept-ranges bytes content-length 114446 x-amz-id-2 dFEXSaK1YIFJMrG2zCIjWW/53ykIcfzya/4OqOjSodPQdVoUN0oOf9sBWW+rTddw8uFpja+dVfc=
GET H3	200	16181266791146063110 tpc.googlesyndication.com/simgad/ Frame FC15	17 KB 17 KB	8ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/16181266791146063110 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bb3661ac37cbb213b64eb600c7c30da647babd9a2b2ffdbe5f30830fcebe2cc4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 11:20:11 GMT x-content-type-options nosniff age 439589 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17729 x-xss-protection 0 last-modified Thu, 01 Jul 2021 21:34:20 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Thu, 08 Dec 2022 11:20:11 GMT
GET H3	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame C7F6	41 KB 15 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sun, 12 Dec 2021 23:38:18 GMT content-encoding gzip x-content-type-options nosniff age 49702 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 12 Dec 2022 23:38:18 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	67ms 15ms	Image image/gif	92.122.255.233 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=120&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1639401999752&r=254949030031&t=meas&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=d8d276c4-244f-43be-be76-be6e9f7629be&gpt_target_ptype=article&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Ftechnology%2Fsecurity&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.122.255.233 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-122-255-233.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	68ms 15ms	Image image/gif	92.122.255.233 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=120&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1639401999752&r=254949030031&t=nht&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=d8d276c4-244f-43be-be76-be6e9f7629be&gpt_target_ptype=article&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Ftechnology%2Fsecurity&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.122.255.233 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-122-255-233.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	27ms 26ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=aw-zdnet&zMoatAdUnit2=technology&zMoatAdUnit3=security&wf=1&ra=3&pxm=&sgs=3&vb=6&kq=1&lo=1&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2F13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&i=REDVENTURES_GAM_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-sUdVZ1Vo8OQdpO6sSX9z7tLEdt1JXu2DKy1rcUrt9QAOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-NM4Tcd8kLtBk3A%3D%3D&sc=1&os=1-0w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=493648219705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=11&zMoatpos=middle&zMoatvguid=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatptype=article&zMoatsl=mpu-middle%3FLL%7CT-1000&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=250&w=300&rm=1&fy=1050&gp=1476.984375&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639401999752&de=254949030031&cu=1639401999752&m=1020&ar=8ab009d7785-clean&iw=04a0275&cb=0&rd=1&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=1476.984375&lb=4190&le=1&lf=93&lg=1&lh=20&ch=0&vv=1&vw=1%3A0%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A390%3A390%3A1279%3A332&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=120&cd=0&ah=120&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5024496911%3A2870786075%3A5718138840%3A138352803033&bo=aw-zdnet&bd=security&gw=redventuresgamheader644747280705&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&zMoatAType=content_article&zMoatTest=zdnet&hv=findIframeAds&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&jk=2&jm=-1&tc=0&fs=195979&na=1760863384&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H3	200	index.html Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	21 KB 4 KB	36ms 17ms	Document text/html	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3125bf41a896ec5c79af5e8926e90736842fa1caedd6c0ab8c5a5cae122e7d34 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-type text/html access-control-allow-origin * cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT expires Tue, 13 Dec 2022 13:26:40 GMT cache-control public, max-age=31536000 last-modified Fri, 20 Aug 2021 07:35:05 GMT x-content-type-options nosniff x-dns-prefetch-control off content-encoding gzip server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
POST H2	200	view googleads4.g.doubleclick.net/pcs/ Frame C7F6	0 377 B	67ms 50ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvU-6QUBp8alMCTGFJd-MNzMCxzvEVY1IYirc9e3NkIQloqczlBDgSzVgs90JdmvkHl1S3iIFo9WFRu9oALD_UgRH1B5Ii92vIjuS7W3rdBM7-X2xHUUiQ2CdVVzn3RBYzzl0YnRE0aafesHt0pk4SiVYK2YReNENQuEsZvUxdpOCeYwe5ryduLneuXkMCuyCFktlaCDhIRqbl3uSTV3RfAL3qQ31wsBYMydN4fQXOyhHGnMN_eeQHywi8_hB6FKhrYb0WmeuKVX4EmOYZZhKaXfMDgW6jXUcqM380rnzY09ISKGPA8wGGXduonnupOkAIjGJG2jCB7M4qDc1BfR_BrzJOreoDEoEzlkL8K_qPi1vwWHaDCMICT5BgJKgFbiPmfrEGwjyCRQ-UGH8y3lg8vxy0EXBZPtkyxrZ_pRBhfrinygxE8p35XPxz6XzhDeRzZmnw2JVRw0YNC5OOSKtXD6ZYk65rOvo-cJIXnEmftKziyYxK8Ei2VOS9gsU22KIPauy1_VkcTWplr0pABc3wbzCmYpStfyaM7uOgYXpJ9OZ8Pzyfo-QBPQZsP5Vk9xz-T5_GxRy1So1iDdTwqr6plymFfOzl0mkwCA3KFzpa9ibx_ZrIGJ6Zjw3Ga5VCGdg_2SktZhGncuuka-d9heJwdYcX6USsREQqW9Zqy1OYNa4t_XZUuFPqolnswq_898pYEaXw3njdkJVezEuEBl__xqxH0CsZ0reDQ7IvOvPr5P9yTwK-d-RUPzvMh_OL9f5yI2WYnVbQilbUbZzrdII3pkutDVQfKUGEr0aQY-XH_2EDvEWw0f62V8PJ4V9z0u3af4vVZCm69YbBnvOmeve1Krc7cd5Phr7LXztsHpD22F1SQBwmwFE1NBce8oOHWXufTpsUsW2TdYOUEnqTs-dNFV9q495RjJFy1ZMhOHotmaFPbma4UmGG1-lsWhylh1E8OKKOyY-gYuc36LrUyMIw0tOy6YUoJ9Cy8AH5e4YRqqJNjugX8Jd7Kpe7zD1AbJXkq224zYQ0fktiSoDXUnCxEMJf0TgdeWuJJLeEM197XEz_O2xzHX7w0qcITIpa1DxzPdrO-OvzM5wgh_NbvX2RfDpAE1viogsjT3HvLPEImNLZYiDSXw9Dan5nxLxIa6uA9NNxnZt7XN9iq4g&sai=AMfl-YS-iiq8ZDHiocI1eVE9c1tpExswfNkPZOVw0hdw0FewPjCzbdwF9hNxjz56CPDtdBw9-2vtcG3cBbq5JHzPmt0uKAiGbwtjYdV7AIU3LqRdlTye6XdOD11zQmY_BJp9iOJjeiPjAcAYp0UEI1tltlkNZDhrGaH8xzc2kSc&sig=Cg0ArKJSzBGhXrStyN8PEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=182&cbvp=1&cstd=175&cisv=r20211207.12234&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version date Mon, 13 Dec 2021 13:26:40 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	200	Enqz_20U.html Show response tpc.googlesyndication.com/sodar/ Frame 0938	22 KB 8 KB	7ms 7ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} timing-allow-origin * content-length 8395 date Sun, 12 Dec 2021 23:38:39 GMT expires Mon, 12 Dec 2022 23:38:39 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 49681 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	pixel.gif redventuresgamheader644747280705.s.moatpixel.com/	43 B 260 B	17ms 17ms	Image image/gif	92.122.255.233 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamheader644747280705.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=207&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5024496911&L2id=2870786075&L3id=5718138840&L4id=138352803033&S1id=aw-zdnet&S2id=security&ord=1639401999752&r=254949030031&t=hdn&os=0&fi2=0&div1=0&ait=0&gpt_target_pos=middle&gpt_target_vguid=d8d276c4-244f-43be-be76-be6e9f7629be&gpt_target_ptype=article&gpt_target_sl=mpu-middle%3FLL%7CT-1000&fullAdUnitPath=%2F22309610186%2Faw-zdnet%2Ftechnology%2Fsecurity&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.122.255.233 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-122-255-233.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:40 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:40 GMT
GET H3	200	gwdpage_style.css s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	55 B 103 B	11ms 11ms	Stylesheet text/css	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdpage_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 07 Dec 2021 16:02:53 GMT content-encoding gzip x-content-type-options nosniff age 509027 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 74 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Wed, 07 Dec 2022 16:02:53 GMT
GET H3	200	gwdpagedeck_style.css s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	731 B 263 B	11ms 11ms	Stylesheet text/css	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdpagedeck_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 234 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwdgooglead_style.css s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	24 B 72 B	12ms 11ms	Stylesheet text/css	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdgooglead_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 07 Dec 2021 16:02:53 GMT content-encoding gzip x-content-type-options nosniff age 509027 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Wed, 07 Dec 2022 16:02:53 GMT
GET H3	200	gwdimage_style.css s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	281 B 187 B	12ms 10ms	Stylesheet text/css	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdimage_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:00:15 GMT content-encoding gzip x-content-type-options nosniff age 462385 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 158 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:00:15 GMT
GET H3	200	gwdtaparea_style.css s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	157 B 144 B	12ms 10ms	Stylesheet text/css	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdtaparea_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 115 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwdattached_style.css s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	26 B 74 B	12ms 9ms	Stylesheet text/css	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdattached_style.css Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fffa14e9a3c576087a9202af54e8f11669f29c37617df0c6f728ca24d95f60bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	googbase_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	400 B 304 B	12ms 10ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/googbase_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 275 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwd_webcomponents_v1_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	21 KB 6 KB	12ms 10ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwd_webcomponents_v1_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 630dcb1aea14b0b32672353c6718f225a51122da1e170c35185ed4177b3489cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 09 Dec 2021 08:34:20 GMT content-encoding gzip x-content-type-options nosniff age 363140 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6288 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Fri, 09 Dec 2022 08:34:20 GMT
