urlscan.io logo urlscan.io
SecurityTrails logo

www.zdnet.com Open in urlscan Pro
2.18.233.143  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/00ebQBQ0nK
Effective URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Submission: On March 20 via manual from KR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 76 IPs in 5 countries across 60 domains to perform 438 HTTP transactions. The main IP is 2.18.233.143, located in European Union and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.zdnet.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on November 26th 2018. Valid for: 7 months.
This is the only time www.zdnet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.133 13414 (TWITTER)
10 2.18.233.143 16625 (AKAMAI-AS)
74 2.18.233.149 16625 (AKAMAI-AS)
7 23.67.133.23 20940 (AKAMAI-ASN1)
2 2.18.234.21 16625 (AKAMAI-AS)
8 104.111.214.229 16625 (AKAMAI-AS)
19 2a00:1450:400... 15169 (GOOGLE)
2 143.204.214.80 16509 (AMAZON-02)
3 34.235.30.148 14618 (AMAZON-AES)
1 3 172.217.16.166 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
18 172.217.23.162 15169 (GOOGLE)
1 34.240.175.172 16509 (AMAZON-02)
14 104.111.215.136 16625 (AKAMAI-AS)
5 151.101.122.133 54113 (FASTLY)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
5 2606:4700::68... 13335 (CLOUDFLAR...)
8 2606:4700::68... 13335 (CLOUDFLAR...)
2 7 34.246.247.78 16509 (AMAZON-02)
3 104.109.87.166 20940 (AKAMAI-ASN1)
1 2600:9000:200... 16509 (AMAZON-02)
5 64.30.230.22 6623 (CBSI-1)
3 2606:4700:20:... 13335 (CLOUDFLAR...)
1 52.208.88.219 16509 (AMAZON-02)
1 34.235.206.33 14618 (AMAZON-AES)
1 1 95.101.194.150 ()
2 2 34.192.38.147 ()
1 54.171.224.12 16509 (AMAZON-02)
2 2 2.18.233.201 ()
2 2 54.171.227.173 ()
2 3 18.197.149.199 16509 (AMAZON-02)
1 5 52.17.182.129 16509 (AMAZON-02)
6 54.72.87.193 16509 (AMAZON-02)
2 52.213.58.51 16509 (AMAZON-02)
4 63.140.43.37 15224 (OMNITURE)
5 37.252.172.70 29990 (ASN-APPNEXUS)
1 23.211.2.27 16625 (AKAMAI-AS)
1 4 66.117.28.68 15224 (OMNITURE)
5 14 104.111.214.103 16625 (AKAMAI-AS)
1 2.18.232.206 16625 (AKAMAI-AS)
1 3 34.255.169.159 16509 (AMAZON-02)
2 2a03:2880:f00... 32934 (FACEBOOK)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2 66.117.28.86 ()
1 1 172.217.23.130 ()
2 151.101.120.134 54113 (FASTLY)
1 1 172.217.16.130 ()
1 6 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... ()
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1288:110... 34010 (YAHOO-IRD)
2 2a03:2880:f10... 32934 (FACEBOOK)
2 23.99.128.52 8075 (MICROSOFT...)
5 99.84.8.118 16509 (AMAZON-02)
1 3.122.36.177 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
22 151.101.2.2 54113 (FASTLY)
50 2.18.235.40 16625 (AKAMAI-AS)
8 104.111.230.142 16625 (AKAMAI-AS)
4 213.19.162.61 26667 (RUBICONPR...)
4 151.101.1.181 54113 (FASTLY)
4 35.177.197.190 16509 (AMAZON-02)
19 2a00:1450:400... 15169 (GOOGLE)
4 213.19.162.57 26667 (RUBICONPR...)
1 2606:4700::68... ()
1 2a00:1450:400... ()
2 2a00:1450:400... ()
4 34.199.66.75 ()
5 2.16.186.10 ()
1 2607:f8b0:400... ()
5 54.145.115.34 ()
2 63.140.43.34 ()
2 54.165.7.225 ()
1 143.204.214.109 ()
1 18.185.208.109 ()
2 34.233.1.251 ()
1 143.204.214.86 ()
1 2a04:4e42::720 ()
2 52.72.207.232 ()
1 64.30.228.207 ()
438 76
1    104.244.42.133 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)
t.co
10    2.18.233.143 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-143.deploy.static.akamaitechnologies.com
www.zdnet.com
rev.cbsi.com
74    2.18.233.149 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-149.deploy.static.akamaitechnologies.com
zdnet4.cbsistatic.com
zdnet3.cbsistatic.com
zdnet2.cbsistatic.com
zdnet1.cbsistatic.com
7    23.67.133.23 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-67-133-23.deploy.static.akamaitechnologies.com
c.evidon.com
2    2.18.234.21 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com
js-sec.indexww.com
as-sec.casalemedia.com
8    104.111.214.229 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-214-229.deploy.static.akamaitechnologies.com
c.go-mpulse.net
0211c814.akstat.io
5f651e6f.akstat.io
19    2a00:1450:4001:81f::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagservices.com
2    143.204.214.80 (Wilmington, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-214-80.fra53.r.cloudfront.net
native.sharethrough.com
3    34.235.30.148 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-235-30-148.compute-1.amazonaws.com
l.betrad.com
3    172.217.16.166 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f166.1e100.net
ad.doubleclick.net
6    2a00:1450:4001:80b::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.de
6    2a00:1450:4001:808::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
adservice.google.com
18    172.217.23.162 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f2.1e100.net
securepubads.g.doubleclick.net
1    34.240.175.172 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-240-175-172.eu-west-1.compute.amazonaws.com
match.adsrvr.org
14    104.111.215.136 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-215-136.deploy.static.akamaitechnologies.com
tags.tiqcdn.com
5    151.101.122.133 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
vidtech.cbsinteractive.com
1    2a02:26f0:6c00::210:ba12 (European Union)

ASN20940 (AKAMAI-ASN1, US)
iicbsi-a.akamaihd.net
5    2606:4700::6810:a10d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.viglink.com
8    2606:4700::6810:4fa5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.lightboxcdn.com
7    34.246.247.78 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
ml314.com
3    104.109.87.166 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-87-166.deploy.static.akamaitechnologies.com
www.everestjs.net
1    2600:9000:200d:7400:15:efbc:e300:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
js.agkn.com
5    64.30.230.22 (Fort Lauderdale, United States)

ASN6623 (CBSI-1 - CBS Interactive Inc., US)
PTR: phx2-dw-cbsi-xw-ext-lb.cnet.com
dw.cbsi.com
3    2606:4700:20::6819:a322 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
tru.am
beacon.tru.am
1    52.208.88.219 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-208-88-219.eu-west-1.compute.amazonaws.com
d.agkn.com
1    34.235.206.33 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-235-206-33.compute-1.amazonaws.com
in.ml314.com
1    95.101.194.150 (European Union)

ASN- ()
PTR: a95-101-194-150.deploy.static.akamaitechnologies.com
tags.bluekai.com
2    34.192.38.147 (Ashburn, United States)

ASN- ()
PTR: ec2-34-192-38-147.compute-1.amazonaws.com
idsync.rlcdn.com
1    54.171.224.12 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-171-224-12.eu-west-1.compute.amazonaws.com
ml314.com
2    2.18.233.201 (European Union)

ASN- ()
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com
pixel.mathtag.com
2    54.171.227.173 (Dublin, Ireland)

ASN- ()
PTR: ec2-54-171-227-173.eu-west-1.compute.amazonaws.com
sync.crwdcntrl.net
3    18.197.149.199 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-197-149-199.eu-central-1.compute.amazonaws.com
ps.eyeota.net
5    52.17.182.129 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-17-182-129.eu-west-1.compute.amazonaws.com
dpm.demdex.net
6    54.72.87.193 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
api.viglink.com
2    52.213.58.51 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-213-58-51.eu-west-1.compute.amazonaws.com
cbsi.demdex.net
4    63.140.43.37 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: cbsi.com.ssl.sc.omtrdc.net
saa.cbsi.com
5    37.252.172.70 (European Union)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 154.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
secure.adnxs.com
1    23.211.2.27 (Cambridge, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-211-2-27.deploy.static.akamaitechnologies.com
as-sec.casalemedia.com
4    66.117.28.68 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
pixel.everesttech.net
14    104.111.214.103 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-214-103.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
1    2.18.232.206 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-206.deploy.static.akamaitechnologies.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
3    34.255.169.159 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-255-169-159.eu-west-1.compute.amazonaws.com
secure-us.imrworldwide.com
2    2a03:2880:f007:8:face:b00c:0:1 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
2    2a00:1450:4001:815::2001 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
tpc.googlesyndication.com
2    2a00:1450:4001:821::2006 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
s0.2mdn.net
1    2a02:26f0:6c00:197::e3d (European Union)

ASN20940 (AKAMAI-ASN1, US)
web-sdk.urbanairship.com
2    66.117.28.86 (Lehi, United States)

ASN- ()
cm.everesttech.net
1    172.217.23.130 (Mountain View, United States)

ASN- ()
PTR: fra16s18-in-f2.1e100.net
cm.g.doubleclick.net
2    151.101.120.134 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
zdnet-1.disqus.com
1    172.217.16.130 (Mountain View, United States)

ASN- ()
PTR: zrh04s06-in-f130.1e100.net
www.googleadservices.com
6    2a00:1450:4001:820::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:824::2004 (Ireland)

ASN- ()
www.google.com
1    2a00:1450:4001:820::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    2a00:1288:110:833::4000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)
ad.yieldmanager.com
2    2a03:2880:f107:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
2    23.99.128.52 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: waws-prod-dm1-001.cloudapp.net
lightboxapi3.azurewebsites.net
lightboxapi2.azurewebsites.net
5    99.84.8.118 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-99-84-8-118.lhr62.r.cloudfront.net
cdn-gl.imrworldwide.com
1    3.122.36.177 (Fairfield, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-122-36-177.eu-central-1.compute.amazonaws.com
www.summerhamster.com
2    2a00:1450:4001:820::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
imasdk.googleapis.com
fonts.googleapis.com
22    151.101.2.2 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
cdn.taboola.com
trc.taboola.com
images.taboola.com
50    2.18.235.40 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
cbsdfp5832910442.s.moatpixel.com
px.moatads.com
8    104.111.230.142 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com
ads.rubiconproject.com
eus.rubiconproject.com
4    213.19.162.61 (United Kingdom)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
optimized-by.rubiconproject.com
4    151.101.1.181 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
widget.perfectmarket.com
4    35.177.197.190 (London, United Kingdom)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-177-197-190.eu-west-2.compute.amazonaws.com
geo.moatads.com
19    2a00:1450:4001:814::2002 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
pagead2.googlesyndication.com
4    213.19.162.57 (United Kingdom)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)
beacon-eu-ams3.rubiconproject.com
1    2606:4700::6810:5514 (United States)

ASN- ()
cdn.jsdelivr.net
1    2a00:1450:4001:825::2003 (Ireland)

ASN- ()
fonts.gstatic.com
2    2a00:1450:4001:816::200e (Ireland)

ASN- ()
www.google-analytics.com
4    34.199.66.75 (Ashburn, United States)

ASN- ()
PTR: ec2-34-199-66-75.compute-1.amazonaws.com
inqlnfvog763mmf771rou737u.litix.io
5    2.16.186.10 (European Union)

ASN- ()
PTR: a2-16-186-10.deploy.static.akamaitechnologies.com
cbsadsales-a.akamaihd.net
techrepublicmedia.akamaized.net
1    2607:f8b0:4002:c0c::5e (United States)

ASN- ()
csi.gstatic.com
5    54.145.115.34 (Ashburn, United States)

ASN- ()
PTR: ec2-54-145-115-34.compute-1.amazonaws.com
cbsinteractive.hb.omtrdc.net
2    63.140.43.34 (Lehi, United States)

ASN- ()
PTR: cbsi.com.ssl.d2.sc.omtrdc.net
som.cbsi.com
2    54.165.7.225 (Ashburn, United States)

ASN- ()
PTR: ec2-54-165-7-225.compute-1.amazonaws.com
cbsinteractive.hb.omtrdc.net
1    143.204.214.109 (Wilmington, United States)

ASN- ()
PTR: server-143-204-214-109.fra53.r.cloudfront.net
platform-cdn.sharethrough.com
1    18.185.208.109 (Cambridge, United States)

ASN- ()
PTR: ec2-18-185-208-109.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
2    34.233.1.251 (Ashburn, United States)

ASN- ()
PTR: ec2-34-233-1-251.compute-1.amazonaws.com
b.sharethrough.com
1    143.204.214.86 (Wilmington, United States)

ASN- ()
PTR: server-143-204-214-86.fra53.r.cloudfront.net
static.sharethrough.com
1    2a04:4e42::720 (European Union)

ASN- ()
str-assets.imgix.net
2    52.72.207.232 (Ashburn, United States)

ASN- ()
PTR: ec2-52-72-207-232.compute-1.amazonaws.com
b.sharethrough.com
1    64.30.228.207 (Fort Lauderdale, United States)

ASN- ()
creatives.techrepublic.com
Apex Domain
Subdomains		 Transfer
74 cbsistatic.com
zdnet4.cbsistatic.com
zdnet3.cbsistatic.com
zdnet2.cbsistatic.com
zdnet1.cbsistatic.com
967 KB
35 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
842 KB
28 doubleclick.net
ad.doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
googleads.g.doubleclick.net
196 KB
22 taboola.com
cdn.taboola.com
trc.taboola.com
images.taboola.com
291 KB
21 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
691 KB
19 moatpixel.com
cbsdfp5832910442.s.moatpixel.com
8 KB
19 googletagservices.com
www.googletagservices.com
357 KB
16 rubiconproject.com
ads.rubiconproject.com
optimized-by.rubiconproject.com
beacon-eu-ams3.rubiconproject.com
eus.rubiconproject.com
37 KB
14 scorecardresearch.com
sb.scorecardresearch.com
12 KB
14 tiqcdn.com
tags.tiqcdn.com
91 KB
12 cbsi.com
dw.cbsi.com
saa.cbsi.com
rev.cbsi.com
som.cbsi.com
16 KB
11 viglink.com
cdn.viglink.com
api.viglink.com
85 KB
9 ml314.com
ml314.com
in.ml314.com
16 KB
9 sharethrough.com
native.sharethrough.com
platform-cdn.sharethrough.com
btlr.sharethrough.com
b.sharethrough.com
static.sharethrough.com
121 KB
9 zdnet.com
www.zdnet.com
144 KB
8 imrworldwide.com
secure-us.imrworldwide.com
cdn-gl.imrworldwide.com
59 KB
8 lightboxcdn.com
www.lightboxcdn.com
178 KB
7 omtrdc.net
cbsinteractive.hb.omtrdc.net
2 KB
7 demdex.net
dpm.demdex.net
cbsi.demdex.net
6 KB
7 google.com
adservice.google.com
www.google.com
2 KB
7 google.de
adservice.google.de
www.google.de
2 KB
7 evidon.com
c.evidon.com
79 KB
6 everesttech.net
pixel.everesttech.net
cm.everesttech.net
3 KB
5 adnxs.com
secure.adnxs.com
3 KB
5 cbsinteractive.com
vidtech.cbsinteractive.com
299 KB
4 akamaized.net
techrepublicmedia.akamaized.net
4 MB
4 litix.io
inqlnfvog763mmf771rou737u.litix.io
1 KB
4 perfectmarket.com
widget.perfectmarket.com
94 KB
4 akstat.io
0211c814.akstat.io
5f651e6f.akstat.io
1 KB
4 go-mpulse.net
c.go-mpulse.net
58 KB
3 eyeota.net
ps.eyeota.net
875 B
3 tru.am
tru.am
beacon.tru.am
14 KB
3 everestjs.net
www.everestjs.net
6 KB
3 betrad.com
l.betrad.com
360 B
2 google-analytics.com
www.google-analytics.com
18 KB
2 gstatic.com
fonts.gstatic.com
csi.gstatic.com
13 KB
2 googleapis.com
imasdk.googleapis.com
fonts.googleapis.com
599 B
2 azurewebsites.net
lightboxapi3.azurewebsites.net
lightboxapi2.azurewebsites.net
831 B
2 facebook.com
www.facebook.com
296 B
2 disqus.com
zdnet-1.disqus.com
2 KB
2 2mdn.net
s0.2mdn.net
93 KB
2 facebook.net
connect.facebook.net
61 KB
2 casalemedia.com
as-sec.casalemedia.com
1 KB
2 crwdcntrl.net
sync.crwdcntrl.net
1 KB
2 mathtag.com
pixel.mathtag.com
1 KB
2 rlcdn.com
idsync.rlcdn.com
850 B
2 agkn.com
js.agkn.com
d.agkn.com
3 KB
2 akamaihd.net
iicbsi-a.akamaihd.net
cbsadsales-a.akamaihd.net
435 KB
1 techrepublic.com
creatives.techrepublic.com
10 KB
1 imgix.net
str-assets.imgix.net
9 KB
1 jsdelivr.net
cdn.jsdelivr.net
2 KB
1 summerhamster.com
www.summerhamster.com
181 B
1 yieldmanager.com
ad.yieldmanager.com
341 B
1 googleadservices.com
www.googleadservices.com
562 B
1 urbanairship.com
web-sdk.urbanairship.com
17 KB
1 qualtrics.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
13 KB
1 bluekai.com
tags.bluekai.com
341 B
1 adsrvr.org
match.adsrvr.org
524 B
1 indexww.com
js-sec.indexww.com
26 KB
1 t.co
t.co
556 B
438 60
Domain Requested by
23 zdnet4.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
21 zdnet2.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
z.moatads.com
19 cbsdfp5832910442.s.moatpixel.com
19 pagead2.googlesyndication.com optimized-by.rubiconproject.com
pagead2.googlesyndication.com
www.zdnet.com
19 www.googletagservices.com www.zdnet.com
t.co
securepubads.g.doubleclick.net
rev.cbsi.com
pagead2.googlesyndication.com
18 px.moatads.com
18 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.zdnet.com
17 zdnet3.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
z.moatads.com
14 sb.scorecardresearch.com 5 redirects tags.tiqcdn.com
cdn.taboola.com
widget.perfectmarket.com
14 tags.tiqcdn.com zdnet2.cbsistatic.com
tags.tiqcdn.com
13 z.moatads.com securepubads.g.doubleclick.net
vidtech.cbsinteractive.com
native.sharethrough.com
13 zdnet1.cbsistatic.com www.zdnet.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
12 images.taboola.com
9 www.zdnet.com t.co
zdnet3.cbsistatic.com
vidtech.cbsinteractive.com
8 ml314.com 2 redirects tags.tiqcdn.com
ml314.com
www.zdnet.com
8 www.lightboxcdn.com www.zdnet.com
www.lightboxcdn.com
7 cbsinteractive.hb.omtrdc.net vidtech.cbsinteractive.com
7 c.evidon.com www.zdnet.com
c.evidon.com
6 trc.taboola.com cdn.taboola.com
6 googleads.g.doubleclick.net 1 redirects pagead2.googlesyndication.com
6 api.viglink.com cdn.viglink.com
6 adservice.google.com www.googletagservices.com
pagead2.googlesyndication.com
6 adservice.google.de www.googletagservices.com
pagead2.googlesyndication.com
5 cdn-gl.imrworldwide.com vidtech.cbsinteractive.com
cdn-gl.imrworldwide.com
5 secure.adnxs.com js-sec.indexww.com
5 dpm.demdex.net 1 redirects www.zdnet.com
tags.tiqcdn.com
vidtech.cbsinteractive.com
5 dw.cbsi.com tags.tiqcdn.com
www.zdnet.com
5 cdn.viglink.com tags.tiqcdn.com
www.zdnet.com
5 vidtech.cbsinteractive.com zdnet2.cbsistatic.com
vidtech.cbsinteractive.com
4 techrepublicmedia.akamaized.net vidtech.cbsinteractive.com
4 b.sharethrough.com
4 inqlnfvog763mmf771rou737u.litix.io vidtech.cbsinteractive.com
4 eus.rubiconproject.com www.zdnet.com
4 beacon-eu-ams3.rubiconproject.com www.zdnet.com
4 geo.moatads.com z.moatads.com
4 widget.perfectmarket.com cdn.taboola.com
widget.perfectmarket.com
4 optimized-by.rubiconproject.com ads.rubiconproject.com
4 ads.rubiconproject.com t.co
4 cdn.taboola.com zdnet2.cbsistatic.com
cdn.taboola.com
4 pixel.everesttech.net 1 redirects
4 saa.cbsi.com tags.tiqcdn.com
4 c.go-mpulse.net www.zdnet.com
zdnet1.cbsistatic.com
c.go-mpulse.net
3 secure-us.imrworldwide.com 1 redirects
3 ps.eyeota.net 2 redirects www.zdnet.com
3 www.everestjs.net tags.tiqcdn.com
www.everestjs.net
3 ad.doubleclick.net 1 redirects www.zdnet.com
3 l.betrad.com www.zdnet.com
2 som.cbsi.com
2 5f651e6f.akstat.io zdnet1.cbsistatic.com
2 www.google-analytics.com widget.perfectmarket.com
2 www.facebook.com connect.facebook.net
2 zdnet-1.disqus.com zdnet2.cbsistatic.com
zdnet-1.disqus.com
2 cm.everesttech.net 2 redirects
2 s0.2mdn.net zdnet2.cbsistatic.com
s0.2mdn.net
2 tpc.googlesyndication.com securepubads.g.doubleclick.net
2 connect.facebook.net tags.tiqcdn.com
connect.facebook.net
2 as-sec.casalemedia.com js-sec.indexww.com
2 cbsi.demdex.net tags.tiqcdn.com
2 0211c814.akstat.io zdnet1.cbsistatic.com
c.go-mpulse.net
2 sync.crwdcntrl.net 2 redirects
2 pixel.mathtag.com 2 redirects
2 idsync.rlcdn.com 2 redirects
2 tru.am tags.tiqcdn.com
tru.am
2 native.sharethrough.com www.zdnet.com
t.co
1 creatives.techrepublic.com
1 str-assets.imgix.net native.sharethrough.com
1 static.sharethrough.com native.sharethrough.com
1 btlr.sharethrough.com native.sharethrough.com
1 platform-cdn.sharethrough.com native.sharethrough.com
1 csi.gstatic.com s0.2mdn.net
1 cbsadsales-a.akamaihd.net
1 lightboxapi2.azurewebsites.net
1 fonts.gstatic.com securepubads.g.doubleclick.net
1 cdn.jsdelivr.net www.lightboxcdn.com
1 fonts.googleapis.com www.lightboxcdn.com
1 rev.cbsi.com t.co
1 imasdk.googleapis.com s0.2mdn.net
1 www.summerhamster.com
1 lightboxapi3.azurewebsites.net www.lightboxcdn.com
1 ad.yieldmanager.com
1 www.google.de
1 www.google.com 1 redirects
1 www.googleadservices.com 1 redirects
1 cm.g.doubleclick.net 1 redirects
1 web-sdk.urbanairship.com zdnet3.cbsistatic.com
1 zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com tags.tiqcdn.com
1 tags.bluekai.com 1 redirects
1 beacon.tru.am tru.am
1 in.ml314.com ml314.com
1 d.agkn.com js.agkn.com
1 js.agkn.com tags.tiqcdn.com
1 iicbsi-a.akamaihd.net tags.tiqcdn.com
1 match.adsrvr.org js-sec.indexww.com
1 js-sec.indexww.com www.zdnet.com
1 t.co
438 95
Subject Issuer Validity Valid
t.co
DigiCert SHA2 High Assurance Server CA		 2019-03-07 -
2020-03-07		 a year crt.sh
www.cbs.com
GeoTrust RSA CA 2018		 2018-11-26 -
2019-06-22		 7 months crt.sh
cc.cnetcontent.com
DigiCert SHA2 Secure Server CA		 2019-01-25 -
2020-01-25		 a year crt.sh
*.evidon.com
DigiCert ECC Secure Server CA		 2019-02-01 -
2020-05-02		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2019-01-09 -
2020-03-09		 a year crt.sh
akstat.io
DigiCert ECC Secure Server CA		 2018-03-12 -
2019-05-11		 a year crt.sh
*.g.doubleclick.net
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.sharethrough.com
Go Daddy Secure Certificate Authority - G2		 2018-09-18 -
2019-11-17		 a year crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2		 2017-04-25 -
2019-06-24		 2 years crt.sh
*.doubleclick.net
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.google.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1		 2017-02-15 -
2019-04-19		 2 years crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA		 2018-12-30 -
2020-03-30		 a year crt.sh
vidtech.cbsinteractive.com
DigiCert SHA2 High Assurance Server CA		 2018-12-13 -
2020-12-17		 2 years crt.sh
a248.e.akamai.net
DigiCert ECC Secure Server CA		 2018-10-18 -
2019-10-18		 a year crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-03-02 -
2019-09-08		 6 months crt.sh
ssl516460.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-03-16 -
2019-09-22		 6 months crt.sh
*.ml314.com
Amazon		 2019-03-16 -
2020-04-16		 a year crt.sh
www.everestjs.net
DigiCert SHA2 Secure Server CA		 2018-10-15 -
2020-10-15		 2 years crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2018-06-21 -
2020-09-16		 2 years crt.sh
*.cbsi.com
DigiCert SHA2 High Assurance Server CA		 2017-11-07 -
2021-02-04		 3 years crt.sh
ssl389962.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-01-10 -
2019-07-19		 6 months crt.sh
www.eyeota.com
COMODO RSA Domain Validation Secure Server CA		 2018-02-12 -
2021-02-11		 3 years crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA		 2018-01-09 -
2021-02-12		 3 years crt.sh
viglink.com
Amazon		 2019-02-09 -
2020-03-09		 a year crt.sh
saa.cbsi.com
DigiCert SHA2 High Assurance Server CA		 2018-05-19 -
2019-08-22		 a year crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA		 2019-01-23 -
2021-03-08		 2 years crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA		 2018-11-28 -
2019-12-26		 a year crt.sh
*.qualtrics.com
DigiCert SHA2 Secure Server CA		 2018-10-08 -
2021-01-06		 2 years crt.sh
*.imrworldwide.com
DigiCert SHA2 Secure Server CA		 2018-02-15 -
2019-07-11		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2019-01-21 -
2019-04-21		 3 months crt.sh
tpc.googlesyndication.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.urbanairship.com
DigiCert SHA2 Secure Server CA		 2018-04-17 -
2019-07-17		 a year crt.sh
*.everesttech.net
DigiCert SHA2 Secure Server CA		 2017-04-13 -
2020-04-17		 3 years crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA		 2018-03-28 -
2020-04-27		 2 years crt.sh
www.google.de
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.ads.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2019-01-03 -
2019-07-02		 6 months crt.sh
*.azurewebsites.net
Microsoft IT TLS CA 4		 2017-12-17 -
2019-12-17		 2 years crt.sh
*.summerhamster.com
Let's Encrypt Authority X3		 2019-02-27 -
2019-05-28		 3 months crt.sh
*.googleapis.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-02-28 -
2019-09-07		 6 months crt.sh
moatads.com
DigiCert ECC Secure Server CA		 2018-11-10 -
2020-02-09		 a year crt.sh
*.rubiconproject.com
DigiCert SHA2 Secure Server CA		 2019-02-13 -
2021-02-17		 2 years crt.sh
p.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-02-22 -
2021-02-22		 2 years crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA		 2018-04-27 -
2019-04-27		 a year crt.sh
ssl363648.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-10-27 -
2019-05-05		 6 months crt.sh
*.google-analytics.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
*.litix.io
Amazon		 2019-01-22 -
2020-02-22		 a year crt.sh
*.hb.omtrdc.net
DigiCert SHA2 Secure Server CA		 2017-12-22 -
2020-01-03		 2 years crt.sh
som.cbsi.com
DigiCert SHA2 High Assurance Server CA		 2018-08-06 -
2019-11-13		 a year crt.sh
imgix.map.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-09-27 -
2019-09-22		 a year crt.sh
*.techrepublic.com
DigiCert SHA2 High Assurance Server CA		 2019-03-05 -
2021-06-07		 2 years crt.sh