GET H3	200	gwdpage_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	3 KB 1 KB	12ms 9ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdpage_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3702675bb100b35f2cc13c2d7e830a1abb3d645ddeb6a2155be81d777d21dfa8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sun, 12 Dec 2021 05:02:00 GMT content-encoding gzip x-content-type-options nosniff age 116680 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1307 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 12 Dec 2022 05:02:00 GMT
GET H3	200	gwdpagedeck_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	8 KB 3 KB	21ms 19ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdpagedeck_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3cc9c19f7f03042ecb970557d5622cdd897a7dfc3ba92877137824f7ce88efde Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3130 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	Enabler_01_246.js Show response s0.2mdn.net/879366/ Frame 648F	116 KB 39 KB	15ms 13ms	Script text/javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/879366/Enabler_01_246.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Sun, 12 Dec 2021 16:54:32 GMT content-encoding gzip x-content-type-options nosniff age 73928 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40237 x-xss-protection 0 last-modified Wed, 30 Jun 2021 20:54:51 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Mon, 13 Dec 2021 16:54:32 GMT
GET H3	200	gwdgooglead_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	13 KB 4 KB	26ms 24ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdgooglead_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3f7b457ebebc60c111e92d8dc5d497b4c7fca36bcf99cffb9a1705f47424676 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4411 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwdimage_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	5 KB 2 KB	27ms 25ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdimage_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 00e3bc05f59be2a1faacba16a7c0fba7de267a60f2e88c04789e4ffe0dfb6056 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2004 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwdtaparea_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	4 KB 2 KB	25ms 23ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdtaparea_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d66c408f2d22f32c480961298e6fba83ca59fe57386f9e6726a47c27553aad90 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1809 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwdgpadataprovider_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	3 KB 1 KB	26ms 24ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdgpadataprovider_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 11084de664d888933874102638926c6686af22a88f1805fc3d4f55ba91b2d816 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1286 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	gwdattached_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	1 KB 616 B	27ms 26ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdattached_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3b1b78dc0bec6c4c5e65036a6d67c15a91ae2fc807f61ddab5ddccc3483cb9c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:00:15 GMT content-encoding gzip x-content-type-options nosniff age 462385 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 587 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:00:15 GMT
GET H3	200	gwdtexthelper_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	7 KB 3 KB	24ms 22ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwdtexthelper_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 35b384bb05910ed7d48bd862cd68e26612295c2019ae64a59984908292fd5bad Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:00:15 GMT content-encoding gzip x-content-type-options nosniff age 462385 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2873 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:00:15 GMT
GET H3	200	gwddatabinder_min.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	5 KB 2 KB	25ms 23ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwddatabinder_min.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 414eef74ac6306127645beddc4f34f59a6ea3994e410f188481d736b01ee4b65 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:00:15 GMT content-encoding gzip x-content-type-options nosniff age 462385 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2321 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:00:15 GMT
GET H3	200	gwd-dynamic-binders.js Show response s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	26 KB 10 KB	26ms 24ms	Script application/x-javascript	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/gwd-dynamic-binders.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1b7dae0db48b4096db0d72ceb798d500974825ca5eb1700d7b2a88d76591e360 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:37 GMT content-encoding gzip x-content-type-options nosniff age 462303 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10530 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/x-javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:37 GMT
GET H3	200	A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Show response pagead2.googlesyndication.com/bg/ Frame 0938	35 KB 13 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 037b12d07ffce84bbca6821a50f249c54429b20c0f2fd67469a0bb5937113051 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:21:47 GMT content-encoding br x-content-type-options nosniff age 293 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13610 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 13 Dec 2022 13:21:47 GMT
GET H3	200	Graphik-Semibold.ttf s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	121 KB 121 KB	10ms 10ms	Font application/octet-stream	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/Graphik-Semibold.ttf Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d0546f328272fedc2222238e38b0a7033ba865dc158da9ec88a021f001d11e6d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Origin https://s0.2mdn.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:01:39 GMT x-content-type-options nosniff age 462301 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 124076 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/octet-stream access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:01:39 GMT
GET H3	200	Graphik-Regular.ttf s0.2mdn.net/sadbundle/17315644224810091839/ Frame 648F	119 KB 119 KB	9ms 9ms	Font application/octet-stream	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s0.2mdn.net/sadbundle/17315644224810091839/Graphik-Regular.ttf Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 64509beac62bcfa481a8daf34bc69ce7942e5a9807d81bc658589c0915f772fa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 Origin https://s0.2mdn.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 08 Dec 2021 05:00:15 GMT x-content-type-options nosniff age 462385 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 121752 x-xss-protection 0 last-modified Fri, 20 Aug 2021 07:35:05 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type application/octet-stream access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 08 Dec 2022 05:00:15 GMT
POST H3	200	view googleads4.g.doubleclick.net/pcs/ Frame C7F6	0 23 B	44ms 44ms	Ping image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvU-6QUBp8alMCTGFJd-MNzMCxzvEVY1IYirc9e3NkIQloqczlBDgSzVgs90JdmvkHl1S3iIFo9WFRu9oALD_UgRH1B5Ii92vIjuS7W3rdBM7-X2xHUUiQ2CdVVzn3RBYzzl0YnRE0aafesHt0pk4SiVYK2YReNENQuEsZvUxdpOCeYwe5ryduLneuXkMCuyCFktlaCDhIRqbl3uSTV3RfAL3qQ31wsBYMydN4fQXOyhHGnMN_eeQHywi8_hB6FKhrYb0WmeuKVX4EmOYZZhKaXfMDgW6jXUcqM380rnzY09ISKGPA8wGGXduonnupOkAIjGJG2jCB7M4qDc1BfR_BrzJOreoDEoEzlkL8K_qPi1vwWHaDCMICT5BgJKgFbiPmfrEGwjyCRQ-UGH8y3lg8vxy0EXBZPtkyxrZ_pRBhfrinygxE8p35XPxz6XzhDeRzZmnw2JVRw0YNC5OOSKtXD6ZYk65rOvo-cJIXnEmftKziyYxK8Ei2VOS9gsU22KIPauy1_VkcTWplr0pABc3wbzCmYpStfyaM7uOgYXpJ9OZ8Pzyfo-QBPQZsP5Vk9xz-T5_GxRy1So1iDdTwqr6plymFfOzl0mkwCA3KFzpa9ibx_ZrIGJ6Zjw3Ga5VCGdg_2SktZhGncuuka-d9heJwdYcX6USsREQqW9Zqy1OYNa4t_XZUuFPqolnswq_898pYEaXw3njdkJVezEuEBl__xqxH0CsZ0reDQ7IvOvPr5P9yTwK-d-RUPzvMh_OL9f5yI2WYnVbQilbUbZzrdII3pkutDVQfKUGEr0aQY-XH_2EDvEWw0f62V8PJ4V9z0u3af4vVZCm69YbBnvOmeve1Krc7cd5Phr7LXztsHpD22F1SQBwmwFE1NBce8oOHWXufTpsUsW2TdYOUEnqTs-dNFV9q495RjJFy1ZMhOHotmaFPbma4UmGG1-lsWhylh1E8OKKOyY-gYuc36LrUyMIw0tOy6YUoJ9Cy8AH5e4YRqqJNjugX8Jd7Kpe7zD1AbJXkq224zYQ0fktiSoDXUnCxEMJf0TgdeWuJJLeEM197XEz_O2xzHX7w0qcITIpa1DxzPdrO-OvzM5wgh_NbvX2RfDpAE1viogsjT3HvLPEImNLZYiDSXw9Dan5nxLxIa6uA9NNxnZt7XN9iq4g&sai=AMfl-YS-iiq8ZDHiocI1eVE9c1tpExswfNkPZOVw0hdw0FewPjCzbdwF9hNxjz56CPDtdBw9-2vtcG3cBbq5JHzPmt0uKAiGbwtjYdV7AIU3LqRdlTye6XdOD11zQmY_BJp9iOJjeiPjAcAYp0UEI1tltlkNZDhrGaH8xzc2kSc&sig=Cg0ArKJSzBGhXrStyN8PEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=350&vt=11&dtpt=168&dett=3&cstd=175&cisv=r20211207.12234&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl= Requested by Host: www.zdnet.com URL: https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:40 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	41ms 41ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2021120601&jk=2421186219939079&bg=!vr2lvfnNAAZKWFskSlg7ACkAdvg8WscLp5yjFEJm3zl_XHhTwncppdSuwZq15_Ifpn0ReTnxAEQA4gIAAADqUgAAACBoAQeZArtrYJCmv2-fvAi3BIsEyt6zF_OsXjBUyZMIxUZJZtkHrv3M-x8U_LacIEz58Q3ei7l6HRPJ5b26hXpHdessLaGN5kvjgoumydAL7b62IOmd3FfnDsk-2MQu5joEbRwLANnLj76XcgTyS3bEUKCuHEQw6wD4RR1D1PxR9cTtNTDTAKlnGJRvOqTGmyWppYnreqi7IkOUt_7HCVsGx0yIXp3SfEhSAjPJfBzsfCpZO_apIOCdSJGzBjygDuzl0kswrfWUhNuQzzCyzq0pb9MVpcHDnFUhNAkSps6JuDS__2zKB0W7TNrJjUAHiSsOlGka4DNm40kZt6clNZ9wTiYziChy6WXocz0y6eWkWTWhOm35D1KsD4tqur3FxTmkslN4tkLC3Fb6FG_4R8fmqjxz_mHK-zs5lfpLzitq8OE0jJCAxLiDoURJiAkDq-WIkihzP_X4YiZ9BzgJJ682e7Kh7fL6_wflQnz6TPdOYpMaQ0rBzCcqqW-KKfE-cQSEx6J827mI7lHBtmhuyLiHZPzqDnJc1K8-FYLuFmZo7sYiL3iFczOa5-Gd2Ri9SGL7NJYsGX6RF0q7KvsstQVmNovJLUHs9uQqNsVDb5FWgajmiYTrVewP-5B7qpBdM8t8FtIx0w9eyP8OnspCFfhxXy11KleWK8xg2fB7gYfztvVwgflPyP0ky2ugpPjNA9l--jlGOu6u5CGU_V4ckQXu0U5TqO9QFLnhPKGmhMMyFztHRmcXanl0pO2r1WNx2GcDV9tjTJ7Lx5O5NRL-Og2dC52pjrcJHlp2TK1nCvwuwmsZ1qhv_J5Eh0--49qWMfi0ONJjbmpNB4lIS0wf2PFCOKdytO04D7XUikN3D2UgEdwgFREzBnrpeB1EgMXuPpZCIfUjrZ_7sA00du14Q0tDy9-GUAilqO5AttVJRbFPCPk Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 648F	6 KB 4 KB	34ms 19ms	XHR application/json	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_246.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 18018ec64a06927962d53494dfd7a5b5f7d834019ae0859b134665961575d79c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:41 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4467 x-xss-protection 0