This page contains 38 frames:

Primary Page: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Frame ID: F196719389D4BD58C1067E27AB843A7A
Requests: 321 HTTP requests in this frame

Frame: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Frame ID: EB90680C9FAFF28EC1CAFAF63F13DA2C
Requests: 2 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1553044285877&lv=1
Frame ID: 661062001F2358BC682518855C16D7CE
Requests: 2 HTTP requests in this frame

Frame: https://d.agkn.com/iframe/8613/?che=370511224&gdpr=&gdpr_consent=&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&bpid=cbsinteractive&c=%7B%22bpid%22%3A%22cbsinteractive%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22https%3A%2F%2Ft.co%2F00ebQBQ0nK%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Frame ID: CB3BC30379D0AB48CD0484C7A11990D5
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=636885417983100100
Frame ID: AA683118AE34F7FD2BEB103ECC786768
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Frame ID: 5658EF333C5D75A41A15978ECF53F112
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: 9CA8189AAB4D4562EC00DFC2BFE6AEAE
Requests: 1 HTTP requests in this frame

Frame: https://cbsi.demdex.net/dest5.html?d_nsid=0
Frame ID: 7425A6E64E1DB5025420828AE3C4EF4F
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.287.0_en.html
Frame ID: AF4D54A5397DCAA78381B82A72147E78
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: 2C4934B98223B984AB553FA8C9ACEF61
Requests: 4 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: 91913A6A90E138469F8B44146CD48AFE
Requests: 14 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: 3D336200A83EE7366ADD62720B3FA72E
Requests: 14 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: C306DE44C196E4388E37FFBCCACC7FAD
Requests: 13 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: 495502D104131AA552FEA76AC092E1E1
Requests: 4 HTTP requests in this frame

Frame: https://ads.rubiconproject.com/ad/9818.js
Frame ID: 282D2776351BDF6FC445FBDD5B211EE8
Requests: 13 HTTP requests in this frame

Frame: https://rev.cbsi.com/common/js/adKit.min.js?1700670664
Frame ID: FD91D93265595204D6C3D6532824C1ED
Requests: 13 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: F0B1A7366ABD60910228283F7E79BCE9
Requests: 1 HTTP requests in this frame

Frame: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=636885417983100100
Frame ID: 8B1D90CC5A48A9C0416337140B7DD11B
Requests: 3 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: CA03957CC7F8B452C12454CD056C94F6
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Frame ID: 5751D140E70D1C5A667CDED4946A0865
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190313/r20190131/zrt_lookup.html
Frame ID: F06E5E5A2F587C6D0166D6385564FD50
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: DECE4AEC88A25C64AACA8CFD6A03E3EE
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Frame ID: E6CE19F22F56BB076E15EE5FD2B49B22
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 7C27F26F3DDD26E7D7CD532E2046858E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Frame ID: 0F3DB29C92F8AAF30491B572E0C3CC2E
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 11AB9CC2787738634BBBEE980618770E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Frame ID: 9A57CF4249D8FA3B3F7A670600876F72
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Frame ID: 46D696A37889769C65AA040FDD8B2AB9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151321&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288638&bpp=56&bdt=769&fdt=1093&idt=1090&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=2&ga_vid=432472175.1553044290&ga_sid=1553044290&ga_hid=418746276&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1465&biw=1585&bih=1200&isw=300&ish=250&ifk=2401019456&scr_x=0&scr_y=0&eid=21060853%2C21061796&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=3832671437&ifi=1&uci=1.nzxmt4mejbj&fsb=1&dtd=1130
Frame ID: 537A6168300B1343CAC4B65BFFCDD7BA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=3772584338&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288702&bpp=37&bdt=863&fdt=1087&idt=1086&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=1&ga_vid=100367113.1553044290&ga_sid=1553044290&ga_hid=1296761769&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=1766732152&scr_x=0&scr_y=0&eid=21060853%2C410075102&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=4066913089&ifi=1&uci=1.j57g26fghydl&fsb=1&dtd=1098
Frame ID: 03BBC9F8B25A591958D4516036530DD1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151320&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288742&bpp=17&bdt=881&fdt=1083&idt=1082&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&rume=1&frm=23&ife=5&pv=1&ga_vid=1970858110.1553044290&ga_sid=1553044290&ga_hid=52532568&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=2537108585&scr_x=0&scr_y=0&eid=21060549%2C21060853&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=3832671437&ifi=1&uci=1.3geg2q2mbwuw&fsb=1&dtd=1095
Frame ID: 7AE92FCB490BB0E3F05BCAD8287D373A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151327&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288763&bpp=22&bdt=868&fdt=1111&idt=1110&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=1&ga_vid=664999439.1553044290&ga_sid=1553044290&ga_hid=1895982299&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=4294&biw=1585&bih=1200&isw=728&ish=90&ifk=3834625986&scr_x=0&scr_y=0&eid=21060853&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CopeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=4066913089&ifi=1&uci=1.dzti3j4786wv&fsb=1&dtd=1118
Frame ID: 3F8EEAECC9C9BD0DB7884CB64E41EC6A
Requests: 1 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Frame ID: 530109D9DE2971195AF65D29075B3772
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: 593CEDB37F72180E3C69AF4939EFD36A
Requests: 3 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: EFEFE63BEA83ABC070C2C84F36976401
Requests: 3 HTTP requests in this frame

Frame: https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Frame ID: 69A69D15CE535C332A2537068C576E0C
Requests: 1 HTTP requests in this frame

Frame: https://native.sharethrough.com/assets/sfp-set-targeting.js
Frame ID: CC360530B00F793E488BA5A8AE29A932
Requests: 6 HTTP requests in this frame

Frame: https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Frame ID: 249FF4389E5AD1045F8F10570705A99D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://t.co/00ebQBQ0nK Page URL
  2. https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • env /^requirejs$/i
Overall confidence: 100%
Detected patterns
  • env /pbjs/i
Overall confidence: 100%
Detected patterns
  • env /^DISQUS/i
Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /2mdn\.net/i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • env /^googletag$/i
Overall confidence: 100%
Detected patterns
  • env /^Modernizr$/i
Overall confidence: 100%
Detected patterns
  • env /^optimizely$/i
Overall confidence: 100%
Detected patterns
  • env /^SWFObject$/i
Overall confidence: 100%
Detected patterns
  • env /^s_(?:account|objectID|code|INST)$/i
Overall confidence: 100%
Detected patterns
  • html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
  • env /^_?COMSCORE$/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

438
Requests

97 %
HTTPS

29 %
IPv6

60
Domains

95
Subdomains

76
IPs

5
Countries

8999 kB
Transfer

20248 kB
Size

29
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/00ebQBQ0nK Page URL
  2. https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 91
  • https://tags.bluekai.com/site/20486?limit=0&id=5978151465408062634&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151465408062634%26eid=50056 HTTP 302
  • https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=5978151465408062634&eid=50056
Request Chain 92
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151465408062634 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ2NTQwODA2MjYzNBAAGg0IvqbG5AUSBQjoBxAAQgBKAA HTTP 307
  • https://ml314.com/csync.ashx?fp=86ac49fec9c729921855c7beddf323f9819f0876004e1587d0973c4b951f44a1f4cb09cee1a4f8eb&person_id=5978151465408062634&eid=50082
Request Chain 93
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151465408062634%26eid=50220 HTTP 302
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151465408062634%26eid=50220&mm_bnc&mm_bct HTTP 302
  • https://ml314.com/csync.ashx?fp=742d5c91-917f-4800-a7f7-b6cf3c44aad9&person_id=5978151465408062634&eid=50220
Request Chain 94
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151465408062634 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151465408062634 HTTP 302
  • https://ml314.com/csync.ashx?fp=39ec8f68f2a60841928fadeb3e4b717a&eid=50146&person_id=5978151465408062634
Request Chain 95
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2qY1T5nE4-VmyeLV9iq0uMFxX_Lo3yc8bl3QcQLegCJQ&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP 302
  • https://ml314.com/csync.ashx?fp=2qY1T5nE4-VmyeLV9iq0uMFxX_Lo3yc8bl3QcQLegCJQ&person_id=5978151465408062634&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Request Chain 96
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151465408062634&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151465408062634&redir=
Request Chain 121
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 134
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1553044287088&ns_c=UTF-8&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1553044287088&ns_c=UTF-8&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Request Chain 136
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp=https%3A//t.co/00ebQBQ0nK&ts=compact&rnd=1553044287092 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp=https%3A//t.co/00ebQBQ0nK&ts=compact&rnd=1553044287092&ja=1
Request Chain 160
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WEpHVFB3QUFCYnNLUVh5ZA HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEPyOhBmVrldGBnOd0plA_GE&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 162
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=P5ORXIfGHpWq3gPLxaHICA&random=1979428470&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1979428470&crd=&cdct=2&is_vtc=1&random=3360767035 HTTP 302
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1979428470&crd=&cdct=2&is_vtc=1&random=3360767035&ipr=y
Request Chain 345
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=5000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1553044291827&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=4082&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=5000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1553044291827&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=4082&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Request Chain 354
  • https://ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/B22286505.241190948;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_directed_treatment= HTTP 302
  • https://ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/B22286505.241190948;dc_pre=CNum5erEj-ECFQe9dwodJH4EzQ;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=
Request Chain 394
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=4842&ns_st_ipt=4842&ns_st_et=4842&ns_st_det=4842&ns_st_upc=4842&ns_st_dupc=4842&ns_st_iupc=4842&ns_st_upa=4842&ns_st_dupa=4842&ns_st_iupa=4842&ns_st_lpc=4842&ns_st_dlpc=4842&ns_st_lpa=4842&ns_st_dlpa=4842&ns_st_pa=4842&ns_ts=1553044296669&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=4842&ns_st_ipt=4842&ns_st_et=4842&ns_st_det=4842&ns_st_upc=4842&ns_st_dupc=4842&ns_st_iupc=4842&ns_st_upa=4842&ns_st_dupa=4842&ns_st_iupa=4842&ns_st_lpc=4842&ns_st_dlpc=4842&ns_st_lpa=4842&ns_st_dlpa=4842&ns_st_pa=4842&ns_ts=1553044296669&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Request Chain 430
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=end&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=6509&ns_st_det=1667&ns_st_upc=4842&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=4842&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=4842&ns_st_dlpc=0&ns_st_lpa=4842&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298336&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=end&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=6509&ns_st_det=1667&ns_st_upc=4842&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=4842&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=4842&ns_st_dlpc=0&ns_st_lpa=4842&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298336&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Request Chain 431
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=2&ns_st_ev=play&ns_st_po=0&ns_st_cl=66000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=8495b1b0-20aa-4299-8f52-f480538e9d83&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298337&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C2_8_3&c4=3000074&c6=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK HTTP 302
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=2&ns_st_ev=play&ns_st_po=0&ns_st_cl=66000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=8495b1b0-20aa-4299-8f52-f480538e9d83&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298337&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C2_8_3&c4=3000074&c6=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK

438 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
00ebQBQ0nK
t.co/ 		448 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.133 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),
Reverse DNS
Software
tsa_o /
Resource Hash
5702f1ec93a14aa36a5120d29618fec7f8e49a4cb52c742c177d4ce318e11583
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 1; mode=block; report=https://twitter.com/i/xss_report

Request headers

:method
GET
:authority
t.co
:scheme
https
:path
/00ebQBQ0nK
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
cache-control
private,max-age=300
content-encoding
gzip
content-length
228
content-type
text/html; charset=utf-8
date
Wed, 20 Mar 2019 01:11:22 GMT
expires
Wed, 20 Mar 2019 01:16:22 GMT
server
tsa_o
set-cookie
muc=2fb15dcd-c309-4031-9eb6-ebcca80deb79; Max-Age=63072000; Expires=Fri, 19 Mar 2021 01:11:22 GMT; Domain=t.co
strict-transport-security
max-age=0
vary
Origin
x-connection-hash
de8ba4d10e15aea10a5accd652a0c606
x-response-time
126
x-xss-protection
1; mode=block; report=https://twitter.com/i/xss_report
Primary Request /
www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/ 		450 KB
98 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
592a90fbaae1f84e757b6585999e04f1d2c39cc7568285aac75f7e42e1e734c3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.zdnet.com
:scheme
https
:path
/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://t.co/00ebQBQ0nK
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://t.co/00ebQBQ0nK

Response headers

status
200
server
nginx
content-type
text/html; charset=UTF-8
set-cookie
fly_device=desktop; expires=Wed, 27-Mar-2019 01:11:23 GMT; path=/; domain=.zdnet.com; secure nemo_highlander=ad_stack%3a1%3acontrol; expires=Mon, 25 Mar 2019 06:59:59 GMT; path=/; domain=.zdnet.com; secure; fly_default_edition=eu; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Wed, 27-Mar-2019 01:11:23 GMT; path=/; domain=.zdnet.com; secure
x-enable-esi
true
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding, User-Agent
access-control-allow-origin
https://www.zdnet.com
x-frame-options
SAMEORIGIN
content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
expires
Wed, 20 Mar 2019 02:41:23 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
referrer-policy
no-referrer-when-downgrade
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-tx-id
fd0fe3c1-1f11-4eb1-9887-ea37afff85d0
content-encoding
gzip
date
Wed, 20 Mar 2019 01:11:24 GMT
main-4a2e80177e-rev.css
zdnet4.cbsistatic.com/fly/1660-fly/css/core/ 		320 KB
59 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
28e2960b8daa25db02de7244e062aa66f9134462ca6b62975a01667e42fb08ba

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:27:54 GMT
server
nginx
etag
W/"5c9134aa-4ff15"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
59674
expires
Wed, 27 Mar 2019 01:11:24 GMT
controls-9423ff3b54-rev.css
zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/ 		41 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-9423ff3b54-rev.css
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f04be93e144932a277b3b79253acc171ea7bbb59460c33d2f4f07dcf684a6b14

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:28:05 GMT
server
nginx
etag
W/"5c9134b5-a561"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
6564
expires
Wed, 27 Mar 2019 01:11:24 GMT
catalin-cimpanu.jpg
zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/ 		910 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/thumbnail/40x40/e9e4d21a35e101b1402c656cf979114c/catalin-cimpanu.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"c3829e4116c9d009ce51c32b304b9e46"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=14433661, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
868
5b866c7860b221313b22bd8c-1280x7201aug292018114859poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2018/08/29/dba59d79-6a8d-48f2-84e2-9c933fac18f6/thumbnail/570x322/4c30613235ad99ea461628aa9cac03ae/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/08/29/dba59d79-6a8d-48f2-84e2-9c933fac18f6/thumbnail/570x322/4c30613235ad99ea461628aa9cac03ae/5b866c7860b221313b22bd8c-1280x7201aug292018114859poster.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ee9c37795c79a1eed787b12e2c9ed9b327ac01cf0843ef63e916c64eb10ddeec

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Wed, 29 Aug 2018 12:10:01 GMT
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=31134216
timing-allow-origin
*
content-length
19839
expires
Sat, 14 Mar 2020 09:35:00 GMT
advertisement.js
zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/ 		53 B
280 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/bundles/zdnetjs/js/utils/advertisement.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Wed, 20 Jun 2018 16:56:03 GMT
server
nginx
etag
"5b2a8723-35"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
71
expires
Wed, 27 Mar 2019 01:11:24 GMT
cobalt-strike-whitespace.png
zdnet1.cbsistatic.com/hub/i/2019/02/28/8044655a-94a6-4e74-9ec8-eff2cac25d87/f1afff1fa36d890d43e6ea3f4635b4fd/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/2019/02/28/8044655a-94a6-4e74-9ec8-eff2cac25d87/f1afff1fa36d890d43e6ea3f4635b4fd/cobalt-strike-whitespace.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
94821abc572dfe5903d78f557c8cd2ffd5aed758ae2e1598448ea2eefdbef84d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"74c156781ba6ffe18400a88689715dd1"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=31134042, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
36229
00-intro.png
zdnet4.cbsistatic.com/hub/i/r/2018/12/08/c86071f7-6462-4b13-99ed-8dd78e95be26/thumbnail/170x128/ddb8d6c8f1d4d0c6e4d9659c917e1ef5/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/12/08/c86071f7-6462-4b13-99ed-8dd78e95be26/thumbnail/170x128/ddb8d6c8f1d4d0c6e4d9659c917e1ef5/00-intro.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
97cc5d66b92bfefff1a0f96e4f06981d6e1261d9c67da523365b7fabaec6ab77

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"480167897cc43b2fb914238f45d7dbbf"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22844520, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
13543
01-cryptojacking.png
zdnet4.cbsistatic.com/hub/i/r/2018/12/08/67af9a37-d4eb-4128-a911-6f653f19dd82/thumbnail/170x128/8e3ca636eabec000a202ec2f4773d1fb/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/12/08/67af9a37-d4eb-4128-a911-6f653f19dd82/thumbnail/170x128/8e3ca636eabec000a202ec2f4773d1fb/01-cryptojacking.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f882e21c26aa874216d4e620fa3392b012a490404cc065f4e7748699b1a58023

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"793bc52a941b3951dfdb85fb04f9fd06"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845057, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
6186
02-web-skimmers.png
zdnet2.cbsistatic.com/hub/i/r/2018/12/08/9eba696d-509d-4dab-9095-67246c273bf0/thumbnail/170x128/a9f042b812185bb975f7ca53b1d42e7b/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/12/08/9eba696d-509d-4dab-9095-67246c273bf0/thumbnail/170x128/a9f042b812185bb975f7ca53b1d42e7b/02-web-skimmers.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
698d9814ab21541807e6d3364e450ecbd3f45536fbf67c59e36f993cb544ca35

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"335396ce0d3f6e808c26132f91916eae"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845140, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
12452
03-botnets.png
zdnet3.cbsistatic.com/hub/i/r/2018/12/08/2eba0bdc-d8b6-4b41-a8fe-0dd8fa8e2970/thumbnail/170x128/03075564a314074d729b73593a6b8a7c/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/12/08/2eba0bdc-d8b6-4b41-a8fe-0dd8fa8e2970/thumbnail/170x128/03075564a314074d729b73593a6b8a7c/03-botnets.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
da8e47bfc536f94a3d784e8f094a96b41244efe4b42ea8b857cc6169cd55e47c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"cea7785b31f6a028bfa54af07d6f79ce"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845111, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
18108
04-ddos.png
zdnet2.cbsistatic.com/hub/i/r/2018/12/08/bd2289b2-f0cc-4eb4-85c8-d99d170f2061/thumbnail/170x128/f221eb1bb313d2fe6898ee1ef84fcba3/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/12/08/bd2289b2-f0cc-4eb4-85c8-d99d170f2061/thumbnail/170x128/f221eb1bb313d2fe6898ee1ef84fcba3/04-ddos.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7aa91de94b48accc2edb54d589727a31df97a2c8be30f665f44746cc0ee023d8

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"eb698350c502ff82503875dba13f5f88"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845116, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
22663
kaspersky.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/19/a24c7bc2-2208-42b8-9308-6d2f4e3fa87a/thumbnail/170x128/f5689c6fc7771468e55c64b1d84c6842/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/19/a24c7bc2-2208-42b8-9308-6d2f4e3fa87a/thumbnail/170x128/f5689c6fc7771468e55c64b1d84c6842/kaspersky.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e4893cdf68767df27f118085e884a8c9da84230a1412c630d117f4cbec3c9688

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"97785e0500ad16c18574c64189ccf4b4"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31527870, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
5535
securityessentialsbroken.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/19/59b049d1-bfa6-495c-aa17-9a7aea22267b/thumbnail/170x128/118ecfd0586549e9c06e00a2ed646bd9/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/19/59b049d1-bfa6-495c-aa17-9a7aea22267b/thumbnail/170x128/118ecfd0586549e9c06e00a2ed646bd9/securityessentialsbroken.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d1a0a88486d3874e2bff42dda5e558fd62790464ca65ba2acea9e0bca514b3a0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"97e48472142cfdd1cd5d5b5ca6831cf4"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31509273, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
4206
another-hacker-hands-stock-photo.jpg
zdnet2.cbsistatic.com/hub/i/r/2017/11/01/ffb221b0-4832-4342-ba4f-649116c7d2ee/thumbnail/170x128/57ff732a0ca182e797f244db0c2f3b4e/ 		10 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2017/11/01/ffb221b0-4832-4342-ba4f-649116c7d2ee/thumbnail/170x128/57ff732a0ca182e797f244db0c2f3b4e/another-hacker-hands-stock-photo.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
44174c2f84a5b2e11079ee9fbefe39f1d699fdd9bfcea3ae1e84ab2809ca2de9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Wed, 01 Nov 2017 17:03:08 GMT
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=31507714
timing-allow-origin
*
content-length
9175
expires
Wed, 18 Mar 2020 17:19:58 GMT
pdf.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/19/619c176d-6ace-4ee4-a393-117c2bf22106/thumbnail/170x128/2e834983db71ca7203e85ca98f6a2d58/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/19/619c176d-6ace-4ee4-a393-117c2bf22106/thumbnail/170x128/2e834983db71ca7203e85ca98f6a2d58/pdf.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
eeb25e7b51977245f7d5218163af6614ec2211005fe746bee7b8cd4bbcb9fdd8

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"968b15768f3d19770471e9436d97913c"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31507574, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
9555
trello-web-macbook-pro.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/03/19/4dfb4dbe-02f0-483a-8899-258a2d4d0dd5/thumbnail/170x128/342974a7de0e1bd86bb9122ede36edc4/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/03/19/4dfb4dbe-02f0-483a-8899-258a2d4d0dd5/thumbnail/170x128/342974a7de0e1bd86bb9122ede36edc4/trello-web-macbook-pro.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2f00ffcd2cd563cfc9f5942b26ccadb11f5524c628c51cb66a5fe009cda9bce7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"add5aebfcb33a2206b6497d53bc4f309"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31499458, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
5229
hacker.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/02/15/5a30480c-da1b-4119-a87e-fe43bd50821a/thumbnail/170x128/0680a327898f4051644c4b6faea1b7ce/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/02/15/5a30480c-da1b-4119-a87e-fe43bd50821a/thumbnail/170x128/0680a327898f4051644c4b6faea1b7ce/hacker.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d9993f23ac0ad90b8490b44fbb5803222e4c24389137007d970ae6fa371d9426

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"2afc4dfb14e55c6face649a1d0c1025b"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31496706, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
5419
firefoxistock-956152050.jpg
zdnet2.cbsistatic.com/hub/i/r/2018/10/15/7533072d-1a39-49f7-ab2b-6fe39e79b7b3/thumbnail/170x128/b829bd2a43361eca616e376eac6ac41b/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2018/10/15/7533072d-1a39-49f7-ab2b-6fe39e79b7b3/thumbnail/170x128/b829bd2a43361eca616e376eac6ac41b/firefoxistock-956152050.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e7d3f48ce3af3303f77d30969b0e3ef39983c52e2b74fbb7cd23d43cd64fa969

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"696b0709b9a2d7d9e2c25b71476ec255"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31494082, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
9524
screenshot-2019-03-19-at-08-54-13.png
zdnet4.cbsistatic.com/hub/i/r/2019/03/19/195026d7-efba-4f16-ba79-0145378a7951/thumbnail/170x128/f022a56129f15db7466133a95dfc5d28/ 		35 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/03/19/195026d7-efba-4f16-ba79-0145378a7951/thumbnail/170x128/f022a56129f15db7466133a95dfc5d28/screenshot-2019-03-19-at-08-54-13.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b897168b2c33a6b7fa55e5ae1852de95bb9a80cad540ef77b5c2458ca8f2c784

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"98cd4fb257c389111d79b0b97480416d"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=31489417, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
36102
aluminium.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/19/d33de407-7d5f-4c8c-ba92-4b04264647e9/thumbnail/170x128/1c329b617610cf6942e769cd05e413e7/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/19/d33de407-7d5f-4c8c-ba92-4b04264647e9/thumbnail/170x128/1c329b617610cf6942e769cd05e413e7/aluminium.jpg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
343b16db122aec6814fa5d708b0d2640a0e42d1f29ee0d98c796b3ec722c22ed

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"3dde889723e33ace6af907cd5cc8e187"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31489478, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
5231
require-2.1.2.js
zdnet2.cbsistatic.com/fly/1660-fly/js/libs/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:27:49 GMT
server
nginx
etag
W/"5c9134a5-3f09"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
6305
expires
Wed, 27 Mar 2019 01:11:24 GMT
evidon-sitenotice-tag.js
c.evidon.com/sitenotice/ 		40 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e6b7af9cebec6e08f0d84046a51912d2e7dac2070a46d3d4ecf42673432f76ac

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
content-length
10658
last-modified
Wed, 27 Feb 2019 22:45:43 GMT
server
Apache
etag
"499850fce82e70c62601a766978d58e7:1551307544"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400, private;max-age=86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 21 Mar 2019 01:11:25 GMT
country.js
c.evidon.com/geo/ 		260 B
456 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Wed, 30 May 2018 22:23:16 GMT
server
Apache
access-control-allow-origin
*
etag
"c1e367d098d326049811561575dbda4a:1527718996"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
status
200
access-control-max-age
86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
content-length
165
snthemes.js
c.evidon.com/sitenotice/425/ 		79 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/425/snthemes.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
f05f427c0a3425f17ce1b199296557b22f8b385c963696f80d588f692364abca

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
content-length
3992
last-modified
Sun, 18 Nov 2018 21:52:50 GMT
server
Apache
etag
"f23a8c8a532eb957f9790e1985bb8e9c:1542577970"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400, private;max-age=86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 21 Mar 2019 01:11:25 GMT
settings.js
c.evidon.com/sitenotice/425/zdnet/ 		15 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/425/zdnet/settings.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1b91058b5969c2319ee3f3efb2b91ccf388c64fe22f806e59b0edb43694150d4

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
content-length
1239
last-modified
Tue, 28 Aug 2018 21:08:55 GMT
server
Apache
etag
"09891370db88cdd3a58c49f5cd396b85:1535490535"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400, private;max-age=86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 21 Mar 2019 01:11:25 GMT
truncated
/ 		917 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41

Request headers

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c

Request headers

Response headers

Content-Type
image/jpeg
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108

Request headers

Response headers

Content-Type
image/jpeg
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9

Request headers

Response headers

Content-Type
image/jpeg
mag-white01.png
zdnet1.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/core/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/core/mag-white01.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:24 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
etag
W/"5c91341f-4f1"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
936
expires
Wed, 27 Mar 2019 01:11:24 GMT
Raleway-Bold.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 		51 KB
51 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Bold.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
last-modified
Tue, 26 Feb 2019 17:11:40 GMT
server
nginx
access-control-allow-origin
*
etag
"5c75734c-cbf4"
content-type
application/octet-stream
status
200
cache-control
max-age=29776533
accept-ranges
bytes
timing-allow-origin
*
content-length
52212
expires
Thu, 27 Feb 2020 16:26:58 GMT
Raleway-Regular.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 		50 KB
51 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Regular.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
last-modified
Tue, 26 Feb 2019 17:11:40 GMT
server
nginx
access-control-allow-origin
*
etag
"5c75734c-c974"
content-type
application/octet-stream
status
200
cache-control
max-age=29776483
accept-ranges
bytes
timing-allow-origin
*
content-length
51572
expires
Thu, 27 Feb 2020 16:26:08 GMT
Raleway-ExtraLight.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 		50 KB
50 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-ExtraLight.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c2c432e808e795014171d087ba8abd58d8337f59ad387c08d8a6c6b3c32106fb

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
last-modified
Tue, 26 Feb 2019 17:11:40 GMT
server
nginx
access-control-allow-origin
*
etag
"5c75734c-c634"
content-type
application/octet-stream
status
200
cache-control
max-age=29776533
accept-ranges
bytes
timing-allow-origin
*
content-length
50740
expires
Thu, 27 Feb 2020 16:26:58 GMT
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Response headers

Content-Type
image/gif
play.svg
zdnet2.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/video/ 		299 B
423 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/video/play.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d5e9dfd6066c2872be4f85c25aa0186402b124ea3f80152e2e2b767906793284

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-9423ff3b54-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
access-control-allow-origin
*
etag
"5c91341f-12b"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=31512115
accept-ranges
bytes
timing-allow-origin
*
content-length
213
expires
Wed, 18 Mar 2020 18:33:20 GMT
ring-animated.svg
zdnet3.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/video/ 		704 B
575 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/video/ring-animated.svg
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-9423ff3b54-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
access-control-allow-origin
*
etag
"5c91341f-2c0"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
max-age=31511983
accept-ranges
bytes
timing-allow-origin
*
content-length
364
expires
Wed, 18 Mar 2020 18:31:08 GMT
logo.png
zdnet4.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/core/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/core/logo.png
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
etag
W/"5c91341f-1009"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
4128
expires
Wed, 27 Mar 2019 01:11:25 GMT
Raleway-Light.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 		50 KB
51 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Light.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
last-modified
Tue, 26 Feb 2019 17:11:40 GMT
server
nginx
access-control-allow-origin
*
etag
"5c75734c-c998"
content-type
application/octet-stream
status
200
cache-control
max-age=29776441
accept-ranges
bytes
timing-allow-origin
*
content-length
51608
expires
Thu, 27 Feb 2020 16:25:26 GMT
Raleway-Black.woff2
zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/ 		50 KB
51 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/bundles/zdnetcss/fonts/raleway/Raleway-Black.woff2
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
927048ad11de8981ab14882b0cac610a1c194aa991d07247cdbf875032dec422

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
last-modified
Tue, 26 Feb 2019 17:11:40 GMT
server
nginx
access-control-allow-origin
*
etag
"5c75734c-c8ec"
content-type
application/octet-stream
status
200
cache-control
max-age=29776574
accept-ranges
bytes
timing-allow-origin
*
content-length
51436
expires
Thu, 27 Feb 2020 16:27:39 GMT
main.default.js
zdnet3.cbsistatic.com/fly/1660-fly/js/ 		145 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
56b1ab920150e9ebc47c4e6ec87c70c05af7a50edb4a9fccfc52fd3a261f7b90

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:27:52 GMT
server
nginx
etag
W/"5c9134a8-24210"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
51714
expires
Wed, 27 Mar 2019 01:11:25 GMT
en.js
c.evidon.com/sitenotice/425/translations/ 		217 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/425/translations/en.js
Requested by
Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8238f5f25e0f6c79352684181f41e1f8fb226fbbeefe07cb21aa9c074b5141b2

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
content-length
7080
last-modified
Sun, 18 Nov 2018 21:51:12 GMT
server
Apache
etag
"b62d382931b2460857acce0af48570f2:1542577872"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400, private;max-age=86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 21 Mar 2019 01:11:25 GMT
vendorlist.js
c.evidon.com/sitenotice/ 		126 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/vendorlist.js
Requested by
Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cd1d44243c825f1c5b6fece79fb2f3605907af8e9948469e3be7fe265a74e6dc

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
content-length
52671
last-modified
Wed, 06 Mar 2019 21:39:02 GMT
server
Apache
etag
"5bddbb4465cdcb7d5352e5dd7b6078cc:1551908342"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400, private;max-age=86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 21 Mar 2019 01:11:25 GMT
ls-zdnet.js
js-sec.indexww.com/ht/ 		85 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/ht/ls-zdnet.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Mar 2019 00:20:28 GMT
Server
Apache
ETag
"76377d-15269-5847b96b7ae48"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=700
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
26184
Expires
Wed, 20 Mar 2019 01:23:05 GMT
YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
c.go-mpulse.net/boomerang/ Frame EB90 		187 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/javascript;charset=UTF-8
Cache-Control
max-age=604800, s-maxage=604800
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
Timing-Allow-Origin
*
gpt.js
www.googletagservices.com/tag/js/ 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
68661329a1cd69d6d40894a3531b37e648a4057832a3ab433afc6abd1d64d313
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"112 / 703 of 1000 / last-modified: 1553036242"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10782
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:25 GMT
sfp.js
native.sharethrough.com/assets/ 		371 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://native.sharethrough.com/assets/sfp.js
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.80 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-80.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5998ea0ddeb88858fb1d3cac734662086a999298da0eadb3da62e19fd8907f83

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:01:03 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 21:58:48 GMT
server
AmazonS3
age
751
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
3ibkv75d5I_4YFKVRo8f4hOtFmS72HRjKpBPeaj-qD5sXK4x63v7rg==
via
1.1 d01ad8df731d3f120823f9e20df55147.cloudfront.net (CloudFront)
expires
Tue, 19 Mar 2019 22:58:47 GMT
evidon-banner.js
c.evidon.com/sitenotice/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/evidon-banner.js
Requested by
Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.67.133.23 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-133-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4b51cad50779921c134fe5f8a46df29da7bdedf5f643c331d192b6057af97992

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
status
200
access-control-max-age
86400
content-length
2538
last-modified
Wed, 27 Feb 2019 22:45:43 GMT
server
Apache
etag
"41298c7c9394582aaf744ce4397a8521:1551307546"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=86400, private;max-age=86400
access-control-allow-credentials
false
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 21 Mar 2019 01:11:25 GMT
2
l.betrad.com/site/v3/425/3445/3/1/2/ 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/site/v3/425/3445/3/1/2/2?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.235.30.148 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-235-30-148.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by
Express
vary
Accept-Encoding
;ord=1553044285325
ad.doubleclick.net/ddm/ad/uwilqjbat/of/dhtphg/ekdqsjphky/ 		43 B
502 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/ddm/ad/uwilqjbat/of/dhtphg/ekdqsjphky/;ord=1553044285325?
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.16.166 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f166.1e100.net
Software
cafe /
Resource Hash
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:25 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
18863
l.betrad.com/site/v3/425/3445/3/1/2/2/ 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/site/v3/425/3445/3/1/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.235.30.148 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-235-30-148.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by
Express
vary
Accept-Encoding
18863
l.betrad.com/site/v3/425/3445/3/4/2/2/ 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/site/v3/425/3445/3/4/2/2/18863?consent=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.235.30.148 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-235-30-148.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
x-powered-by
Express
vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ 		109 B
490 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ 		109 B
490 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_319.js
securepubads.g.doubleclick.net/gpt/ 		160 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
cf65e308f1c461e06038b45d5bfa27689e22241f6b673b7d540d35cdd0ca4c32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 07 Mar 2019 16:13:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
58724
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:25 GMT
rid
match.adsrvr.org/track/ 		109 B
524 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=184216
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.240.175.172 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-240-175-172.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ce6a918d0fade0e75a9ecf3dabb9eaa08c0c34af6ca838defe9adc31768b6995

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
x-aspnet-version
4.0.30319
status
200
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
109
expires
Fri, 19 Apr 2019 01:11:25 GMT
require.optional-dependency.js
zdnet4.cbsistatic.com/fly/js/libs/ 		582 B
518 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/js/libs/require.optional-dependency.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f27c0c9f284c6959dd7db1e768c6e43a518ea650afc69d7a60383f3a963cde7b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 16:42:46 GMT
server
nginx
etag
"5b5f4006-246"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
307
expires
Wed, 27 Mar 2019 01:11:25 GMT
article-070c6edc57-rev.js
zdnet4.cbsistatic.com/fly/js/pages/ 		250 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/js/pages/article-070c6edc57-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c480ce7d4d5f2fb023403c864eac3350b46fab68728482d625d4d4b45b049427