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 648F	17 KB 6 KB	39ms 38ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: s0.2mdn.net URL: https://s0.2mdn.net/879366/Enabler_01_246.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:41 GMT content-encoding gzip x-content-type-options nosniff server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" etag "1637097310169751" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6386 x-xss-protection 0 expires Mon, 13 Dec 2021 13:26:41 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 0938	0 20 B	42ms 42ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgS2BEEq3YdvuHtzJ7_UP6dm2qAMAAAAAOAHgBAI&bg=!hoWlhcHNAAZKWFskSlg7ACkAdvg8WpfUpSEY9hNnZ0fuhtj8ftkuF8FSoPzPvP2w9u8cBed1k35fLQIAAABtUgAAAAtoAQcKAAxVU9tDBA5jKP5S1PmZAvcqZzynIg5wRppxfp3i3G15sz1GiqvHSaWx6EANrmmBEzlbafUqbQ_l8eVhcqxUWPzmS0IDC_3aOG5znTEkbY_iACClcdGnj-vR154wqT5uWzmcjDGHxY6_hUPMYsJ2bKs58AnE7wiAQGVbw072AlaR0I7E1zNX8kg9HzjX3eyhCWjPGveVTjQhTyv1zn04PiOZ9EG43TjMXeq6Qkg20Cjm-gGvghtR17SLLUeBcwedguzewvCUcxOsNa_pg-XkQo6xh5HoDXEEtJl0ZW9uUWzT8vPXRaGZOD7XNSFOPqAghR1SB29YzDdLX7elpzIAZjWYv6VHU_2jEn43zpPl79IbtV3xo2d1deJ6L-3GMNRDfUxCLUdgVM7VMLWK7F1mzfzNpNaNpK4QuWESnVTzhuf53X65aG0-EMVTNq6-2wFlHm-xL3VU7Jo6oDA97isf51w4O0_fQzInvyV1jyRQnYv8PGoLE-LDD_8krNtHgZXt5S4NUZ8ZlxQMGWEuwGZ6mg2AqN4MDTrclRHOGf-eWGVfFnE0tbB-8eLbtXmUvfejZlpJ30RWTPMUsbHYNqzGTA_Muj0R4Ypwufn8wT268l96KjE6cVYqH9B1OnVf5r-PFoEAXpHsWFVZLaeJqkM766z05_UCL6oGD6Ywf0a3TT7ZzXXzh0UjRRLtY4b22UJnNn-ay_APnq71LK8cNfiDsYcQ-ix48Ob7vK3dWngrhymMkhDMXBQsM9EWX8dVwH_CZbfROts4FAVTo_BWanepxgCLUMIhDh4Ppmtb1uv7Fowa2roeccpoCdvLVOJ3_rtGbQlMG8_0PgRVZ7GbIttOz1OS-yK1wJ8b_nTcg7XawQiraRtvzM0U2vNKTrCsfgA6T9I0G6RiayphJNO86Ef2rm4kMfrkgz03_041_zYgondGa-pJftk-W0sLU0wA2KmKWP4e70mC4Uyh-0PZgwzAQBFxqclkbglwuVU7Lyd9I3nfzy4fqbVxG9Xt9NUx4aZ70CsfzCWdDbU Requested by Host: 13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com URL: https://13e3ff94722aa8cf9a8b744f8a004925.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Show response pagead2.googlesyndication.com/bg/ Frame 782B	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 037b12d07ffce84bbca6821a50f249c54429b20c0f2fd67469a0bb5937113051 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:21:47 GMT content-encoding br x-content-type-options nosniff age 294 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13610 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 13 Dec 2022 13:21:47 GMT
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame E6FF	0 0	44ms 43ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CpYcHD0q3YbGRLO_L7_UPtsGYyAL-mqSIZ8n6o5bYDNvZHhABIPe7x4MBYJXikIKgB6ABlNbu1QPIAQbgAgCoAwGqBMkCT9CrBwOdcvqpK3REkjvU0AoL-7qgBU8By3njOMXuPzlIAWgMPlVWnmnQyQwKN6SPvjwiXDBeE2gKv-l2uD682eZruO19z-fIxMYoh0IGa5VHIa1kQ1MhvGJXhluTm4ND9xV8TEA5sC4XtKuGAHrQt_-Tw_18FNC3ybbFWLEO5O-vI6xbJqevhNNN4aPuQHN--Tp4638f7r4ySt-83fZFW2Cjb6ENAafTw9D-CBJ9Z0lAUkyurzEb3dzUCLg3mzXI40uE4OADfifk3btsPzjp-xGE4fRuTqmOOS0jj_mJvy-K7nCOewSmNe8uOR5jxDjLhJxcSKfWgN5To0I1AF4n-Mcdm9iqap9nlqSvnbzAXkJgQ4Mh0Uq9rTOkManoV1kMDO3vChUfau657uiin48mlT34XjLne2IxVH6QkRE9olR24LYfDgZu897ABJSf4Lu6A-AEAZIFBAgEGAGSBQQIBRgEgAfUqZEqqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ6f9H0ggJCIjhgBAQARgdgAoDyAsB2BMMiBQB0BUBmBYBgBcBshceChwIABIUcHViLTg4MjAzNjI2MDU3MTExOTYYyZt6&sigh=SP7hCiBXZ8w&vt=1&template_id=492&uach_m=[] Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	activeview pagead2.googlesyndication.com/pcs/ Frame E6FF	42 B 64 B	50ms 49ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssvvjAQkKgMjnRLruzFBeOB4dTVA_lnvj1VtkVzVIwItNafDm9NtQIomih7AZmPyfKQg_YzzsL8pvtoC4p9kvB89xGhWNl2IgSQF6-cZa8Znkltc7kIK5OS3JWtXw9yvnH8adxhyYMGlAVm&sai=AMfl-YSo32Cg03xX_uP6Dca48fD4nbULzecsvyJu9-GhSdZWY1d7ZSvfUyCQZyfm6iD-9C2MTTOnEKZGEfn_lMIEbYz04_HlDjemyBOeSZx7n6OjKHKdikB1_9G5L-r8xu4&sig=Cg0ArKJSzCaYvnLP4ql3EAE&id=ampim&o=436,5&d=728,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=254&tls=1254&g=100&h=100&tt=1254&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=3529097836 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame BDBB	0 0	44ms 43ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CRUNcD0q3Yer_LbGilQfO4aOAAv6apIhnyfqjltgM29keEAEg97vHgwFgleKQgqAHoAGU1u7VA8gBBuACAKgDAaoE0AJP0DbBAfXENUs0iV2kzGf41mfOo2X3ab22m1xjfYJagZ39nl9CXFWBwiC9Rq6TamA3fejd0tpO9nea3c5GAW1IwNFroL6mLZt-IOG84jAornytlD3-SOan5WeFIPXTgvT8zP_Xil0g13PPaMYvsYHcCXq-ugdZY4963Ry8dNk8XNW5dCNq3lghVr-j-bx8mmrclTVawRjLmeQgnJ8iPXq3eq8VC7eC47I_VqW-iTeS3R2XFubG8_U5TLDEZLfniGIitIFltfDKqUs6aamQF54qc2p1S0ypFCqYtJWzP9glNJoAkCjV3kRqXANdW_BkZljwCV9m2iZRXlxRyVyfanvARBNp29rRTh_IS0rghqitV9SF3b-JmiF_TaEQ8LsWQ6cbCyOz-5Z-b5ZGJ2cgjMj9h1D2o86uzhiESbl1qvQuGP6Jibv6bvV-0-n8FkFMQRnABJSf4Lu6A-AEAZIFBAgEGAGSBQQIBRgEgAfUqZEqqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQpNxU0ggJCIjhgBAQARgdgAoDyAsB2BMMiBQB0BUBmBYBgBcBshceChwIABIUcHViLTg4MjAzNjI2MDU3MTExOTYYyZt6&sigh=d2iiGRTBLao&vt=1&template_id=5020&uach_m=[] Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	activeview pagead2.googlesyndication.com/pcs/ Frame BDBB	42 B 64 B	46ms 46ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuyTMPdLPBLnHchN-oaIXjCk2xwuxyPIbWr6FwMNGhpKHJnN2TukOO34ZXa-U7_IaIoky4NLBIhBXowPd_iXEZxOLQpmgZxTBAj2d3iVikqEuHll4Llmxs20sBGxVQI3QLzlX8ScLKYKbua&sai=AMfl-YRA36PfGsrLtL-j2ChOjE8zBeP1BaWvfceWdAMHTyAvD22EyvpFhcUYCnLcvWeQN6pyBilgHpIagSLOnfV0ns2mrGPpkiUWV6ScNzwj9splu11xW5wWwwilCc_EG4k&sig=Cg0ArKJSzMSqXPVGkAqUEAE&id=ampim&o=1050,478&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=149&tls=1149&g=79.00000214576721&h=100&tt=1149&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=1139850431 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:41 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET DATA	200 OK	truncated / Frame 9EC0	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b2a6c51d93ca9229376a659a7df93e1237564d9a3a59ffed34de2aab37916af3 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	20ms 20ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1639402002474&de=927850629587&m=0&ar=cc97a930ec1-clean&iw=101177c&q=9&cb=0&ym=0&cu=1639402002474&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5009920773%3A2848205265%3A5688542871%3A138349983448&zMoatW=300&zMoatH=250&zMoatVGUID=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatSN=b&zMoatSL=mpu-bottom%3FLL%7CT-1000&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=unsafe&zMoatMData=1&zMoatCURL=zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A390%3A390%3A1279%3A332&iq=noHistData&tt=noHistData&tu=1&tp=unsafe&jk=-1&jm=-1&fs=195926&na=1877624551&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:42 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	24ms 15ms	Image image/gif	92.122.255.233 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=8&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5009920773&L2id=2848205265&L3id=5688542871&L4id=138349983448&S1id=22308610192&S2id=22654085702&ord=1639402002474&r=927850629587&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatCURL=zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet&zMoatPS=bottom&zMoatPT=article&zMoatSL=mpu-bottom%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=1&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.122.255.233 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-122-255-233.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:42 GMT
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	23ms 14ms	Image image/gif	92.122.255.233 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=8&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5009920773&L2id=2848205265&L3id=5688542871&L4id=138349983448&S1id=22308610192&S2id=22654085702&ord=1639402002474&r=927850629587&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatCURL=zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet&zMoatPS=bottom&zMoatPT=article&zMoatSL=mpu-bottom%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=2&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.122.255.233 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-122-255-233.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:42 GMT
GET DATA	200 OK	truncated / Frame C7F6	220 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 00df53589b2b9d083129044aca5c6d5f676dd1c1395b5939aec0515b14af9923 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame FC15	0 0	42ms 41ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst_bT1ocQssisA_A6L8J0UVtUeyhjNXIux-FU_WVIa7chqbjBZeo9b-YRIIBBy6TYCmbPHclC1lmZDQ1REUZAoSfOZ-onh8xuCmh-RUpyJGRJvfMBpkzDY7YijrIFin0XZwUEBL5Cr0Tj0IGPDVWH1gxDAQIpxejOh4vMA0sAMrzXiKWxzPVR2zI4smfCgWjWd_DOLfEiXcoHls8YsV_CRWDB3JKUh8iVdYDB0_OEwdE7SnmvGv88X9RfOKPI1QCPtwEcu_OTMQViax39_7-WSa1Mn7O-BqOUWjYNBS9Im6ToCsj-orB1VI&sig=Cg0ArKJSzImZakiImS9AEAE&uach_m=[UACH]&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:42 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Mon, 13 Dec 2021 13:26:42 GMT
GET DATA	200 OK	truncated / Frame FC15	216 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 42334fdfe51dab675bff6c495fc8c918a64443991c5c6d99a9daca86d8b59fe3 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	60019689_20210701071753329_Button1_300x250.svg s0.2mdn.net/ads/richmedia/studio/60019689/ Frame 648F	320 B 239 B	8ms 8ms	Image image/svg+xml	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210701071753329_Button1_300x250.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3fafcfea8f029a207adbff8ebb12bd62f6b129656fe72da89f09a46c0e585c83 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 07:48:32 GMT content-encoding gzip x-content-type-options nosniff age 20290 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 210 x-xss-protection 0 last-modified Thu, 01 Jul 2021 14:21:18 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 14 Dec 2021 07:48:32 GMT
GET H3	200	60019689_20210630083650481_300x250_ASG_ACNLogo.svg s0.2mdn.net/ads/richmedia/studio/60019689/ Frame 648F	3 KB 1 KB	9ms 8ms	Image image/svg+xml	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210630083650481_300x250_ASG_ACNLogo.svg Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a8355d33f3dd35891b695850ed2c172b5ee8487fba03fdca3dca6449667897a4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 05:10:33 GMT content-encoding gzip x-content-type-options nosniff age 29769 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1139 x-xss-protection 0 last-modified Wed, 30 Jun 2021 16:10:02 GMT server sffe vary Accept-Encoding report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 14 Dec 2021 05:10:33 GMT