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 11 Mar 2019 14:43:13 GMT
server
nginx
etag
W/"5c867401-3e718"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
72107
expires
Wed, 27 Mar 2019 01:11:25 GMT
utag.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		94 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
98a91b898a824dd0cf24f33ff1e83eed96b8846b34906a04d148d679ec76328a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 04 Feb 2019 23:26:48 GMT
server
AkamaiNetStorage
etag
"5272121993f0cd3709694b5de30997c6:1549322808"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
19639
expires
Wed, 20 Mar 2019 01:16:25 GMT
CBSI-PLAYER.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/ 		760 KB
203 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.122.133 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1491a1594a4058a62ea4c08441cfcbbfe82a0916b4f26b55f3605af896766dd7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
age
2334980
x-cache
HIT, HIT
status
200
x-cache-hits
1, 56
content-length
206982
x-amz-id-2
00wxkpwuAzVTkPD8/nzRtFNLsfyAqVWfcEHoC2EHo/t6ZcwKMq60wTYpksh3aMjkKJ0nwH342Hg=
x-served-by
cache-dca17743-DCA, cache-cdg20773-CDG
last-modified
Fri, 21 Dec 2018 01:15:44 GMT
server
AmazonS3
x-timer
S1553044286.828580,VS0,VE0
etag
"ffe80da4a589534ffbb17f46d6ef50a3"
vary
Accept-Encoding
x-amz-request-id
A730A61B7DDD0284
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
backend-origin
fastlyshield--shield_cache_dca17743_DCA
x-amz-meta-mtime
1522022400
mpulse-1.0.2.js
zdnet1.cbsistatic.com/fly/js/libs/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Tue, 04 Sep 2018 19:29:20 GMT
server
nginx
etag
W/"5b8edd10-2fdf"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
4877
expires
Wed, 27 Mar 2019 01:11:25 GMT
config.json
c.go-mpulse.net/api/v2/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1553044285810&s=8681b1570b2811a5be5ffb57623d551cdd6329cadf147fd7a096d3b9ce1eb485
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c13552944b0ca91101e9d1fe16c0a220e0851634ea1e6e95d832858d9fd9b9ea

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
736
isInternalUser.js
iicbsi-a.akamaihd.net/common/js/esi/ 		22 B
262 B 		Script
General
Check archive.org
Download Go to
Full URL
https://iicbsi-a.akamaihd.net/common/js/esi/isInternalUser.js?cb=cbsiInternal
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00::210:ba12 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Apache /
Resource Hash
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Cache-Control
max-age=369239
Server
Apache
Connection
keep-alive
ETag
"fb25287978f1b619e801f164a2dfd9ea:1473886414"
Content-Length
22
Content-Type
application/x-javascript
vglnk.js
cdn.viglink.com/api/ 		78 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0dd0d42e82bfcc16e96fb72d732787a0edf0bc99b0a34f6f6eaaf1d1b32a8f9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
10188A31AAAD84F6
status
200
content-length
27355
x-amz-id-2
DqydBfcU3scbnAmCHibbgGUjt9NeYrjWjZWtMQ9zgQT9RYVOhrlkzz28Ae6Ws0CLqevAPK6qseU=
last-modified
Thu, 28 Feb 2019 16:44:17 GMT
server
cloudflare
etag
"e4a0c710d19e7cd4fd23cd54aeb7db5e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1800
accept-ranges
bytes
cf-ray
4ba3cfe2ce2263a3-FRA
expires
Wed, 20 Mar 2019 01:41:25 GMT
utag.1779.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1779.js?utv=ut4.43.201812051842
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:44:34 GMT
server
AkamaiNetStorage
etag
"d9d7e83a29455212e34c01480b1f490c:1468269874"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1785
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1782.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 29 Oct 2018 17:20:52 GMT
server
AkamaiNetStorage
etag
"97a101e7e82a97f50ecf77b7f47f82c0:1540833652"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1071
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1787.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		142 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d4ccc0936dea09d1846d5bb1487dd533738e598752d8215cd883f77b3cd91d4b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 04 Feb 2019 23:26:48 GMT
server
AkamaiNetStorage
etag
"de701970add656aa2ed88a5afc8b53f5:1549322808"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1790.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:39 GMT
server
AkamaiNetStorage
etag
"4b28dcbeb485ec0fb2bc177998e13a13:1470061899"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
872
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1791.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1791.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 01 Aug 2016 14:31:39 GMT
server
AkamaiNetStorage
etag
"d48fc2d40f52ba6d94837d7d88bf538f:1470061899"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1196
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1792.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1792.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2016 14:29:14 GMT
server
AkamaiNetStorage
etag
"3a3edbecca3411eff2cd07c3d9a1c9a1:1469716154"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1664
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1797.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Wed, 25 Jan 2017 20:08:35 GMT
server
AkamaiNetStorage
etag
"b9d616cf39d845f12dd79086f8a81faf:1485374915"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
883
expires
Thu, 04 Apr 2019 01:11:25 GMT
utag.1800.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1800.js?utv=ut4.43.201805241512
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e9b3eb7f022396e969766ad5e908b21df0b646c943e149902c64de590e9549d9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 07 Aug 2017 22:41:17 GMT
server
AkamaiNetStorage
etag
"a4e3f3c6ffcb138f20ba95f73c0e2416:1502145677"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
912
expires
Thu, 04 Apr 2019 01:11:25 GMT
ad-009e94c00c-rev.js
zdnet2.cbsistatic.com/fly/js/managers/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/js/managers/ad-009e94c00c-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
527c0c0c1a578554c4475a506762fb90fe7af774e9fa3aa12a8e46098971ab80

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Mon, 18 Feb 2019 12:17:11 GMT
server
nginx
etag
W/"5c6aa247-1aba"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2426
expires
Wed, 27 Mar 2019 01:11:25 GMT
config.json
c.go-mpulse.net/api/ Frame EB90 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&d=www.zdnet.com&t=5176814&v=1.571.0&if=&sl=0&si=1j2gvsct3q8-NaN&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,LOGN&acao=
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
dbe433fd93ce167d7ab3165a4274bb9e4caa01404c0ac6d87c10bdd376f24ef7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
692
lightbox.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 6610 		326 B
544 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1553044285877&lv=1
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
8cbc6f6b56bd4267915a2dc3fb476ff37dc18f9abcaf7fe8768afad282d809b6

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
server
cloudflare
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cf-ray
4ba3cfe31ea3c2d3-FRA
tag.aspx
ml314.com/ 		26 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?2022019
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1782.js?utv=ut4.43.201810291720
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.247.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
a3273dce4deb1a87d9c6b75ce1b9305872ee56ad6da2ab873858d9d20d1ff3a8

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Last-Modified
Wed, 20 Mar 2019 01:07:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=86177
Connection
keep-alive
Content-Length
11908
Expires
Thu, 21 Mar 2019 01:07:43 GMT
st.v3.js
www.everestjs.net/static/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.87.166 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-87-166.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
35733dd71de077b039d2bac6614c78eb3ab7d3879cb307cc10cc1907d2f61eb6

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Last-Modified
Tue, 27 Nov 2018 08:53:52 GMT
Server
Apache
ETag
"183a208-4205-57ba196bd494e"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=59573
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5509
Expires
Wed, 20 Mar 2019 17:44:18 GMT
ad-2.0.js
zdnet3.cbsistatic.com/fly/bundles/flyjs/js/managers/ 		19 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/bundles/flyjs/js/managers/ad-2.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
de749bdbeeb7bb7f79cb31ff00fe6830004064419f73fe9a6ec982e9de8bf19d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
gzip
last-modified
Wed, 12 Sep 2018 09:41:20 GMT
server
nginx
etag
W/"5b98df40-4c22"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
5115
expires
Wed, 27 Mar 2019 01:11:25 GMT
tag.js
js.agkn.com/prod/v0/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.agkn.com/prod/v0/tag.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1800.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200d:7400:15:efbc:e300:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd30ffd9618eaa423abb4c900f4af01cac18be85d75265ba08d87d5230bf85b8

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:02:19 GMT
via
1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)
last-modified
Tue, 04 Dec 2018 22:35:38 GMT
server
AmazonS3
age
9269
etag
"a5442c681a576408c25edbf365995343"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
3167
x-amz-cf-id
KV9h16uCLVQLX_SdboO1zqS2q1A3hEGBVagBSzeCM87RLDzSxNq9tw==
ds.js
dw.cbsi.com/js/cbsi/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dw.cbsi.com/js/cbsi/ds.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1790.js?utv=ut4.43.201805241512
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Sep 2017 19:06:40 GMT
Server
Apache/2.4.25
ETag
"1917-55916dc13f000"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=43200, s-maxage=1800
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=914
Content-Length
6423
Expires
Wed, 20 Mar 2019 01:41:26 GMT
cbsinteractive.js
tru.am/scripts/custom/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tru.am/scripts/custom/cbsinteractive.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1797.js?utv=ut4.43.201805241512
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a27fab6c5a0b1db438219c7d24ce2fff95e0910378fe4bdeb64b4f970eebccc

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 23 Jan 2018 19:10:31 GMT
server
cloudflare
etag
W/"8c3752e674fdabefc911d5c40f71780d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4ba3cfe37e34bee9-FRA
expires
Wed, 20 Mar 2019 05:11:26 GMT
pixel.gif
cdn.viglink.com/images/ 		43 B
102 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=4.090296140600373
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
cf-cache-status
HIT
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
x-amz-request-id
1A44048EE6D14824
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
4ba3cfe36e6363a3-FRA
content-length
43
x-amz-id-2
MzLO+M36nfrkYr60LBEdLjWIZQP+zdpEDuEKphP3iM5lGEG7+bXlUdmyZWj6f44IsVLtTSb4i6I=
pixel.gif
cdn.viglink.com/images/ 		43 B
263 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=4.090296140600373
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:25 GMT
cf-cache-status
HIT
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
x-amz-request-id
1A44048EE6D14824
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=15, must-revalidate
accept-ranges
bytes
cf-ray
4ba3cfe36e6463a3-FRA
content-length
43
x-amz-id-2
MzLO+M36nfrkYr60LBEdLjWIZQP+zdpEDuEKphP3iM5lGEG7+bXlUdmyZWj6f44IsVLtTSb4i6I=
anonc.js
dw.cbsi.com/ 		73 B
620 B 		Script
General
Check archive.org
Download Go to
Full URL
https://dw.cbsi.com/anonc.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
5c07e505644f3fb108d78aea0fda66308640c68b73bba3a62cf2c4113e97f6c0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Apache/2.4.25
Etag
BxabzFyRkz5icIhQVCI.1.dw_anonc
P3P
CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Cache-control
private, max-age=43200, s-max-age=0
Connection
Keep-Alive
Content-Type
application/javascript
Keep-Alive
timeout=80, max=180
Content-Length
73
Expires
Mon, 05 Jan 1970 12:12:12 GMT
gpt-4.3.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/managers/ 		52 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/managers/gpt-4.3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d48e0904f1b40972f1fc6dac3f358719e080fab3291d13d2ca4a60405707a88b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
gzip
last-modified
Tue, 04 Sep 2018 19:27:44 GMT
server
nginx
etag
W/"5b8edcb0-d143"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
10936
expires
Wed, 27 Mar 2019 01:11:26 GMT
Cookie set /
d.agkn.com/iframe/8613/ Frame CB3B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://d.agkn.com/iframe/8613/?che=370511224&gdpr=&gdpr_consent=&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&bpid=cbsinteractive&c=%7B%22bpid%22%3A%22cbsinteractive%22%2C%22loc%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F%22%2C%22gdpr%22%3A%22%22%2C%22gdpr_consent%22%3A%22%22%2C%22ref%22%3A%22https%3A%2F%2Ft.co%2F00ebQBQ0nK%22%2C%22cid%22%3A%22-1%22%2C%22sid%22%3A%22-1%22%2C%22gen%22%3A%22-1%22%2C%22age%22%3A%22-1%22%2C%22cat%22%3A%22-1%22%2C%22brd%22%3A%22-1%22%7D
Requested by
Host: js.agkn.com
URL: https://js.agkn.com/prod/v0/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.88.219 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-208-88-219.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash

Request headers

Host
d.agkn.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Cache-Control
no-cache, must-revalidate
Content-Type
text/html;charset=UTF-8
Date
Wed, 20 Mar 2019 01:11:26 GMT
Expires
Sat, 01 Jan 2000 00:00:00 GMT
P3P
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
Server
Apache-Coyote/1.1
Set-Cookie
ab=0001%3AQhEHP4tfQ%2BTdyrg1Eh2QarlORBqX2g6B;Max-Age=31536000;domain=agkn.com;path=/ u=C|0AEAkJE--JCRPvgAAAAAAAg1RAQCADVIBAIA;Max-Age=31536000;domain=agkn.com;path=/
Content-Length
481
Connection
keep-alive
user.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 6610 		616 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox.js?cb=1553044285877&lv=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b536d88c3df185fc95a5c3120148b75da6dbe0960d3108642c9ec87d239f727

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
7bBbWBinUYzuMBUFRxJi/A==
cf-polished
origSize=998594
status
200
x-ms-lease-status
unlocked
last-modified
Mon, 18 Mar 2019 21:36:38 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
c399d447-501e-003e-68d2-dde3e0000000
expires
Thu, 19 Mar 2020 01:11:26 GMT
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
4ba3cfe3efe8c2d3-FRA
cf-bgj
minify
ta-pagesocial-sdk.js
tru.am/scripts/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/cbsinteractive.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb9007c254c493be4a067de535b19a30f5e5aef3d5b19f58b1c72d2c65a04f79

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 21 May 2018 10:49:23 GMT
server
cloudflare
etag
W/"8761e04182a1c11ff30f706f8052c8d6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=86400
cf-ray
4ba3cfe3ee6abee9-FRA
expires
Thu, 21 Mar 2019 01:11:26 GMT
utsync.ashx
ml314.com/ 		906 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=50070&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&pv=1553044286071_735y9r83i&bl=en-us&cb=3668888&return=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D22052%26dpuuid%3D%5BPersonID%5D%26redir%3D&ht=&d=&dc=&si=1553044286071_735y9r83i&cid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&s=1600x1200&rp=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?2022019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.247.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
18acd09ec1584113e42232bb972da74ec2ed2d0bf58458b6bdccf45c5f9d9c1c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
private
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
519
Expires
0
ud.ashx
in.ml314.com/ 		20 B
698 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=2022019
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?2022019
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.235.206.33 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-235-206-33.compute-1.amazonaws.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, no-cache="set-cookie"
Connection
keep-alive
Content-Length
138
Expires
Thu, 21 Mar 2019 01:11:26 GMT
beacon
beacon.tru.am/ 		17 B
388 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::6819:a322 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27676ea482895bdddd3f3796f430a812e11364efc224227c86973a52398966c2

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
br
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, private, max-age=0
cf-ray
4ba3cfe48cffbed5-FRA
expires
Thu, 01 Jan 1970 00:00:00 UTC
csync.ashx
ml314.com/
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=5978151465408062634&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=5978151465408062634%26eid=50056
  • https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=5978151465408062634&eid=50056
43 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=5978151465408062634&eid=50056
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.247.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 20 Mar 2019 21:11:26 GMT

Redirect headers

Location
https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=5978151465408062634&eid=50056
Date
Wed, 20 Mar 2019 01:11:26 GMT
Connection
keep-alive
Content-Length
0
BK-Server
7f36
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=5978151465408062634
  • https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTNTk3ODE1MTQ2NTQwODA2MjYzNBAAGg0IvqbG5AUSBQjoBxAAQgBKAA
  • https://ml314.com/csync.ashx?fp=86ac49fec9c729921855c7beddf323f9819f0876004e1587d0973c4b951f44a1f4cb09cee1a4f8eb&person_id=5978151465408062634&eid=50082
43 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=86ac49fec9c729921855c7beddf323f9819f0876004e1587d0973c4b951f44a1f4cb09cee1a4f8eb&person_id=5978151465408062634&eid=50082
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.224.12 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-171-224-12.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 20 Mar 2019 21:11:26 GMT

Redirect headers

status
307
date
Wed, 20 Mar 2019 01:11:26 GMT
cache-control
no-cache, no-store
timing-allow-origin
*
content-length
0
location
https://ml314.com/csync.ashx?fp=86ac49fec9c729921855c7beddf323f9819f0876004e1587d0973c4b951f44a1f4cb09cee1a4f8eb&person_id=5978151465408062634&eid=50082
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
csync.ashx
ml314.com/
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151465408062634%26eid=50220
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=5978151465408062634%26eid=50220&mm_bnc&mm_bct
  • https://ml314.com/csync.ashx?fp=742d5c91-917f-4800-a7f7-b6cf3c44aad9&person_id=5978151465408062634&eid=50220
43 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=742d5c91-917f-4800-a7f7-b6cf3c44aad9&person_id=5978151465408062634&eid=50220
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.247.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 20 Mar 2019 21:11:26 GMT

Redirect headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
MT3 1.31.3.9 fe26b9c DPLAT-404 cdg-pixel-x6
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=742d5c91-917f-4800-a7f7-b6cf3c44aad9&person_id=5978151465408062634&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Wed, 20 Mar 2019 01:11:25 GMT
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151465408062634
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D5978151465408062634
  • https://ml314.com/csync.ashx?fp=39ec8f68f2a60841928fadeb3e4b717a&eid=50146&person_id=5978151465408062634
43 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=39ec8f68f2a60841928fadeb3e4b717a&eid=50146&person_id=5978151465408062634
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.247.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-246-247-78.eu-west-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
private
Connection
keep-alive
Content-Length
43
Expires
Wed, 20 Mar 2019 21:11:26 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:26 GMT
P3P
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
Location
https://ml314.com/csync.ashx?fp=39ec8f68f2a60841928fadeb3e4b717a&eid=50146&person_id=5978151465408062634
Cache-Control
no-cache
X-Server
10.26.8.227
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2qY1T5nE4-VmyeLV9iq0uMFxX_Lo3yc8bl3QcQLegCJQ&gdpr=1&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil
  • https://ml314.com/csync.ashx?fp=2qY1T5nE4-VmyeLV9iq0uMFxX_Lo3yc8bl3QcQLegCJQ&person_id=5978151465408062634&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
70 B
171 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.197.149.199 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-18-197-149-199.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Content-Length
70
Content-Type
image/gif

Redirect headers

Date
Wed, 20 Mar 2019 01:11:25 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
text/html; charset=utf-8
Location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil
Cache-Control
private
Connection
keep-alive
Content-Length
168
Expires
Wed, 20 Mar 2019 21:11:26 GMT
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=5978151465408062634&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151465408062634&redir=
42 B
769 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151465408062634&redir=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.182.129 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-182-129.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v021-098e5e736.edge-irl1.demdex.com 5.49.0.20190304124312 3ms
Pragma
no-cache
X-TID
xmAc0CsER0Y=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
X-TID
asxyMvoIT3w=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=5978151465408062634&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
fb_digioh.2.1.5.css
www.lightboxcdn.com/static/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.lightboxcdn.com/static/fb_digioh.2.1.5.css?cb=636885417983100100
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2a804abed27cf1276fba69a26f3da96befe05f5661af72545fc97a508c82e5e

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
i+12d4SLet4LAL0q+CrTcw==
cf-polished
origSize=5372
x-ms-meta-cbmodifiedtime
Tue, 03 Nov 2015 22:12:06 GMT
status
200
x-ms-lease-status
unlocked
last-modified
Wed, 20 Feb 2019 20:29:57 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
x-ms-request-id
c1bdb8e7-601e-00b5-02d2-dd583e000000
expires
Thu, 19 Mar 2020 01:11:26 GMT
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
4ba3cfe4e972c2d3-FRA
cf-bgj
minify
ls.html
www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame AA68 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.lightboxcdn.com/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=636885417983100100
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
www.lightboxcdn.com
:scheme
https
:path
/lclst/a1583f50-579b-41d0-8c4e-1cd1790d945c/ls.html?purl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&vid=a1583f50-579b-41d0-8c4e-1cd1790d945c&se=0&prev=0&cb=636885417983100100
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
__cfduid=dfd39b65b0aec279789b1bea33e1e44811553044285
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
date
Wed, 20 Mar 2019 01:11:26 GMT
content-type
text/html
content-md5
xa1/rdPe0J6SwxlD7atkzw==
last-modified
Mon, 18 Mar 2019 21:36:38 GMT
x-ms-request-id
c8715e70-101e-00dc-3ab9-de0792000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
cf-cache-status
MISS
expires
Thu, 19 Mar 2020 01:11:26 GMT
cache-control
public, max-age=31536000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
server
cloudflare
cf-ray
4ba3cfe4e98ec2d3-FRA
content-encoding
br
t.gif
www.lightboxcdn.com/z9g/ 		35 B
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1553044286218&h=www.zdnet.com&e=p&u=40913
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Mar 2019 01:11:26 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
7e3e704a-501e-0118-4275-cd3e01000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
4ba3cfe4e98cc2d3-FRA
cf-bgj
imgq:85
/
0211c814.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://0211c814.akstat.io/?h.pg=article&h.ab=ad_stack_control_1&when=1553044286252&t_other=custom4%7C2069&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=8e3b8951a98e7f70b2d8c67d30177d1fd19d255a&h.t=1553044285837&http.initiator=api&rt.start=api&rt.si=98e3462f-a47d-416f-9728-8145ccd98a2b&rt.ss=1553044288851&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:26 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 20 Mar 2019 01:11:26 GMT
ping
api.viglink.com/api/ 		261 B
941 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.viglink.com/api/ping
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.87.193 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
3bd097e0a2ffab3241922a0b074d76dcdd1a75d43e1c9556e7f1e8e5939994cc