GET H3	200	60019689_20210630073939543_300x250_ASG_Security_IMG1_Background.png s0.2mdn.net/ads/richmedia/studio/60019689/ Frame 648F	121 KB 121 KB	10ms 9ms	Image image/png	2a00:1450:4001:828::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/ads/richmedia/studio/60019689/60019689_20210630073939543_300x250_ASG_Security_IMG1_Background.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bf50e4a07277399557d82e3ca0505ecd2033feda09752ae4d6c92d47fa135666 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://s0.2mdn.net/sadbundle/17315644224810091839/index.html?e=69&leftOffset=0&topOffset=0&c=Q7eJvW2M2k&t=1&renderingType=2 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 06:19:50 GMT x-content-type-options nosniff age 25612 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 123437 x-xss-protection 0 last-modified Wed, 30 Jun 2021 14:39:39 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 14 Dec 2021 06:19:50 GMT
GET H3	200	view securepubads.g.doubleclick.net/pcs/ Frame 9EC0	0 0	42ms 41ms	Fetch image/gif	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvWT4iczUMI1r-S8w_42qCo1g4DAkHh0wcBSnwIBa6ZuyMDEpKs4jNres8U79CTwkna3g3X7HV4E6dIp0RRl0ibddiP6pWBDIMvG3-KZtzmFX0G-rMj5Ss3TMFYeHXCyyev8usKVGpxjGZChEU1-XtiYB8GFerjWU1uOavPU__sOf4emHay6RvjZruTMJ1TYrnjZpJQOz7cUKgmufy2eqIqgrag-8tVqJ5c1vcaDZqUq3qTdGFGmqXoyT1V3jfL8AvhON4ygE2EbXgV-jU0m2ogDtw1Lg3xSUF5iFel_mRgIuVGiMiSNFl2dAehDVb_wRypvYYIs3PGbwagAg&sig=Cg0ArKJSzIxGhsCWZ1O6EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl= Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:42 GMT x-content-type-options nosniff accept-ch Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 server cafe expires Mon, 13 Dec 2021 13:26:42 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/ Frame 9EC0	11 KB 8 KB	23ms 20ms	XHR application/json	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021120601&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e95762010a0c041109e084cbcdd5541ebded898de5a381e73a412021a8b0620b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Mon, 13 Dec 2021 13:26:42 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8476 x-xss-protection 0
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	20ms 19ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22654085702&bd=undefined&zMoatNotCnet=true&zMoatPT=article&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=bottom&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F16181266791146063110&i=REDVENTURES_GAM_DISPLAY1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BvmjrG%3DH%3C%5B*C%24GTK%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-sUdVZ1Vo8OQdpO6sSX9z7tLEdt1JXu2DKy1rcUrt9QAOGgL%2F6PC5WmU2F3MRrrFWS1qZ&rs=1-NM4Tcd8kLtBk3A%3D%3D&sc=1&os=1-0w%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&pcode=redventuresgamheader644747280705&rx=493648219705&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&f=0&j=&t=1639402002474&de=927850629587&cu=1639402002474&m=20&ar=cc97a930ec1-clean&iw=101177c&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4190&le=1&lf=0&lg=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A390%3A390%3A1279%3A332&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=8&cd=0&ah=8&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5009920773%3A2848205265%3A5688542871%3A138349983448&gw=redventuresgamdisplay60805146916&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22654085702&dfp=0%2C1&la=22654085702&zMoatW=300&zMoatH=250&zMoatVGUID=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatSN=b&zMoatSL=mpu-bottom%3FLL%7CT-1000&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=unsafe&zMoatMData=1&zMoatSlotId=mpu-bottom&zMoatCURL=zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet&zMoatDev=Desktop&zMoatDfpSlotId=mpu-bottom&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=2&jm=-1&tz=mpu-bottom&iq=noHistData&tt=noHistData&tu=1&tp=unsafe&tc=0&fs=195926&na=1007651095&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:42 GMT
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/ Frame 9EC0	17 KB 6 KB	49ms 48ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021120601.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:26:42 GMT content-encoding gzip x-content-type-options nosniff server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" etag "1637097310169751" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6386 x-xss-protection 0 expires Mon, 13 Dec 2021 13:26:42 GMT
GET H2	200	pixel.gif px.moatads.com/	43 B 260 B	22ms 22ms	Image image/gif	2.18.235.40 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://px.moatads.com/pixel.gif?e=17&i=REDVENTURES_GAM_DISPLAY1&hp=1&wf=1&ra=1&pxm=&sgs=3&bo=22308610192&bp=22383746382&bd=undefined&zMoatNotCnet=true&zMoatPT=Not%20Specified&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatPS=Not%20Specified&zMoatSZPS=Not%20Specified&zMoatPTAT=Not%20Specified&zMoatPTATSECT=content_article&zMoatAType=content_article&zMoatTest=zdnet&zMoatAB=content_article-zdnet&vb=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1639402002524&de=173468401077&m=0&ar=cc97a930ec1-clean&iw=101177c&q=13&cb=0&ym=0&cu=1639402002524&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5009920773%3A2848205265%3A5677026463%3A138355023537&zMoatW=300&zMoatH=250&zMoatMMV_MAX=na&zMoatCURL=zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet&zMoatDev=Desktop&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet%2F%23ftag%3DRSSbaffb68&id=1&ii=4&zMoatOrigSlicer1=22308610192&zMoatOrigSlicer2=22383746382&dfp=0%2C1&la=22383746382&gw=redventuresgamdisplay60805146916&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A390%3A390%3A1279%3A332&iq=na&tt=na&tu=&tp=&jk=-1&jm=-1&fs=195926&na=897662275&cs=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-235-40.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:42 GMT