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
261
Expires
Thu, 01 Jan 1970 00:00:00 GMT
c.gif
dw.cbsi.com/clear/ 		42 B
346 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dw.cbsi.com/clear/c.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=91a1429b-0d61-43fd-b421-a8b6e260e98c&assettitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&assettype=content_article&pubdate=2019-02-28%2018%3A26%3A07&viewguid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&ts=1553044286424&ld=www.zdnet.com&ldc=729ffe36-ddd1-4420-b951-3a9854c61bfa&brwinsz=1600x1200&brscrsz=1600x1200&brlang=en-US&tcset=utf8&im=dsjs&clgf=BxabzFyRkz5icIhQVCI&xref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&title=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Keep-Alive
timeout=80, max=366
Content-Length
42
Expires
Mon, 05 Jan 1970 12:12:12 GMT
id
dpm.demdex.net/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&ts=1553044286525
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.182.129 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-182-129.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
366dd5f07685f15ce8fbf1ef89dc1831f87e77274e8eaca4c175aae3c8db4fa4

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v021-07cd3f515.edge-irl1.demdex.com 5.49.0.20190304124312 4ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
MTKpF29DTVE=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
752
Expires
Thu, 01 Jan 1970 00:00:00 GMT
utag.v.js
tags.tiqcdn.com/utag/tiqapp/ 		2 B
202 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cbsi/zdnetglobalsite/201902042326&cb=1553044286527
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Wed, 20 Mar 2019 01:21:26 GMT
Cookie set dest5.html
cbsi.demdex.net/ Frame 5658 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=undefined
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.58.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-213-58-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=88531462596589170174219556101805620937
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 06 Mar 2019 12:43:31 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=88531462596589170174219556101805620937;Path=/;Domain=.demdex.net;Expires=Mon, 16-Sep-2019 01:11:26 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
oqUIIKSUQcQ=
Content-Length
2764
Connection
keep-alive
id
saa.cbsi.com/ 		90 B
577 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://saa.cbsi.com/id?d_visid_ver=2.3.0&d_fieldgroup=A&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&mid=88302168321446056654240514095442262961&ts=1553044286569
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.37 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
cbsi.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
96cf2e499d0aa55ab3638bcbd9e9d54982e20dbae123f214d857eb1b77cbbaac

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Omniture DC
xserver
www7142
Vary
Origin
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Access-Control-Allow-Origin
https://www.zdnet.com
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Content-Type
application/x-javascript
Keep-Alive
timeout=15
Content-Length
90
domains
api.viglink.com/api/ 		76 B
521 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.87.193 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
27cd569efd4a5e1be8a63597fb40ac2f9d29f4db0f5eb4686bf99469fbeb779c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:26 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
76
Expires
Thu, 01 Jan 1970 00:00:00 GMT
id
dpm.demdex.net/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=88302168321446056654240514095442262961&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012E48C99F05310321-40000191C000E2B0&ts=1553044286720
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.182.129 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-182-129.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cdfffe04dd3bedc6b4d55766ac77df7ca133d5cd7df9b4da219b91c63773869e

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v021-01ad1a719.edge-irl1.demdex.com 5.49.0.20190304124312 7ms
Pragma
no-cache
Content-Encoding
gzip
X-TID
/rkgCGgVThs=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
753
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s02464717539520
saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://saa.cbsi.com/b/ss/cnetzdnetglobalsite/10/JS-2.3.0/s02464717539520?AQB=1&ndh=1&pf=1&callback=s_c_il[0].doPostbacks&et=1&t=20%2F2%2F2019%201%3A11%3A26%203%200&d.&nsid=0&jsonv=1&.d&mid=88302168321446056654240514095442262961&aid=2E48C99F05310321-40000191C000E2B0&aamlh=6&ce=UTF-8&ns=cbsinteractive&pageName=zdnet%3A%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&r=https%3A%2F%2Ft.co%2F00ebQBQ0nK&cc=USD&ch=editorial&server=www.zdnet.com&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=zdnet&v1=zdnet&h1=editorial%7Carticle&c2=D%3Dv2&v2=eu&l2=113c25b6-ec91-11e3-95d2-02911863765e&c3=D%3Dv3&v3=responsive%20web%7Cdesktop&l3=85fd8691-f525-4ea2-a601-af296f629f7f&c4=D%3Dv4&c5=D%3Dv5&v5=cnetzdnetglobalsite&c6=D%3Dv6&v6=editorial%7Carticle&c7=D%3Dv7&v7=D%3Dg&c8=D%3Dv8&v8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=D%3DUser-Agent&c10=D%3Dv10&v10=article&c11=D%3Dv11&v11=D%3Dch%2B%22%3A%22%2Bv10&v15=not%20authenticated%7Canon&c20=D%3Dv20&v20=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&c22=D%3Dv22&v22=content_article&c23=D%3Dv23&v23=113c25b6-ec91-11e3-95d2-02911863765e&c24=D%3Dv24&v24=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&c25=D%3Dv25&c26=D%3Dv26&v26=bfccdd23-ed4a-11e3-95d2-02911863765e&c28=D%3Dv28&c30=D%3Dv30&v30=91a1429b-0d61-43fd-b421-a8b6e260e98c&c31=D%3Dv31&c33=D%3Dv33&c34=D%3Dv34&c35=D%3Dv35&v35=BxabzFyRkz5icIhQVCI&v44=ad_stack%7C1%7Ccontrol&c50=D%3Dv50&v50=9%3A00PM&c51=D%3Dv51&v51=Tuesday&c52=D%3Dv52&v52=1&c53=D%3Dv53&v53=New&c54=D%3Dv54&v54=First%20Visit&c65=D%3Dv65&v65=discover&c69=D%3Dv69&v85=true&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.37 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
cbsi.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
88af97624c853db3e3193068cf680f6f61961ef889b984ac3d477377d13694b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-AAM-TID
jrmNhIQiSn8=
Date
Wed, 20 Mar 2019 01:11:26 GMT
X-Content-Type-Options
nosniff
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
1828
X-XSS-Protection
1; mode=block
DCS
dcs-prod-irl1-v021-0c2a47d38.edge-irl1.demdex.com 5.49.0.20190304124312 8ms
Pragma
no-cache
Last-Modified
Thu, 21 Mar 2019 01:11:26 GMT
Server
Omniture DC/2.0.0
xserver
www161
ETag
"3335137208891932672-5146102632032508965"
Vary
*
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Tue, 19 Mar 2019 01:11:26 GMT
jpt
secure.adnxs.com/ 		0
684 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/jpt?id=11834629&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=dv4rdQq6&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.70 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
154.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 154.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.119:80
AN-X-Request-Uuid
0cd59767-0d6e-4e13-a448-d8d60886d97f
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/ 		0
684 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/jpt?id=11834625&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=lq5Uz31N&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.70 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
154.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 154.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.132:80
AN-X-Request-Uuid
9d3b9962-ab1e-45fa-a99a-418c896c87a4
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/ 		0
684 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/jpt?id=11834627&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=4l95oMq2&psa=0&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.70 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
154.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 154.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.115:80
AN-X-Request-Uuid
adf47d44-289c-459a-b7da-04f52901cdc5
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/ 		0
684 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/jpt?id=11834631&size=300x250&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=OpnyaNWO&psa=0&promo_sizes=300x600&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.70 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
154.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 154.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.120:80
AN-X-Request-Uuid
317c5c6e-8c39-4152-b7ca-136dba1e64e6
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
jpt
secure.adnxs.com/ 		0
684 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/jpt?id=11834632&size=728x90&callback=headertag.AppNexusHtb.adResponseCallback&callback_uid=mtXREpsv&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.70 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
154.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.13.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 154.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.119:80
AN-X-Request-Uuid
fcf8d1bf-7736-4836-85e2-9ae8c75ab616
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
as-sec.casalemedia.com/ 		66 B
943 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/cygnus?v=7.2&s=182823&fn=headertag.IndexExchangeHtb.adResponseCallback&r=%7B%22id%22%3A95433708%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F%22%2C%22ref%22%3A%22https%3A%2F%2Ft.co%2F00ebQBQ0nK%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22202%22%2C%22siteID%22%3A%22182829%22%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22220%22%2C%22siteID%22%3A%22183316%22%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22209%22%2C%22siteID%22%3A%22182828%22%7D%2C%22id%22%3A%223%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22210%22%2C%22siteID%22%3A%22182826%22%7D%2C%22id%22%3A%224%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22208%22%2C%22siteID%22%3A%22182824%22%7D%2C%22id%22%3A%225%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22222%22%2C%22siteID%22%3A%22182825%22%7D%2C%22id%22%3A%226%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22219%22%2C%22siteID%22%3A%22183315%22%7D%2C%22id%22%3A%227%22%7D%2C%7B%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22sid%22%3A%22201%22%2C%22siteID%22%3A%22182823%22%7D%2C%22id%22%3A%228%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22020c46ee-a5ac-4c18-b23c-43a924564c87%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222019-03-20T01%3A11%3A25%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.211.2.27 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-211-2-27.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
50e258894c35132a6e6650553a2ca25c007c449a6c065f145ef0bc1eb9637a58

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
86
Expires
Wed, 20 Mar 2019 01:11:27 GMT
vglnk.js
cdn.viglink.com/api/ 		78 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0dd0d42e82bfcc16e96fb72d732787a0edf0bc99b0a34f6f6eaaf1d1b32a8f9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
10188A31AAAD84F6
status
200
content-length
27355
x-amz-id-2
DqydBfcU3scbnAmCHibbgGUjt9NeYrjWjZWtMQ9zgQT9RYVOhrlkzz28Ae6Ws0CLqevAPK6qseU=
last-modified
Thu, 28 Feb 2019 16:44:17 GMT
server
cloudflare
etag
"e4a0c710d19e7cd4fd23cd54aeb7db5e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1800
accept-ranges
bytes
cf-ray
4ba3cfe9484563a3-FRA
expires
Wed, 20 Mar 2019 01:41:26 GMT
utag.1775.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201902042326
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
gzip
last-modified
Thu, 10 Nov 2016 20:42:35 GMT
server
AkamaiNetStorage
etag
"5c146d38de1d3cadd0aad77a0a5f17a5:1478810555"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
8960
expires
Thu, 04 Apr 2019 01:11:26 GMT
utag.277.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201902042326
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:44:36 GMT
server
AkamaiNetStorage
etag
"29692457f12ec06cd9fc48cbd8cdc6ef:1468269876"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
863
expires
Thu, 04 Apr 2019 01:11:26 GMT
utag.1772.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1772.js?utv=ut4.43.201902042326
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
gzip
last-modified
Mon, 11 Jul 2016 20:44:35 GMT
server
AkamaiNetStorage
etag
"c7d84f57f98f9b3fb71a3838478c37f9:1468269875"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
959
expires
Thu, 04 Apr 2019 01:11:26 GMT
utag.1796.js
tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1796.js?utv=ut4.43.201902042326
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.215.136 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-215-136.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:26 GMT
content-encoding
gzip
last-modified
Mon, 28 Nov 2016 15:10:21 GMT
server
AkamaiNetStorage
etag
"dd19a19a5530b9ad20e9a093818a0f15:1480345821"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=1296000
accept-ranges
bytes
content-length
2762
expires
Thu, 04 Apr 2019 01:11:26 GMT
pixel_details.html
www.everestjs.net/static/ Frame 9CA8
Redirect Chain
  • https://pixel.everesttech.net/4083/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26optout%3D__EFOPTOUT__%26throttleCook...
  • https://www.everestjs.net/static/pixel_details.html
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.87.166 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-87-166.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

Host
www.everestjs.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Server
Apache
Last-Modified
Tue, 04 Oct 2011 16:14:21 GMT
ETag
"8623-a6-4ae7b62583140"
Accept-Ranges
bytes
Content-Type
text/html
Content-Encoding
gzip
Content-Length
146
Cache-Control
max-age=59515
Expires
Wed, 20 Mar 2019 17:43:22 GMT
Date
Wed, 20 Mar 2019 01:11:27 GMT
Connection
keep-alive
Vary
Accept-Encoding

Redirect headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Server
Apache
Set-Cookie
everest_session_v2=XJGTPwAABbsKQXyd; path=/; domain=.everesttech.net everest_g_v2=g_surferid~XJGTPwAABbsKQXyd; path=/; domain=.everesttech.net; expires=Thu, 11-Feb-2021 11:51:27 GMT
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Location
https://www.everestjs.net/static/pixel_details.html#google=XJGTPwAABbsKQXyd&gsurfer=XJGTPwAABbsKQXyd&optout=0&throttleCookie=&time=20190320011127
Content-Length
345
Keep-Alive
timeout=15, max=997183
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Cookie set dest5.html
cbsi.demdex.net/ Frame 7425 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cbsi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.213.58.51 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-213-58-51.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Host
cbsi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Cookie
demdex=88531462596589170174219556101805620937; dextp=269-1-1553044286714|477-1-1553044286816|771-1-1553044286918|22052-1-1553044287018
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 06 Mar 2019 12:44:10 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=88531462596589170174219556101805620937;Path=/;Domain=.demdex.net;Expires=Mon, 16-Sep-2019 01:11:27 GMT;Max-Age=15552000
Vary
Accept-Encoding, User-Agent
X-TID
iXJzq+L7Rlc=
Content-Length
2764
Connection
keep-alive
/
www.zdnet.com/components/breaking-news/xhr/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/components/breaking-news/xhr/?slug=breaking-news-banner
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
382fde4c3b7f67dd0cd604e32a416a7444d16c554ce47db1ca15dd7562eb975a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/components/breaking-news/xhr/?slug=breaking-news-banner
pragma
no-cache
cookie
fly_device=desktop; nemo_highlander=ad_stack%3a1%3acontrol; fly_default_edition=eu; fly_preferred_edition=eu; fly_geo={"countryCode": "de"}; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22f%22%2C%22subSession%22%3A%226%22%7D; first_page_today=false; _ccmsi=1553044286071_735y9r83i|1553044286071; _ccmaid=5978151465408062634; LDCLGFbrowser=729ffe36-ddd1-4420-b951-3a9854c61bfa; XCLGFbrowser=BxabzFyRkz5icIhQVCI; s_vnum=1555636286519%26vn%3D1; s_invisit=true; s_getNewRepeat=1553044286520-New; s_lv_zdnet=1553044286520; s_lv_zdnet_s=First%20Visit; AMCVS_10D31225525FF5790A490D4D%40AdobeOrg=1; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=-894706358%7CMCMID%7C88302168321446056654240514095442262961%7CMCAAMLH-1553649086%7C6%7CMCAAMB-1553649086%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1553051486s%7CNONE%7CMCAID%7C2E48C99F05310321-40000191C000E2B0%7CvVersion%7C2.3.0; s_cc=true; aam_uuid=88531462596589170174219556101805620937; viewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e; utag_main=v_id:016998a729820014cad51407097800078006107000b08$_sn:1$_ss:0$_st:1553046086914$ses_id:1553044285827%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session; RT="sl=1&ss=1553044282770&tt=4190&obo=0&bcn=%2F%2F0211c814.akstat.io%2F&sh=1553044286967%3D1%3A0%3A4190&dm=zdnet.com&si=f2bd5cea-91f0-4820-af44-2676edf40ae1&ld=1553044286967"
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
484
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 20 Mar 2019 00:22:27 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:27 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
b309b15b-27a5-4605-b744-e2e919526019
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
set-cookie
ak_bmsc=31CA9ADD4DABB720A85D44CD953E3AAD0210BAB7CD7000003F93915CD24EDE30~plxudeqNQhrlpctJugYATtbwH6O55POR9jNrkDWUY/ltwHC5JkKyB4pbBpRP15E2O91EBa9JqxRzsFzmMTW9D/1xNtEkYBCqzKbOf/SAwzVIKhw8XsG5LA9lXt4uERdUO5cq4D8zANgDawtmDToWCKJ3fkgxaECcgVTjRk2ZcPEs1z0ZVok3T1PzvOXZ4efMWhpUBkILsGrkx4gDPPwR0x6UsPySCXkqg9RkVSytE3W4c=; expires=Wed, 20 Mar 2019 03:11:27 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 01:52:27 GMT
disqus-count-5922ea1c53-rev.js
zdnet2.cbsistatic.com/fly/js/components/ 		406 B
480 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/disqus-count-5922ea1c53-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Mon, 30 Jul 2018 16:42:34 GMT
server
nginx
etag
"5b5f3ffa-196"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
270
expires
Wed, 27 Mar 2019 01:11:27 GMT
cobalt-strike-servers-stats.png
zdnet2.cbsistatic.com/hub/i/2019/02/28/d00cd8dc-c356-4081-a5de-424fa5362d1f/7593ca1c455b17c952422c57c1aa467f/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/2019/02/28/d00cd8dc-c356-4081-a5de-424fa5362d1f/7593ca1c455b17c952422c57c1aa467f/cobalt-strike-servers-stats.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1e323dbeea0c9e92937c9569b5310027d4afa488b81906993a005ecf7ff9ca40

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"b237e7e6bada3f572c342dc4bbcda0d2"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=31134134, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
16910
controls-9423ff3b54-rev.css
zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/ 		41 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-9423ff3b54-rev.css
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f04be93e144932a277b3b79253acc171ea7bbb59460c33d2f4f07dcf684a6b14

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:28:05 GMT
server
nginx
etag
W/"5c9134b5-a561"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
6564
expires
Wed, 27 Mar 2019 01:11:27 GMT
image-gallery-modal-0495667ac9-rev.js
zdnet1.cbsistatic.com/fly/js/components/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/image-gallery-modal-0495667ac9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3905d3b0fd6276509a8eba066ad829e40dbbc02cc56d5b14eaa030323028ce3e

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Mon, 18 Feb 2019 12:17:05 GMT
server
nginx
etag
W/"5c6aa241-14d9"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1995
expires
Wed, 27 Mar 2019 01:11:27 GMT
05-ransomware.png
zdnet1.cbsistatic.com/hub/i/r/2018/12/08/64f3a47e-d4d8-4b20-a8ca-aeb34fa9e360/thumbnail/170x128/a1a3b05d52700821d92ba1316a366107/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/12/08/64f3a47e-d4d8-4b20-a8ca-aeb34fa9e360/thumbnail/170x128/a1a3b05d52700821d92ba1316a366107/05-ransomware.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e9671a96669a66f6cb6b8b0008ff3661d6cb18515c78ad68da5a60222283212a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"94f338fe2f7f9a84751deeefae6bcba2"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845100, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
15231
06-financial-crime.png
zdnet1.cbsistatic.com/hub/i/r/2018/12/08/054b33aa-33e4-4feb-99d0-828dbf0bbda5/thumbnail/170x128/e8b9eabef6805de54268cc6efe4e477f/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2018/12/08/054b33aa-33e4-4feb-99d0-828dbf0bbda5/thumbnail/170x128/e8b9eabef6805de54268cc6efe4e477f/06-financial-crime.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
748351ae61f6d52d56b073486ce980e0305e0df6b7a0866c7a129e636ecf835c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"f65d22c53bba4ccf77df86be93a43d5a"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845168, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
32413
07-cloud.png
zdnet3.cbsistatic.com/hub/i/r/2018/12/08/50fd4224-49bf-4f52-abcb-2e4b2f7b4735/thumbnail/170x128/91d7be77c917c15ec7d98637d5335101/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/12/08/50fd4224-49bf-4f52-abcb-2e4b2f7b4735/thumbnail/170x128/91d7be77c917c15ec7d98637d5335101/07-cloud.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c5ed40064116613618498a83645bf2064a2e8dc34948cf93005ff6d7863ea30a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"2d5b3be8503916af8d41e5add640b0b6"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845080, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
18459
08-email.png
zdnet3.cbsistatic.com/hub/i/r/2018/12/08/357cfe7d-e26c-4960-b85d-39c95e13f5a7/thumbnail/170x128/2377314cfa52dd71a6e13c4e6c37c43e/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2018/12/08/357cfe7d-e26c-4960-b85d-39c95e13f5a7/thumbnail/170x128/2377314cfa52dd71a6e13c4e6c37c43e/08-email.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e9a4d90f147ce964245ed1d4c52269e22b2e8be39d9c0d289ecbfc89cb5d0dec

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"4fa478df5573b6597248fd32f3200107"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845128, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
16122
09-cybercriminal-underground.png
zdnet4.cbsistatic.com/hub/i/r/2018/12/08/5af1bf25-ce87-4df4-9372-7f713c895022/thumbnail/170x128/dbd5e838586a622c1ec0cd13f4cef6ad/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2018/12/08/5af1bf25-ce87-4df4-9372-7f713c895022/thumbnail/170x128/dbd5e838586a622c1ec0cd13f4cef6ad/09-cybercriminal-underground.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fd58c72e2037127f17c2c3d0c53116c75eab402ae74b8a6fc415c79833fda846