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6A90	13 KB 5 KB	7ms 6ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5046 date Mon, 13 Dec 2021 13:15:24 GMT expires Tue, 13 Dec 2022 13:15:24 GMT last-modified Mon, 21 Jun 2021 20:47:05 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 678 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	aframe Show response www.google.com/recaptcha/api2/ Frame 52BE	783 B 535 B	16ms 16ms	Document text/html	2a00:1450:4001:828::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 31000053cc6a1d56ea292bce15a305e5e114b909d5d6252f04b2994fa0a5f94c Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-rdQ1q0x9KUoQsUFfs83wYQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Mon, 13 Dec 2021 13:26:42 GMT date Mon, 13 Dec 2021 13:26:42 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-rdQ1q0x9KUoQsUFfs83wYQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 513 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Show response pagead2.googlesyndication.com/bg/ Frame 6A90	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/A3sS0H_86Eu8poIaUPJJxUQpsgwPL9Z0aaC7WTcRMFE.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 037b12d07ffce84bbca6821a50f249c54429b20c0f2fd67469a0bb5937113051 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 13 Dec 2021 13:21:47 GMT content-encoding br x-content-type-options nosniff age 295 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13610 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 13 Dec 2022 13:21:47 GMT
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 52BE	0 0	55ms 55ms	Image text/html	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2021120601&jk=1004953407530916&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H2	200	pixel.gif redventuresgamdisplay60805146916.s.moatpixel.com/	43 B 260 B	15ms 15ms	Image image/gif	92.122.255.233 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://redventuresgamdisplay60805146916.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=196&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=5009920773&L2id=2848205265&L3id=5688542871&L4id=138349983448&S1id=22308610192&S2id=22654085702&ord=1639402002474&r=927850629587&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=d8d276c4-244f-43be-be76-be6e9f7629be&zMoatCURL=zdnet.com%2Farticle%2Fhackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet&zMoatPS=bottom&zMoatPT=article&zMoatSL=mpu-bottom%3FLL%7CT-1000&moatClientSlicer3=0&bedc=1&q=3&nu=1&ib=0&dc=1&ob=0&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 92.122.255.233 Schiphol, Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a92-122-255-233.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT last-modified Fri, 20 May 2016 15:16:00 GMT server AkamaiNetStorage etag "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Mon, 13 Dec 2021 13:26:42 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/ Frame 9EC0	0 20 B	42ms 42ms	Image image/gif	2a00:1450:4001:809::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2021120601&jk=1004953407530916&bg=!vr2lvfnNAAZKWFskSlg7ACkAdvg8Wlqf4eC7Xq0bKPifOFpGhP5tiFrHKFVj_HpY7b2sZ_x5DNkk3QIAAABMUgAAAAdoAQeZAserRc3J1OnKNOe-h9VRE1KwEL-0xW9mvr_vtf4hy7M0IcNVgg6-0uS_TRkNpvmoVfLwWzYpzYsm4oNypXwRJPkcNlC8d1P6L36p6kj82N3XhkZFRnWN414dhPKGm1xQYHjnpcI5ED0GyOLHVBSlWTbgb2PpBsMkFkan8qNaTXSEGTewaaHOXpplCRScY3u2fU0cgUyRnbXkHmNFp14wA5xjI5DWF5eA-2BEsQnGGhCqvvqAqnTTPkR3yXBemf_omnjDWJuGnjrGzUo6FXEYXEN01FUHD58VyTE4nr2urW_8IyNYsY_BcOwqojS_yojTDM5hnqyV2wHxz4uosqjVd1kroO1FzrN4AJRTFAX20BtkwMemdbdxSBUl-XBE7nomU7c_jpMcKETWCxD21tCgzBxl0ZQ3QavEAJSt7zaQvuySjx7IpSnb1wJS335Qq5kGLcFRzDtlEvd5XTF5c-KnSuN79xd1-0tL9KOO62ro2l9yZdWLFs3xdZKefIOvT-2MA5wHh-SYinKSini3Mk6JpLU6-pqncelEizZT-Gi1VMWRENpw-Zz3c3y0oVFHhGEfSpwjskH6pHqjzBn0gFXeRelJgipUnrum_hydE_T3g-tJ4o7vn1S-NKmsnLPX72zD4dordJcUhUJSEYDSvGLbputfgqMF7iTEUrGmi8WojAnJlkmjY5SkoIaRB0X0pZnpCZS79XFMxWMehHYDu7M6QxdkL-UQFRheDl4udDGipIRlgpakm3W7GwKoh_NzVrKZhfE9ybKUn5zyJEzenDKMBYP2-Y-98hoHd4hboX0Ud2_-NnUjGpzDbdF2K5nKAh0AQz1HuuVgJCgZHeReVsG7JeLGzDqFCM2MM5E1CrIjcWSqeEwXsbHMpAOmGTncrdVmsI5HykT9fe9NvlYmYhEYutRPMA3egmnQ11bZ_w2EjMz-VS686aNkG6o Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Mon, 13 Dec 2021 13:26:42 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	204 No Content	/ 02179916.akstat.io/	0 354 B	231ms 216ms	Ping image/gif	2a02:26f0:6c00:291::11a6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://02179916.akstat.io/ Requested by Host: c.go-mpulse.net URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_256_GCM Server 2a02:26f0:6c00:291::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.zdnet.com/article/hackers-pretending-to-be-iranian-govt-use-sms-messages-to-steal-credit-card-info-create-botnet/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Mon, 13 Dec 2021 13:26:44 GMT Content-Type image/gif Access-Control-Allow-Origin https://www.zdnet.com Cache-Control max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Timing-Allow-Origin * X-XSS-Protection 0 Expires Mon, 13 Dec 2021 13:26:44 GMT