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"13844d01d85a85bed47338e396b2aa3d"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=22845157, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
10334
cs.js
sb.scorecardresearch.com/c2/3005086/ 		0
400 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/c2/3005086/cs.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1775.js?utv=ut4.43.201902042326
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Fri, 08 Apr 2011 23:11:26 GMT
ETag
"d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=259200
Connection
keep-alive
Content-Length
20
Expires
Sat, 23 Mar 2019 01:11:27 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005086&ns__t=1553044287088&ns_c=UTF-8&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%2...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1553044287088&ns_c=UTF-8&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%...
0
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1553044287088&ns_c=UTF-8&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:27 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005086&ns__t=1553044287088&ns_c=UTF-8&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:27 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
/
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 		52 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_3xeBFJDuSs0SRW5&Q_LOC=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.277.js?utv=ut4.43.201902042326
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.206 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-206.deploy.static.akamaitechnologies.com
Software
/ Express
Resource Hash
091f22ee9132a45b69120f7c34c7f090f4e2694ab23267b34fb384ac6573ccfd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
access-control-allow-origin
*
x-powered-by
Express
etag
W/"d07a-JEOiz2B2/6C9STriKjC1xWUGPro"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
public, max-age=60, s-maxage=604800
strict-transport-security
max-age=31536000; includeSubDomains; preload
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
13148
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp=https%3A//t.co/00ebQBQ...
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp=https%3A//t.co/00ebQBQ...
44 B
332 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp=https%3A//t.co/00ebQBQ0nK&ts=compact&rnd=1553044287092&ja=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.255.169.159 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-169-159.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:27 GMT
server
nginx
access-control-allow-origin
*
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
200
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:27 GMT
server
nginx
access-control-allow-origin
*
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&si=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp=https%3A//t.co/00ebQBQ0nK&ts=compact&rnd=1553044287092&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
302
cache-control
no-cache
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
fbevents.js
connect.facebook.net/en_US/ 		52 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f007:8:face:b00c:0:1 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
6bb981959d783d83df88b9aa48738948c9a8a22c1a31b8cb5305d3e338ebf9a7
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
public
x-fb-debug
da2cQkzUTcuZPuTotc9uM5jSvW9fvhvM+h+OywPbNgT/ThavT6ZHV7Q0cxwSl17xKBhtUZY+JQOu/8pKRZbIag==
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 20 Mar 2019 01:11:27 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
strict-transport-security
max-age=31536000; preload; includeSubDomains
vary
Accept-Encoding
content-length
15216
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
disqus-loader-a1eab8131b-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		1 KB
725 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/disqus-loader-a1eab8131b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
a4d452555ef3c54319d8528439b6d27eea5e7cf579b89303b72a00e54c0dfbf5

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Wed, 06 Mar 2019 16:04:02 GMT
server
nginx
etag
W/"5c7fef72-458"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
521
expires
Wed, 27 Mar 2019 01:11:27 GMT
kaspersky.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/03/19/a24c7bc2-2208-42b8-9308-6d2f4e3fa87a/thumbnail/70x53/188ab58f62b5de760717074c35c17b71/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/03/19/a24c7bc2-2208-42b8-9308-6d2f4e3fa87a/thumbnail/70x53/188ab58f62b5de760717074c35c17b71/kaspersky.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
afd311dd346d987f9c1bd97d8d39dd49f68b3a19aa2e2844fc5e72bee545daa3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"a2cc63e065705fe938a4dda49092966f"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31529255, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
1596
sundar-pichai-stadia.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/03/19/6d606760-f345-4dfe-97e3-085bfa201948/thumbnail/70x53/8880004d05cd96c599a8fe65aaa5d63b/ 		995 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/03/19/6d606760-f345-4dfe-97e3-085bfa201948/thumbnail/70x53/8880004d05cd96c599a8fe65aaa5d63b/sundar-pichai-stadia.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fd9faddcffbc92c87f36ce5edea2e116bb7c228d4a0328c6104d42920c60e643

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"2bcab9d935d219641434683dd9d18a03"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31514771, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
957
pdf.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/03/19/619c176d-6ace-4ee4-a393-117c2bf22106/thumbnail/70x53/853568af6447a542931a02264f98b5bc/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/03/19/619c176d-6ace-4ee4-a393-117c2bf22106/thumbnail/70x53/853568af6447a542931a02264f98b5bc/pdf.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5b4f35da519cd7ef263aa48d3c0061acf643d692670412523a1166fe4d845845

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"b5c01503041b70d41d80e3dbe31bbd8c"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31508115, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
2200
aluminium.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/03/19/d33de407-7d5f-4c8c-ba92-4b04264647e9/thumbnail/70x53/9c024a143980d67192c657300f33bfb0/ 		955 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/03/19/d33de407-7d5f-4c8c-ba92-4b04264647e9/thumbnail/70x53/9c024a143980d67192c657300f33bfb0/aluminium.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8677698d257a0e229eee4cf3b6c40dfa04bf2d2057f0591f856b3af090b36a41

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"ef4e3b775c934dada217712d76f3d51f"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31489458, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
911
/
www.zdnet.com/newsletter/xhr/widget-login/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=security
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2e8a7f9a54c5cdcd46f59e055e6e2bd1f56e511fe958bf1b42a3dd1e351b53b9
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/newsletter/xhr/widget-login/?topic=security
pragma
no-cache
cookie
fly_device=desktop; nemo_highlander=ad_stack%3a1%3acontrol; fly_default_edition=eu; fly_preferred_edition=eu; fly_geo={"countryCode": "de"}; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22f%22%2C%22subSession%22%3A%226%22%7D; first_page_today=false; _ccmsi=1553044286071_735y9r83i|1553044286071; _ccmaid=5978151465408062634; LDCLGFbrowser=729ffe36-ddd1-4420-b951-3a9854c61bfa; XCLGFbrowser=BxabzFyRkz5icIhQVCI; s_vnum=1555636286519%26vn%3D1; s_invisit=true; s_getNewRepeat=1553044286520-New; s_lv_zdnet=1553044286520; s_lv_zdnet_s=First%20Visit; AMCVS_10D31225525FF5790A490D4D%40AdobeOrg=1; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=-894706358%7CMCMID%7C88302168321446056654240514095442262961%7CMCAAMLH-1553649086%7C6%7CMCAAMB-1553649086%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1553051486s%7CNONE%7CMCAID%7C2E48C99F05310321-40000191C000E2B0%7CvVersion%7C2.3.0; s_cc=true; aam_uuid=88531462596589170174219556101805620937; viewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e; utag_main=v_id:016998a729820014cad51407097800078006107000b08$_sn:1$_ss:0$_st:1553046086914$ses_id:1553044285827%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session; RT="sl=1&ss=1553044282770&tt=4190&obo=0&bcn=%2F%2F0211c814.akstat.io%2F&sh=1553044286967%3D1%3A0%3A4190&dm=zdnet.com&si=f2bd5cea-91f0-4820-af44-2676edf40ae1&ld=1553044286967"
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
729
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:27 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
26752e9c-973f-49fd-8306-e212e565c649
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
set-cookie
fly_session=avphdad5oht9ef41o1l45vnq53; path=/; domain=.zdnet.com; secure; HttpOnly ak_bmsc=E23E0B67FAA8E995193D3F398515B22F0210BAB7CD7000003F93915C3DF5E44C~plSgrSgIPvBEyo/Wv2aWFvJa2DAmjhd8rF6tzX+firDpGKUm6uT95hZln923xnbyyHbD2cGkFnvIUvzjSagxYqa5CSl1yLBbvTZf4ZMJuMumEPXlXOFfxtR1mZFl/bEXA9BcTevOgQhNOpqae6vo5TkSBfkge9iQrfdxDk1tUQmCXEg/aTLua0FQC56hWfs6J+FLIRywUYYKsbv353hhLe3O/lLIK+0WIFMsV9wgPa7Zc=; expires=Wed, 20 Mar 2019 03:11:27 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 01:11:27 GMT
front-door-carousel-56427878d9-rev.js
zdnet1.cbsistatic.com/fly/js/components/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet1.cbsistatic.com/fly/js/components/front-door-carousel-56427878d9-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Thu, 16 Aug 2018 13:35:07 GMT
server
nginx
etag
W/"5b757d8b-124a"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
cneonction
close
timing-allow-origin
*
content-length
1564
expires
Wed, 27 Mar 2019 01:11:27 GMT
urban-airship-29ae327ed0-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Wed, 29 Aug 2018 13:13:23 GMT
server
nginx
etag
W/"5b869bf3-514"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
827
expires
Wed, 27 Mar 2019 01:11:27 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		101 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=651165757893007&correlator=3046312428966066&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21062068%2C21063066%2C370204055&vrg=319&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-32&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=7x7%7C5x5%2C1x1%2C728x90%7C970x66%7C970x250%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x66%7C970x250%2C371x771&ists=64&prev_scp=pos%3Dnav%7C%7Cpos%3Dtop%7Cpos%3Dtop%7Cpos%3Dmiddle%7Cpos%3Dbottom%7Cpos%3Dbottom%7Cpos%3Dtop&eri=1&cust_params=test%3Dad_stack%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cservers%26pid%3Dcobalt%252Ckoss-cobalt%252Ctargus-strike%26tag%3Dcloud-security%252Ctarget%252Cmalware%26mfr%3Dcobalt-networks-inc%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%26env%3Dprod%26firstpg%3D1%26vguid%3D4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e%26session%3Df%26subses%3D6&cookie_enabled=1&bc=15&abxe=1&lmt=1553044287&dt=1553044287211&dlt=1553044284815&idt=889&frm=20&biw=1585&bih=1200&oid=3&adxs=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&adys=0%2C87%2C0%2C0%2C0%2C0%2C0%2C0&adks=2023318038%2C2445865130%2C2747284756%2C452850281%2C1204165017%2C3038593014%2C1775574267%2C2040766242&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&dssz=81&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x4420%7C1585x0%7C1585x0%7C370x0%7C370x0%7C370x250%7C1210x0%7C370x0&blev=1&bisch=1&ga_vid=666783898.1553044287&ga_sid=1553044287&ga_hid=1376354792&fws=128%2C4%2C128%2C128%2C128%2C128%2C128%2C128
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
b1306e0bddee25498a07d408621acee737c6ddf7b8a84079879481f0877668eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
13659
x-xss-protection
1; mode=block
google-lineitem-id
4745974454,-2,253246569,253246569,241984809,4745571990,241984809,4825966980
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239360681,-2,75374362809,75375443409,75375443409,138247985732,75374362809,138247024569
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_319.js
securepubads.g.doubleclick.net/gpt/ 		67 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
c11b9a046106f278a5fb5411e95c1ba5d6f06daf9e4bfa98da51c523e4157388
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 07 Mar 2019 16:13:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25393
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-32/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-32/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:815::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers
advertisement-d41d8cd98f-rev.js
zdnet2.cbsistatic.com/fly/js/utils/ 		0
178 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/js/utils/advertisement-d41d8cd98f-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
last-modified
Fri, 10 Aug 2018 18:33:06 GMT
server
nginx
etag
"5b6dda62-0"
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
0
expires
Wed, 27 Mar 2019 01:11:27 GMT
comscore.streaming.6.1.1.171219.min.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/comscore/ 		104 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/comscore/comscore.streaming.6.1.1.171219.min.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.122.133 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
age
963965
x-cache
HIT, HIT
status
200
x-cache-hits
2, 3075
content-length
18881
x-amz-id-2
iNMxzm/TCgHK9pS62vBa4WS9cdIY2RAk2iZ/4rvpCGyqBgvmIfhh/M1oP8g+QU4MesGXKPLqSuQ=
x-served-by
cache-dca17747-DCA, cache-cdg20773-CDG
last-modified
Fri, 21 Dec 2018 01:17:23 GMT
server
AmazonS3
x-timer
S1553044287.295675,VS0,VE0
etag
"c3c30c0ebfc35a9426296256fc3133d8"
vary
Accept-Encoding
x-amz-request-id
089711D8482F40CB
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
backend-origin
fastlyshield--shield_cache_dca17747_DCA
x-amz-meta-mtime
1522022400
headerstats
as-sec.casalemedia.com/ 		0
337 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/headerstats?s=182823&u=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/ls-zdnet.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.21 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-21.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:27 GMT
Server
Apache
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Wed, 20 Mar 2019 01:11:27 GMT
fly-disqus-count-1f604770a3-rev.js
zdnet2.cbsistatic.com/fly/js/components/ 		882 B
670 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet2.cbsistatic.com/fly/js/components/fly-disqus-count-1f604770a3-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Tue, 12 Mar 2019 17:29:14 GMT
server
nginx
etag
"5c87ec6a-372"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
460
expires
Wed, 27 Mar 2019 01:11:27 GMT
ima3.js
s0.2mdn.net/instream/html5/ 		242 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/html5/ima3.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:821::2006 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
a3fc1372b0b5633793c73f767e6e8c999f9f5ff9e3e6e0b412826ec1af74ef9b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
84786
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
config.json
c.go-mpulse.net/api/v2/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.go-mpulse.net/api/v2/config.json?key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&t=1553044287356&s=e7b5decb5e704071e4cd48af8579d1b68f11c03f03c3cd994f6627c558ebf2a7
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1248d29a870a1c2b43e881497a3c7d5046d2a1bd2784e3782fdee46d147edd67

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
800
ua-sdk.min.js
web-sdk.urbanairship.com/notify/v1/ 		78 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://web-sdk.urbanairship.com/notify/v1/ua-sdk.min.js
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/js/components/urban-airship-29ae327ed0-rev.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:197::e3d , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
UploadServer /
Resource Hash
7a1c6137f5ed3900e2b07d0c6785da9915da4e44dea8aabac8c3ddaad73b4ca2

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-goog-meta-goog-reserved-file-mtime
1552593996
status
200
x-guploader-uploadid
AEnB2UpwxoD5wimuB_oHSbEoRTZQLvfjOtF3Y7b2iLVC5rTSsLtEFghc7DmKaSdZ0p7j4Dn9Zcu2L32AO7FBrG-tDdNAHn1ynw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-length
16953
last-modified
Thu, 14 Mar 2019 20:06:38 GMT
server
UploadServer
etag
"a9fa052d127e29c685af6e9134f76d4a"
vary
Accept-Encoding
x-goog-hash
crc32c=bXT+Cw==, md5=qfoFLRJ+KcaFr26RNPdtSg==
x-goog-generation
1552593998397520
cache-control
public, max-age=300
x-goog-stored-content-length
79866
accept-ranges
bytes
content-type
application/x-javascript
expires
Wed, 20 Mar 2019 01:16:27 GMT
309391486091569
connect.facebook.net/signals/config/ 		186 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/309391486091569?v=2.8.42&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f007:8:face:b00c:0:1 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
61c7775dd53bf4483c287392a1194232ed17a29eeec5f64896c57ff53c5e66ef
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Origin, Accept-Encoding
content-length
45966
x-xss-protection
0
pragma
public
x-fb-debug
CBWuvb3I0NGoSG5qKNC4wxiQDWC4cvpDK69pLfAfQ6vZd1xz3ym+0meWpcP15EZBhIdOc9sZA9v1orpcfpSSZw==
date
Wed, 20 Mar 2019 01:11:27 GMT
x-frame-options
DENY
access-control-allow-methods
OPTIONS
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
https://connect.facebook.net
access-control-expose-headers
X-FB-Debug, X-Loader-Length
cache-control
public, max-age=1200
access-control-allow-credentials
true
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
show-hide-1.0-7dc26ff326-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		2 KB
914 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/show-hide-1.0-7dc26ff326-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Thu, 10 Jan 2019 17:52:02 GMT
server
nginx
etag
W/"5c378642-7a5"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
710
expires
Wed, 27 Mar 2019 01:11:27 GMT
4083-12969.js
www.everestjs.net/dl/4083/ 		484 B
655 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.everestjs.net/dl/4083/4083-12969.js
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.87.166 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-87-166.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Mon, 25 Nov 2013 14:23:10 GMT
Server
Apache
ETag
"4a5a49-1e4-4ec011a776f80"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=54442
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
288
Expires
Wed, 20 Mar 2019 16:18:49 GMT
v
pixel.everesttech.net/4083/ 		128 B
716 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.everesttech.net/4083/v?ev___loc=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ev___ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"9c38d7-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=994968
Content-Length
128
1x1
pixel.everesttech.net/
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WEpHVFB3QUFCYnNLUVh5ZA
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEPyOhBmVrldGBnOd0plA_GE&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"1433c2-80-53f3f17013d40"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=15, max=997163
Content-Length
128

Redirect headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://pixel.everesttech.net/1x1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
count.js
zdnet-1.disqus.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet-1.disqus.com/count.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
636210
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 11 Mar 2019 17:49:30 GMT
Server
nginx
ETag
"5c869faa-367"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
/
www.google.de/pagead/1p-user-list/1036174608/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&amp;guid=ON&amp;script=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=P5ORXIfGHpWq3g...
  • https://www.google.com/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1979428470&crd=&cdct=2&is_vtc=1&random=3360767035
  • https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1979428470&crd=&cdct=2&is_vtc=1&random=3360767035&ipr=y
42 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1979428470&crd=&cdct=2&is_vtc=1&random=3360767035&ipr=y
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:820::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:27 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:27 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/1036174608/?label=pXjaCJ6m6gcQkIqL7gM&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&random=1979428470&crd=&cdct=2&is_vtc=1&random=3360767035&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
ad.yieldmanager.com/ 		0
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.yieldmanager.com/pixel?id=2447099&t=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:110:833::4000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
X-Content-Type-Options
nosniff
Server
ATS
Age
0
Expect-CT
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security
max-age=31536000
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
s
pixel.everesttech.net/4083/ 		128 B
716 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.everesttech.net/4083/s?s=12969
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
66.117.28.68 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Last-Modified
Wed, 19 Oct 2016 22:11:25 GMT
Server
Apache
ETag
"9c38d7-80-53f3f17013d40"
Vary
Cookie
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control
no-cache
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=15, max=994967
Content-Length
128
/
www.facebook.com/tr/ 		44 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=309391486091569&ev=PageView&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&rl=https%3A%2F%2Ft.co%2F00ebQBQ0nK&if=false&ts=1553044287466&sw=1600&sh=1200&v=2.8.42&r=stable&a=tmtealium&ec=0&o=30&fbp=fb.1.1553044287465.473712036&it=1553044287374&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Wed, 20 Mar 2019 01:11:27 GMT
z
lightboxapi3.azurewebsites.net/z9p/40913/www.zdnet.com/jsonp/ 		441 B
727 B 		Script
General
Check archive.org
Download Go to
Full URL
https://lightboxapi3.azurewebsites.net/z9p/40913/www.zdnet.com/jsonp/z?cb=1553044287484&callback=jQuery17106550358415670661_1553044286208&_=1553044287486
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Kestrel / ASP.NET
Resource Hash
a42c55f8a0a47f3c876221eb7ed577c044f59ab90ed2395d592ce0f245d278b9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
Server
Kestrel
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript
mux.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/ 		70 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/mux.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.122.133 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3ae5d0f70dfeb1308462aaaa19d8326a6bd2d41781323b07db04cccffc09cf5f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
age
1392367
x-cache
HIT, HIT
status
200
x-cache-hits
1, 161
content-length
21978
x-amz-id-2
zgcnin+SB1JSc2io3/l4gBQl7XptJ+s5461pEByzZWAMIgE8OaFve7xpNhG06y2uXYsCdR5sinU=
x-served-by
cache-dca17724-DCA, cache-cdg20773-CDG
last-modified
Fri, 21 Dec 2018 01:16:38 GMT
server
AmazonS3
x-timer
S1553044288.529745,VS0,VE0
etag
"6ff5de35d5b5d1d667e341d5109a9c19"
vary
Accept-Encoding
x-amz-request-id
3312530A0732501B
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
backend-origin
fastlyshield--shield_cache_dca17724_DCA
x-amz-meta-mtime
1522022400
ggcmb510.js
cdn-gl.imrworldwide.com/novms/js/2/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.8.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-8-118.lhr62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
gB9SHtsGPCXzAHzgrpgYdBOQ7nMvfStz
content-encoding
gzip
last-modified
Tue, 05 Mar 2019 14:34:42 GMT
server
AmazonS3
age
6912
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Tue, 19 Mar 2019 23:20:57 GMT
x-amz-cf-id
SXVU_hwkTJH8VDkXssH3hIQqqeuE_DqMXPvXlYwDe4LeKdNJn8-I7w==
via
1.1 9f7475378931ebe64377681caa6a6ff0.cloudfront.net (CloudFront)
AppMeasurement-2.3.0.min.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.122.133 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
age
2231186
x-cache
HIT, HIT
status
200
x-cache-hits
4, 33
content-length
27260
x-amz-id-2
DygN9j4ptYlgqXZ3JEXmbvf/IJiVaaSANRd8iSR48wkkrUfnkNQ12kfiUTrb4fHqc/ZiJI5/jZE=
x-served-by
cache-dca17728-DCA, cache-cdg20773-CDG
last-modified
Fri, 21 Dec 2018 01:17:06 GMT
server
AmazonS3
x-timer
S1553044288.529917,VS0,VE0
etag
"d71ba6c9a930b6864408830c3e2705f9"
vary
Accept-Encoding
x-amz-request-id
183A5CA46654BB99
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
backend-origin
fastlyshield--shield_cache_dca17728_DCA
x-amz-meta-mtime
1522022400
VideoHeartbeat-2.0.2.min.js
vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/ 		143 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.122.133 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
age
2109720
x-cache
HIT, HIT
status
200
x-cache-hits
291, 315
content-length
28977
x-amz-id-2
uAHkLRUqvyPYpBOGFtCoQWy+0WxUklLdlnukwzmQvUaLz9TB3jwQzOE+6jiAWHtjcbX8R8ZK5w4=
x-served-by
cache-dca17764-DCA, cache-cdg20773-CDG
last-modified
Fri, 21 Dec 2018 01:17:07 GMT
server
AmazonS3
x-timer
S1553044288.529937,VS0,VE0
etag
"215943f0e77b4fcc9cc72b98a8ea1cfc"
vary
Accept-Encoding
x-amz-request-id
093DD98F40F36290
via
1.1 varnish, 1.1 varnish
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
application/javascript
x-amz-meta-mtime
1522022400
bcn
www.summerhamster.com/ 		43 B
181 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.summerhamster.com/bcn?fe=1553044287546&y=2.0.1105&elg=828158726&flg=68&x=zzz.cgqhw.frp%2Fduwlfoh%2Fyxoqhudelolwb-hasrvhv-orfdwlrq-ri-wkrxvdqgv-ri-pdozduh-f-f-vhuyhuv%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fxzlotmedw%2Fri%2Fgkwskj%2Fhngtvmsknb%2F%3Brug%3D1553044285325%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.36.177 Fairfield, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-3-122-36-177.eu-central-1.compute.amazonaws.com
Software
Jetty(9.2.10.v20150310) /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 20 Mar 2019 01:11:27 GMT
server
Jetty(9.2.10.v20150310)
access-control-allow-origin
*
content-length
43
access-control-allow-methods
*
content-type
image/gif
/
0211c814.akstat.io/ 		0
354 B 		Other
General
Check archive.org
Download Go to
Full URL
https://0211c814.akstat.io/
Requested by
Host: c.go-mpulse.net
URL: https://c.go-mpulse.net/boomerang/YZ2TK-PC7PJ-K64DL-L53CR-P2G4E
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 20 Mar 2019 01:11:27 GMT
truncated
/ 		2 KB
0 		Media
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7e9696aabfbb60803028b14636581f459404cea187d0c0c50b7d4d5cf8e1a3b1

Request headers

Response headers

Content-Type
video/mp4
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Response headers

Content-Type
image/png
truncated
/ 		715 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Response headers

Content-Type
image/png
glcfg510.js
cdn-gl.imrworldwide.com/novms/js/2/configs/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/ggcmb510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.8.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-8-118.lhr62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
C_jlH6EJFkwAH9m6jwG5pmUjxJCOeer7
content-encoding
gzip
last-modified
Tue, 05 Mar 2019 14:34:41 GMT
server
AmazonS3
age
6854
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Tue, 19 Mar 2019 23:20:15 GMT
x-amz-cf-id
ixOjFKgUPgDE5Ugtqx7qDNE6-7ncZwrNv2Y0KHbCPbmB-vVLxMmurw==
via
1.1 9f7475378931ebe64377681caa6a6ff0.cloudfront.net (CloudFront)
id
dpm.demdex.net/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=2.3.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=10D31225525FF5790A490D4D%40AdobeOrg&d_nsid=0&d_mid=88302168321446056654240514095442262961&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012E48C99F05310321-40000191C000E2B0&d_cid_ic=userId%01&d_cid_ic=puuid%01&ts=1553044287679
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/AppMeasurement-2.3.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.17.182.129 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-17-182-129.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
0dd91e59e964377d91851af0a2aa172c1c2832ffa3391b3f527421f90be7666c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v021-057842e9a.edge-irl1.demdex.com 5.49.0.20190304124312 9ms
Pragma
no-cache
Content-Encoding
gzip
X-Error
300,300
X-TID
LHO1fNEKRgs=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
752
Expires
Thu, 01 Jan 1970 00:00:00 GMT
bridge3.287.0_en.html
imasdk.googleapis.com/js/core/ Frame AF4D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.287.0_en.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
imasdk.googleapis.com
:scheme
https
:path
/js/core/bridge3.287.0_en.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
184181
date
Mon, 18 Mar 2019 18:44:39 GMT
expires
Tue, 17 Mar 2020 18:44:39 GMT
last-modified
Mon, 18 Mar 2019 18:38:07 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
1; mode=block
cache-control
public, max-age=31536000
age
109608
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
client.js
s0.2mdn.net/instream/video/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:821::2006 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10523
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
/
www.zdnet.com/m3d0s1/xhr/right-rail/ 		10 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/m3d0s1/xhr/right-rail/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bfdd00df7d044aee98ae6a057d826479041e36972d77e0190401d8cecf913358
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/m3d0s1/xhr/right-rail/
pragma
no-cache
cookie
fly_device=desktop; nemo_highlander=ad_stack%3a1%3acontrol; fly_default_edition=eu; fly_preferred_edition=eu; fly_geo={"countryCode": "de"}; zdnet_ad=%7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22f%22%2C%22subSession%22%3A%226%22%7D; first_page_today=false; _ccmsi=1553044286071_735y9r83i|1553044286071; _ccmaid=5978151465408062634; LDCLGFbrowser=729ffe36-ddd1-4420-b951-3a9854c61bfa; XCLGFbrowser=BxabzFyRkz5icIhQVCI; s_vnum=1555636286519%26vn%3D1; s_invisit=true; s_getNewRepeat=1553044286520-New; s_lv_zdnet=1553044286520; s_lv_zdnet_s=First%20Visit; AMCVS_10D31225525FF5790A490D4D%40AdobeOrg=1; AMCV_10D31225525FF5790A490D4D%40AdobeOrg=-894706358%7CMCMID%7C88302168321446056654240514095442262961%7CMCAAMLH-1553649086%7C6%7CMCAAMB-1553649086%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1553051486s%7CNONE%7CMCAID%7C2E48C99F05310321-40000191C000E2B0%7CvVersion%7C2.3.0; s_cc=true; aam_uuid=88531462596589170174219556101805620937; viewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e; utag_main=v_id:016998a729820014cad51407097800078006107000b08$_sn:1$_ss:0$_st:1553046086914$ses_id:1553044285827%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session; RT="sl=1&ss=1553044282770&tt=4190&obo=0&bcn=%2F%2F0211c814.akstat.io%2F&sh=1553044286967%3D1%3A0%3A4190&dm=zdnet.com&si=f2bd5cea-91f0-4820-af44-2676edf40ae1&ld=1553044286967"; _fbp=fb.1.1553044287465.473712036; fly_session=avphdad5oht9ef41o1l45vnq53; ak_bmsc=E23E0B67FAA8E995193D3F398515B22F0210BAB7CD7000003F93915C3DF5E44C~plSgrSgIPvBEyo/Wv2aWFvJa2DAmjhd8rF6tzX+firDpGKUm6uT95hZln923xnbyyHbD2cGkFnvIUvzjSagxYqa5CSl1yLBbvTZf4ZMJuMumEPXlXOFfxtR1mZFl/bEXA9BcTevOgQhNOpqae6vo5TkSBfkge9iQrfdxDk1tUQmCXEg/aTLua0FQC56hWfs6J+FLIRywUYYKsbv353hhLe3O/lLIK+0WIFMsV9wgPa7Zc=; adblock_status=not_adblocking; upid_855134808=1
origin
https://www.zdnet.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
content-length
435
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1535
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:28 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
6b486c27-cb3e-4d23-a25c-d52fb623adfd
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
set-cookie
bm_sv=10245B7D441A973BD5F1094B2AEEB0E2~NrmDLJek2ujkTJqz+6VH6Nw/5VDbjE0ueFzL82oDj9DOG//CJtryh7I3u9pZefqbiU/Ob1FMF53PbJ/vZ0gZFVeJRIqmTmYpRhi3lv9rVNC4spnz8YDm9zEzyPT7W58KSCss8mBtNZlTaOcVEJi+PCbhyJUcGs9TrZZeaDiLFUw=; Domain=.zdnet.com; Path=/; Max-Age=7199; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 01:11:28 GMT
default-se4908240cd.png
zdnet2.cbsistatic.com/fly/images/sprites/video/controls/1x/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/fly/images/sprites/video/controls/1x/default-se4908240cd.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
de4b8c1882f3c5f3e8d7ed920d1f4f31865ee05228fa7c60800656f3b279287d

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-9423ff3b54-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
last-modified
Wed, 20 Jun 2018 17:00:35 GMT
server
nginx
etag
W/"5b2a8833-1e14"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
7728
expires
Wed, 27 Mar 2019 01:11:27 GMT
loader.js
cdn.taboola.com/libtrc/cbsinteractive-zdnet/ 		228 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e884428110b94ddd472b35bd0a415fd5493ee5456631ee1a238ff3c3a9c57818

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
xcZWelzC7IB2_nFYxgZFwID4l0jxvuOM
content-encoding
gzip
age
109
x-cache
HIT
status
200
date
Wed, 20 Mar 2019 01:11:27 GMT
x-amz-replication-status
COMPLETED
content-length
23346
x-amz-id-2
HSn0CYbg4+Zt8XwxVEXA1DQcUYW8L3hzQoGOm32pS21PA2M9izQFko/ilUo3YNeoGM/KVCdandc=
x-served-by
cache-fra19172-FRA
last-modified
Mon, 18 Mar 2019 11:19:51 GMT
server
AmazonS3
x-timer
S1553044288.844208,VS0,VE1
etag
"817955ea07e9e561758c10b671fa2c15"
vary
Accept-Encoding
x-amz-request-id
5D0FF4D151769AF0
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
84
x-cache-hits
1
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 2C49 		77 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 2C49 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
osd.js
www.googletagservices.com/activeview/js/current/ 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27825
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
9818.js
ads.rubiconproject.com/ad/ Frame 9191 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=8220
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Wed, 20 Mar 2019 03:28:27 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 9191 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 9191 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
9818.js
ads.rubiconproject.com/ad/ Frame 3D33 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=8220
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Wed, 20 Mar 2019 03:28:27 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 3D33 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 3D33 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
9818.js
ads.rubiconproject.com/ad/ Frame C306 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=8220
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Wed, 20 Mar 2019 03:28:27 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame C306 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame C306 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 4955 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 4955 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
9818.js
ads.rubiconproject.com/ad/ Frame 282D 		26 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.rubiconproject.com/ad/9818.js
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache / PHP/5.3.3
Resource Hash
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Server
Apache
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=8220
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
7558
Expires
Wed, 20 Mar 2019 03:28:27 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 282D 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:27 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 282D 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:27 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50016
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
adKit.min.js
rev.cbsi.com/common/js/ Frame FD91 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rev.cbsi.com/common/js/adKit.min.js?1700670664
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
576e8bf4510a62d7cdcfedd8b749f3039d0c5aa8b2bdfe2e38a44645e0f982e4

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
last-modified
Mon, 07 Nov 2016 21:14:51 GMT
server
Apache
etag
"61acd092be7016e54f2dac81f3076225:1478553291"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
accept-ranges
bytes
content-length
2158
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame FD91 		77 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame FD91 		303 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50015
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
view
securepubads.g.doubleclick.net/pcs/ Frame 2C49 		0
72 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNnbvHI9xQaGBSBKXP2GssEWtBHF2E8WVjbr_-2q0P1tVeZmsQhZf0X0K9L7UpzV6zuD_MK7dZxA5_8bUP3PO-CRNC1tX_apXP-RQzzUPDFqX_6zAHNego4LB1aagMZExWTY8tWczg--Bt1tQnNQkLfgFERnw8yegEChacBfVnb3KLSvTuDIaF1i0uZ38Hg5mRozcsHQ4I6DFKLzYGqBkN3fjMevPcDXj9Rc1UzukdZM6sygNvVAdYDOdyuJxYeA&sai=AMfl-YTjbVbSgwzKOCjoWNbB6KwLQe7bxIOT6hImnRzjYNRsqxucsRrmuVJ-cd0XLWK-Zqz4jl0MdtFsU74nGBhX6v0fvAcuulRnogKNQyqyuqEpb_q1qdmYqxtmYdc0&sig=Cg0ArKJSzPOtsgPid7rXEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame 9191 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvip19o9w_rwDPRZDyXbzSBzUCI2j42ka9ojZ8hzaEBKDMb26iEX0rQb4p3I8NTrNV4lLadAwLR3I6K-6qT9dU7YoYrOmbQuNco6RqhQyofb8Z9gE6Y6S3DFfZe2jmv1L02KpFF-_YuM6AHG2c9WpzUISI9MGA-OHYpMBOuySpS5y2WfLhEdOVaYO314xOjXNpgLPtymCMyWurEXDYHGzs2kZ6ASuaK_RDF4GgfZNTq7teqybUYuRbVSAY-&sai=AMfl-YTQTHxK5c1TwI-L4wDI1oaMlIqFQxsGHBSSzYh5p_7ps8b0ApIPBljeCV3mxEfiHwMutseUZmCinbEy5jCWN8Zv7mP22fHvCOSdZJTX0JnZCg3V_RwT-LE7Q-NX&sig=Cg0ArKJSzPW8Tea0gCRvEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame 3D33 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuiRvATwhZGMXBaDk8may7AdG0AbUfAaNHj8IS8lrYWUw8VwaAvDcgAY9QM8cYn0odPMcZxZu5kWEonv46z3PoXT1kcO-eaAO--1RnfOgQkLFdhog-JOkhBz_6KfdOd1802n1IICKIidF6bHmH6aGh-GBKYYe-ZHsYgM9YhRP0Phe7Z5EUyh-lF6jpkP3xajqwGvoijCtkmqXzTp4W4XtqlM5kPOe-EMml_IOMfmj-nWPpgIM_rRzBbOltx&sai=AMfl-YRoyz0VS68ndm2YCYcNpdLLCfI12uDMDZ4uu-M-25Gvvmwe7w8hX05PsYE5JPbd0RoUpTaQ2pd4s2tnE510CdR8CDlsqYWmDFvUCY1fYTSO7AR5-SWq0s-lhIQ7&sig=Cg0ArKJSzG1KOsW6ubEqEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame C306 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuWZ3Tm2xKyKy_UpXk9E3iOlyhNxFYIskX_I_P0vfNTQ8P6wOl8RagVz8muMa0eM7viMT3TB7EjZ2NFGuxGSnkkt1_ggbNK35L9zGHxDqKrwfKu99w0PfoL40wJrg7MkkipaOqz4o3O494RNconjTD7J8cGmgbnoaF212212iOHFrIxdhoScZJZmRIhqORYsYvHtDLJp5WE1-Mq0t6fL1HFNaEcbThvinD4WreW09RIivAhWRO8o4yaAmjT&sai=AMfl-YRPGZIb-d0K89QYsK7bQDHUXYADBYyB3tXheTjpvy4KQK-POdPim4d9Ml80Xd-AHzgjTJ8mSH8vUCaWwYPrHqbhKtfhyOwY20Je1SumaP7dna-1PnLbr5e0ldcY&sig=Cg0ArKJSzLl9XDDjmcv6EAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame 4955 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZGaUkVxOX8rRO_xXnsXQYD2Ja7B4I8G089_IL28-xOzAxtl3roBiEBmJ7BLifz9ahOtaPeRdU-8-ys324hknCsK66wRwNQhsEm9qtvwzZg3mE4y76F9AXcXZrjLWzfwdgB0UxCy6DHOQW8rkoI4JjKj2rjzYF64-FNU3igkvxRm5Rz5ZS2iD8X2oYEHYo5tSGGx2qEQzv9vAgoFHOlBvmMYyZH16_sNOerTjXfflQPRYU02R7JzcjAMo7g6CZSg&sai=AMfl-YQevYDcsT8ZTdS3FPCeUYm4TDZ-xKjY2Fw-4BeoAvjcM5dUrgOIdUR4Hb9EixKhQ5uU1tVYPcZKc6U-rY11P2vZoCTdXLpTZYIFHtyPMGuKPMmADnPW2rdwgd6S&sig=Cg0ArKJSzNXpKQ16S_MEEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame 282D 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpPS8L1dO2_ELQF8UYgcdLyec-fEhmetZVeF120HSBj2H_2bV9Z-MT7WGVaAcgufZh-2fZP8nxO34w_8rn5cZgqGHR6EJRgC9OOJz_weQ9ZdGpmBiuBxhR6_fP73hA6UCeJYRbOJAk-X6muaJaDALmTDEjCwORZyUzRSZmUC0kAavgLIqrmF4yLR8BPe3sMU9lQk9PoSxYNKYnSjI8hBB-3nxcZhZvFKrKkO9pWSak608Oz91AUURPNLB_&sai=AMfl-YT2EJOOoe0rSMUAvl7Il239blDbTioUCfUbjAbsIUlXJiHGPuadxpcv08jHmfzcCNUojLs98_o1FmAhNiAvVEoFVZ6S3651m0DWNleCQRpeiqq4h07HieJqS5Ia&sig=Cg0ArKJSzJvS_SyKHKEhEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame FD91 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudxYG6X21eEEj0ZKzFVjnsjBC0Wi3svNJraqQozH3GPw40eowPkbOUep6ayDVUYgnMRlgmC2hKyunTt_nAWW7qDXk56lg4xDDkPYC3ajck33-g9gtp3WLsLUX5ePZdAMuRwzWxhOt5KTafGFpw-GAxky1Eai-MWo0xer6Z641hebAlOAOKBgOmdpwQJ0oEMf49GYM4e8qJZ-TVGlCcmVTOiV1PWDQfK1NgKxOyQxcqLDWGyDT652jzJAFGl5l9Jg&sai=AMfl-YTQrd_RY7f2YydF72iTzpcV9jIKKj6Auwb--oD_FsfZut0vZRHU7zZQ6nct3_56PMyMZqqgHylmlhDA6hFkx4ibo67GQcXFQgfI34JAikFJEgRUtZYpwh8_rY1Y&sig=Cg0ArKJSzB_BXRRApwaaEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
cdn-gl.imrworldwide.com/conf/ 		42 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/configs/glcfg510.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.8.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-8-118.lhr62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c6df1bf046eea1d51b9b30f72f87f5c6d13f4fea02b8efc48ac386557e8bb32a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
dtLkJxfn7CBQxvcIqNr_Irq47AvRMXxu
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 22:26:33 GMT
server
AmazonS3
age
2884
date
Wed, 20 Mar 2019 00:23:25 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400,s-maxage=86400
x-amz-cf-id
_ih2wG8zScGZE0ivAxZDur6bxXvcL-T9-wc3VvluMXueUiVcly7O3A==
via
1.1 9f7475378931ebe64377681caa6a6ff0.cloudfront.net (CloudFront)
283812-2.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 9191 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.3824910975594935&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.61 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
814fc328c94f6c4693c0d960425db2c2cda5c48ac07cd68248ef49483bb1a0a5

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=10
Content-Length
917
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 3D33 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.22378517257147967&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.61 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
8c0702ef2a629a8d6e4ce1ffd10791e9463ff2706bc57d0fdbb81b32de845fe7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=10
Content-Length
921
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-15.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame C306 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4666640234977637&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.61 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
ded5e33cf5c8a626dec0b35a3985aa37cbf5c23153fc32ec53aa81111c7e5109

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=10
Content-Length
920
Expires
Wed, 17 Sep 1975 21:32:10 GMT
283812-2.js
optimized-by.rubiconproject.com/a/9818/59604/ Frame 282D 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.11147696643936755&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Requested by
Host: ads.rubiconproject.com
URL: https://ads.rubiconproject.com/ad/9818.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.61 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
RAS 2.4 /
Resource Hash
a002d29c9492e0679d163afa2f2eb9828dfb00fe517bacdddfae7070e2fc04b3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Server
RAS 2.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Connection
Keep-Alive
Content-Type
text/javascript
Keep-Alive
timeout=0, max=10
Content-Length
918
Expires
Wed, 17 Sep 1975 21:32:10 GMT
0.8729840349669468
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 		43 B
615 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.8729840349669468?AQB=1&ce=UTF%2D8&events=event66&v0=ftag_cd:LGN22ef1e6&v2=en&v3=desktop&v4=right-rail&v5=zdnet&v10=article&v20=vulnerability+exposes+location+of+thousands+of+malware+c%26c+servers&v22=content_article&v23=&v24=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&v30=91a1429b-0d61-43fd-b421-a8b6e260e98c&v60=33165724,33165723,33165721&v64=2150&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201903201-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.37 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
cbsi.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
X-Content-Type-Options
nosniff
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Thu, 21 Mar 2019 01:11:28 GMT
Server
Omniture DC/2.0.0
xserver
www83
ETag
"3335137213186899968-5304221158323823072"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Tue, 19 Mar 2019 01:11:28 GMT
e.gif
dw.cbsi.com/levt/ria/ 		43 B
369 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=91a1429b-0d61-43fd-b421-a8b6e260e98c&assettitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&assettype=content_article&pubdate=2019-02-28%2018%3A26%3A07&viewguid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=91a1429b-0d61-43fd-b421-a8b6e260e98c&v16=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1553044288109&tcset=utf8&im=dsjs&title=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=956
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame FD91 		32 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: rev.cbsi.com
URL: https://rev.cbsi.com/common/js/adKit.min.js?1700670664
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
68661329a1cd69d6d40894a3531b37e648a4057832a3ab433afc6abd1d64d313
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"112 / 139 of 1000 / last-modified: 1553036242"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
10782
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
/
www.facebook.com/tr/ Frame F0B1 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
6579
pragma
no-cache
cache-control
no-cache
origin
https://www.zdnet.com
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
fr=0lbZ1JNdOFj7AvWZ3..BckZM_...1.0.BckZM_.
Origin
https://www.zdnet.com
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
content-type
text/plain
access-control-allow-origin
https://www.zdnet.com
access-control-allow-credentials
true
content-length
0
server
proxygen-bolt
date
Wed, 20 Mar 2019 01:11:28 GMT
nlsSDK600.bundle.min.js
cdn-gl.imrworldwide.com/novms/js/2/ 		154 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/PF7B87067-BF4D-F80F-E040-070AAD316CE6.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.8.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-8-118.lhr62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
69ab1a2de27af9982ac383ba968b31150b40465eee67ccd2cb540397dd372c14

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
.JOJbolsUKPAQzRqc25FG3kbf09NeIy8
content-encoding
gzip
last-modified
Tue, 05 Mar 2019 14:34:42 GMT
server
AmazonS3
age
56045
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=86400
date
Tue, 19 Mar 2019 23:19:39 GMT
x-amz-cf-id
RrbkNlzXGzbgnj4ShRaGmaKwsZhcCVbSl2_BJroj9KeiFU3DzsKuqA==
via
1.1 9f7475378931ebe64377681caa6a6ff0.cloudfront.net (CloudFront)
settings.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox/f0433f51-4cb3-432b-b2cb-f0c5b71cbf39/ 		43 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox/f0433f51-4cb3-432b-b2cb-f0c5b71cbf39/settings.js?cb=636885417983100100
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
94eda68ef465fcff5393659fd95ec043d732f3a7254fa695e4edfed349a4c94c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
gX0sae6W3d9/m4rYTtlnWA==
cf-polished
origSize=44150
status
200
x-ms-lease-status
unlocked
last-modified
Mon, 18 Mar 2019 21:36:38 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
c73e1a66-501e-001c-5ed2-dd8dd6000000
expires
Thu, 19 Mar 2020 01:11:28 GMT
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
4ba3cff18e44c2d3-FRA
cf-bgj
minify
lightbox_builder.js
www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/ Frame 8B1D 		199 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=636885417983100100
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcf58131ecb05e295093138b95f5bb6d7e0a26b8a3bdf6243184baa26371cade

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
br
cf-cache-status
HIT
content-md5
BndaaZzjyfF2Ccv8b7PgFw==
cf-polished
origSize=308526
status
200
x-ms-lease-status
unlocked
last-modified
Mon, 18 Mar 2019 21:36:38 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
x-ms-request-id
b6b34621-d01e-0024-49d2-ddcc8f000000
expires
Thu, 19 Mar 2020 01:11:28 GMT
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
4ba3cff19e5dc2d3-FRA
cf-bgj
minify
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Thu, 21 Mar 2019 01:11:28 GMT
load.js
widget.perfectmarket.com/cbsinteractive-zdnet/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.181 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
rwr9L97XovW8QPypI62jHvd7E2HiNZm2
content-encoding
gzip
age
18
x-cache
HIT, HIT
status
200
date
Wed, 20 Mar 2019 01:11:28 GMT
content-length
4742
x-amz-id-2
IeE9+nTLEpRap1NUvEiPbE+qQgMPeliAJb3YSmkiHcZXNknzshBkuokPJDiSswQryBLApcOaYnY=
x-served-by
cache-lax8630-LAX, cache-fra19126-FRA
last-modified
Thu, 20 Oct 2016 17:48:07 GMT
server
AmazonS3
x-timer
S1553044288.319734,VS0,VE0
etag
"fc0de48a0976cde02ddee0bd49a81832"
vary
Accept-Encoding,,
x-amz-request-id
47A0ED1AAAD0A94D
via
1.1 varnish, 1.1 varnish
cache-control
max-age=300
accept-ranges
bytes
content-type
binary/octet-stream
x-cache-hits
1, 1
impl.350-59-RELEASE.js
cdn.taboola.com/libtrc/ 		363 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.350-59-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f0a8ddb225b2c3387fec857e9281f571cb8d707045427179ca3403da280dd6ad

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
O7t6HDZvP8wgT2lO5coW1Sve6vF.C4cd
content-encoding
gzip
age
74
x-cache
HIT
status
200
date
Wed, 20 Mar 2019 01:11:28 GMT
x-amz-replication-status
PENDING
content-length
105345
x-amz-id-2
2yzZ91p45yavdcKbF1LMJV1CGRCwfyN8SUMJpGuLfM32MtWOyLMb+qTT148yrR603cIiGz9HmbU=
x-served-by
cache-fra19172-FRA
last-modified
Wed, 20 Mar 2019 01:10:10 GMT
server
AmazonS3
x-timer
S1553044288.272219,VS0,VE0
etag
"a0269dc4c9945f100058764b0d189b55"
vary
Accept-Encoding
x-amz-request-id
C2828A7C2A33D1FA
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
84
x-cache-hits
69
n.js
geo.moatads.com/ Frame 2C49 		107 B
371 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBnyBBBNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF7HfC7Kn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=0&qb=0&qi=0&qj=0&po=1-0020002000002100&qr=0&i=CBSDFPCW2&hp=1&cm=22&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044288295&de=983906044652&m=0&ar=93f2ca0-clean&q=2&cb=0&cu=1553044288295&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360681&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatDev=Desktop&zMoatSlotId=nav-ad&zMoatAType=content_article&zMoatTest=ad_stack%7C1%7Ccontrol&zMoatMMV_MAX=na&zMoatDfpSlotId=nav-ad-5c91933ba07ea&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-ad_stack%7C1%7Ccontrol&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=nav-ad&iq=na&tt=na&tu=&tp=&fs=159287&na=583281648&cs=0&callback=MoatSuperV26.gna918461
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.197.190 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-197-190.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
e624dffee1d0f645d4dc8a5bbf8b5df999a9536e4cf6583a4646997e4809d981

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Server
nginx/1.7.9
Etag
"8aa2a2316fe9569cf88deb121f6d4cec7c8a2714"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
n.js
geo.moatads.com/ 		104 B
368 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBnyBBBNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF7HfC7Kn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=0&qb=0&qi=0&qj=0&po=1-0020002000002100&qr=0&i=CBSDFPCW2&hp=1&cm=22&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044288295&de=983906044652&m=0&ar=93f2ca0-clean&q=3&cb=0&cu=1553044288295&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745974454%3A138239360681&zMoatPS=nav&zMoatPT=article&zMoatW=7&zMoatH=7&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatDev=Desktop&zMoatSlotId=nav-ad&zMoatAType=content_article&zMoatTest=ad_stack%7C1%7Ccontrol&zMoatMMV_MAX=na&zMoatDfpSlotId=nav-ad-5c91933ba07ea&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&bo=23605329&bp=23619609&bd=nav&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=7x7&zMoatSZPS=7x7%20%7C%20nav&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-ad_stack%7C1%7Ccontrol&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=nav-ad&iq=na&tt=na&tu=&tp=&fs=159287&na=914356367&cs=0&callback=MoatDataJsonpRequest
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.197.190 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-197-190.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
223e28eecc4a5536d595b32357b763fbccfefb9ddd1ca0aa94323e895984e8b3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Server
nginx/1.7.9
Etag
"6030647e3ce85d31f4e6b74a888d6234a6273cca"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
104
n.js
geo.moatads.com/ Frame 4955 		107 B
371 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBnyBBBNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF7HfC7Kn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=0&qb=0&qi=0&qj=0&po=1-0020002000002100&qr=0&i=CBSDFPCW2&hp=1&cm=17&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044288405&de=945525853402&m=0&ar=93f2ca0-clean&q=7&cb=0&cu=1553044288405&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4745571990%3A138247985732&zMoatPS=bottom&zMoatPT=article&zMoatW=300&zMoatH=250&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatDev=Desktop&zMoatSlotId=mpu-bottom&zMoatAType=content_article&zMoatTest=ad_stack%7C1%7Ccontrol&zMoatMMV_MAX=na&zMoatDfpSlotId=mpu-bottom-5c91933ba07ea&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&bo=23605329&bp=23619609&bd=bottom&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=300x250&zMoatSZPS=300x250%20%7C%20bottom&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-ad_stack%7C1%7Ccontrol&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=mpu-bottom&iq=na&tt=na&tu=&tp=&fs=159287&na=312765657&cs=0&callback=MoatSuperV26.gna386950
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.197.190 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-197-190.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
c8a6d6006718ee7a80977294992376112600b26c4661e984bccfeaed715fbcfd

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Server
nginx/1.7.9
Etag
"0bb61f8428150f3816e5812f5c5d0c8f11464b0c"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame C306 		64 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.4666640234977637&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
456887b6e9592979b8525ec06fb2b3a24de69ed0388001771d0ee02031bb9086
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25000
x-xss-protection
1; mode=block
server
cafe
etag
3757763389223287865
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
5a353984-0615-4ad0-bad0-fae9e395cd5f
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame C306 		43 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/5a353984-0615-4ad0-bad0-fae9e395cd5f?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563BDB09825453F9D64EEC12873C4F722EA82E0AABC36FA859084960F249B39B8D58A06A8364CE4B05D86EA04654B7DAB71913962D954BAC5EE62C7F7D6AF45A08783570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308EB2496EFCC5E65F1F5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.57 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:27 GMT
Cache-Control
private, max-age=0, no-cache
Expires
01 Jan 1970 10:00:00 GMT
Server
Rubicon Project
Content-Length
43
Content-Type
image/webp
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 9191 		64 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.3824910975594935&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
456887b6e9592979b8525ec06fb2b3a24de69ed0388001771d0ee02031bb9086
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25000
x-xss-protection
1; mode=block
server
cafe
etag
3757763389223287865
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
8dc4fe97-9dbb-47f3-9377-83de8fe33e9e
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame 9191 		43 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/8dc4fe97-9dbb-47f3-9377-83de8fe33e9e?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563B350FCB019B4C766F399048CE1795D65BC5690482A5C39DE5FA15E8952C006DAE6B822374D4301C4D6EA04654B7DAB7198AEBC26667B8F3D22C7F7D6AF45A08783570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308EB2496EFCC5E65F1F5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.57 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Cache-Control
private, max-age=0, no-cache
Expires
01 Jan 1970 10:00:00 GMT
Server
Rubicon Project
Content-Length
43
Content-Type
image/webp
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 3D33 		64 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-15.js?&cb=0.22378517257147967&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=59604_15&rp_secure=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
456887b6e9592979b8525ec06fb2b3a24de69ed0388001771d0ee02031bb9086
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25000
x-xss-protection
1; mode=block
server
cafe
etag
3757763389223287865
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
d5098658-ec4b-4f8d-b356-adb4e3d9a8c2
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame 3D33 		43 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/d5098658-ec4b-4f8d-b356-adb4e3d9a8c2?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=15&e=6A1E40E384DA563BF505A466A97B412106F2051D14D649BB02E8F0E43A501AB8A2330AC2697F7E954087DE680276868D6EA04654B7DAB71913962D954BAC5EE62C7F7D6AF45A08783570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308EB2496EFCC5E65F1F5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.57 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Cache-Control
private, max-age=0, no-cache
Expires
01 Jan 1970 10:00:00 GMT
Server
Rubicon Project
Content-Length
43
Content-Type
image/webp
show_ads.js
pagead2.googlesyndication.com/pagead/ Frame 282D 		64 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: optimized-by.rubiconproject.com
URL: https://optimized-by.rubiconproject.com/a/9818/59604/283812-2.js?&cb=0.11147696643936755&tk_st=1&rf=https%3A//www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=59604_2&rp_secure=1
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
456887b6e9592979b8525ec06fb2b3a24de69ed0388001771d0ee02031bb9086
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25000
x-xss-protection
1; mode=block
server
cafe
etag
3757763389223287865
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
0a7bff55-dc87-4480-bce5-3379b31099a3
beacon-eu-ams3.rubiconproject.com/beacon/d/ Frame 282D 		43 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon-eu-ams3.rubiconproject.com/beacon/d/0a7bff55-dc87-4480-bce5-3379b31099a3?oo=51&accountId=9818&siteId=59604&zoneId=283812&sizeId=2&e=6A1E40E384DA563B86759EE0D0B97D266E18A3A3DAB4F65DF9C333C607DFD7842831D96483F8DB263DCA6BE1B7E7B7C66EA04654B7DAB719EB7E390EBE2DF0042C7F7D6AF45A08783570ECD3831C9446AC237D6FA0EBFC9ADFFA16DC2C67B308EB2496EFCC5E65F1F5BE0B04AD33F58D33F8630F2FDB6069
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
213.19.162.57 , United Kingdom, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software
Rubicon Project /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Cache-Control
private, max-age=0, no-cache
Expires
01 Jan 1970 10:00:00 GMT
Server
Rubicon Project
Content-Length
43
Content-Type
image/webp
domains
api.viglink.com/api/ 		42 B
487 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.87.193 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
0670a9b776355524c521a3f31f3bcbaf8bfa71681c326be2915310b100f4eb1a

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame FD91 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame FD91 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_319.js
securepubads.g.doubleclick.net/gpt/ Frame FD91 		160 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
cf65e308f1c461e06038b45d5bfa27689e22241f6b673b7d540d35cdd0ca4c32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 07 Mar 2019 16:13:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
58724
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
b
sb.scorecardresearch.com/ 		0
248 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1553044288528&ns_c=UTF-8&cv=3.1e&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:28 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pmk-201618008.1.js
widget.perfectmarket.com/cbsinteractive-zdnet/ 		323 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.181 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
bVoOWfmxkMrYwv2s6Uu9D96fE._5IBqu
content-encoding
gzip
age
12748703
x-cache
HIT, HIT
status
200
date
Wed, 20 Mar 2019 01:11:28 GMT
content-length
91236
x-amz-id-2
T2A7wWXMDNgx2Z35EWhae8i8jDSVEo/Aqmbmta3HbEBKVMhwoZJKjGQuEf/CaAEiaINfKwR6uJs=
x-served-by
cache-lax8630-LAX, cache-fra19126-FRA
last-modified
Thu, 20 Oct 2016 17:47:53 GMT
server
AmazonS3
x-timer
S1553044289.535469,VS0,VE0
etag
"da73fb2066df9f51d08b6688cfb35441"
vary
Accept-Encoding,,
x-amz-request-id
58FF20717A687DE4
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31536000
accept-ranges
bytes
content-type
text/javascript
x-cache-hits
386, 9
ls.html
cdn-gl.imrworldwide.com/novms/html/ Frame CA03 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by
Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.8.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-8-118.lhr62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

:method
GET
:authority
cdn-gl.imrworldwide.com
:scheme
https
:path
/novms/html/ls.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
IMRID=f0a7e401-5db8-4142-8bba-b80c9a331167
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
content-type
text/html
last-modified
Tue, 05 Mar 2019 14:34:40 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
bFE_v0S8rJQmD6jK1O9nK5_UKwVOFfYf
server
AmazonS3
content-encoding
gzip
date
Tue, 19 Mar 2019 23:19:39 GMT
cache-control
max-age=86400
vary
Accept-Encoding
age
31309
x-cache
Hit from cloudfront
via
1.1 9f7475378931ebe64377681caa6a6ff0.cloudfront.net (CloudFront)
x-amz-cf-id
uackC4F59Gn62nXa0fdOaiGGqfZFGn0hr5jyHdG82bn_-MYupuOKQw==
integrator.js
adservice.google.de/adsid/ Frame C306 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame C306 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame C306 		68 B
193 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 19 Mar 2019 15:20:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
35431
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
88
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 03:20:57 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame C306 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame 5751 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190313/r20190131/ Frame F06E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20190313/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20190313/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Wed, 13 Mar 2019 13:22:44 GMT
expires
Wed, 27 Mar 2019 13:22:44 GMT
content-type
text/html; charset=UTF-8
etag
1255180509436287879
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6616
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
560924
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
usync.html
eus.rubiconproject.com/ Frame DECE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Thu, 07 Mar 2019 18:37:22 GMT
Content-Encoding
gzip
Content-Length
7419
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=49735
Expires
Wed, 20 Mar 2019 15:00:23 GMT
Date
Wed, 20 Mar 2019 01:11:28 GMT
Connection
keep-alive
Vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ Frame 9191 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame 9191 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame 9191 		68 B
145 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 19 Mar 2019 15:20:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
35431
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
88
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 03:20:57 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame 9191 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame E6CE 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
usync.html
eus.rubiconproject.com/ Frame 7C27 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Thu, 07 Mar 2019 18:37:22 GMT
Content-Encoding
gzip
Content-Length
7419
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=49735
Expires
Wed, 20 Mar 2019 15:00:23 GMT
Date
Wed, 20 Mar 2019 01:11:28 GMT
Connection
keep-alive
Vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ Frame 3D33 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame 3D33 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame 3D33 		68 B
145 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 19 Mar 2019 15:20:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
35431
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
88
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 03:20:57 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame 3D33 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame 0F3D 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
usync.html
eus.rubiconproject.com/ Frame 11AB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Thu, 07 Mar 2019 18:37:22 GMT
Content-Encoding
gzip
Content-Length
7419
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=49735
Expires
Wed, 20 Mar 2019 15:00:23 GMT
Date
Wed, 20 Mar 2019 01:11:28 GMT
Connection
keep-alive
Vary
Accept-Encoding
integrator.js
adservice.google.de/adsid/ Frame 282D 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:80b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame 282D 		109 B
171 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.zdnet.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
104
x-xss-protection
1; mode=block
ca-pub-1991679624331369.js
pagead2.googlesyndication.com/pub-config/r20160913/ Frame 282D 		68 B
145 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-1991679624331369.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 19 Mar 2019 15:20:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
age
35431
content-type
text/javascript
status
200
cache-control
public, max-age=43200
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
88
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 03:20:57 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame 282D 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/ Frame 9A57 		198 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
75582
x-xss-protection
1; mode=block
server
cafe
etag
12822828111139054337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Mar 2019 01:11:28 GMT
usync.html
eus.rubiconproject.com/ Frame 46D6 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.142 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-142.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
eus.rubiconproject.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified
Thu, 07 Mar 2019 18:37:22 GMT
Content-Encoding
gzip
Content-Length
7419
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=49735
Expires
Wed, 20 Mar 2019 15:00:23 GMT
Date
Wed, 20 Mar 2019 01:11:28 GMT
Connection
keep-alive
Vary
Accept-Encoding
gen_204
pagead2.googlesyndication.com/pagead/ 		0
58 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?vd=diff&oc=f&nc=f&oi=f&ni=f&custVid=157424995&lid=93&sdkv=h.3.287.0&id=ima_html5&c=3738375899697273&domain=www.zdnet.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:28 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
n.js
geo.moatads.com/ Frame FD91 		107 B
371 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=hBBnjB7GsBpBBBPY2CEBsCybBqw776Kqi7gBooCvBOCiCOB6sCqGBgiBBs0fW0glMfcxnBBBkB0BYBnyBBBNBmB0ziw7pCr6yC6rO24xXmYyBdfEC2BBBBBjzmBktCP97GBBBGwRmmEBBBBBBBBBBBnaBW35CeFaBBBpx0OFiBBBT5392tavKc5KCdzzFs7nBBBBBBBBRcQyRBBBCpjOBBBBBBBBBTLF7HfC7Kn7O0EYkCBB0IofRfBBPCxB7UBbjtBbBBC0dL9TRhq8K55G96Lo0eIRTzBiqeuSBBBBBB&iv=7&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=0&qb=0&qi=0&qj=0&po=1-0020002000002100&qr=0&i=CBSDFPCW2&hp=1&cm=21&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044288861&de=1500438432&m=0&ar=93f2ca0-clean&q=12&cb=0&cu=1553044288861&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=25477209%3A2356361194%3A4825966980%3A138247024569&zMoatPS=top&zMoatPT=article&zMoatW=371&zMoatH=771&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatSN=f&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatDev=Desktop&zMoatSlotId=dynamic-showcase-top&zMoatAType=content_article&zMoatTest=ad_stack%7C1%7Ccontrol&zMoatMMV_MAX=na&zMoatDfpSlotId=dynamic-showcase-top-5c91933ba07ea&qs=1&zGSRC=1&gu=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&bo=23605329&bp=23619609&bd=top&dfp=0%2C1&la=23619609&zMoatNotCnet=true&zMoatFT=Not%20Specified&zMoatSZ=371x771&zMoatSZPS=371x771%20%7C%20top&zMoatPTAT=article%20%7C%20content_article&zMoatPTATSECT=article%20%7C%20content_article&zMoatAB=content_article-ad_stack%7C1%7Ccontrol&zMoatOrigSlicer1=23605329&zMoatOrigSlicer2=23619609&gw=cbsdfp5832910442&fd=1&ac=1&it=500&tz=dynamic-showcase-top&iq=na&tt=na&tu=&tp=&fs=159287&na=1040971765&cs=0&callback=MoatSuperV26.gna122859
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.177.197.190 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-177-197-190.eu-west-2.compute.amazonaws.com
Software
nginx/1.7.9 /
Resource Hash
0c163d79b9c69d7c02c4bcc3e3bebea07c68aa6cd7de232146b4e128245afdb7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Server
nginx/1.7.9
Etag
"6742fe60669d9c662acba16fe289c1757e9e9781"
Content-Type
text/html; charset=UTF-8
Cache-Control
max-age=900
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
107
truncated
/ Frame C306 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b5d047c9cfeaab36c22d219ad63f1320ab177bdc3f5c7345daaac22f07c1d272

Request headers

Response headers

Content-Type
image/png
css
fonts.googleapis.com/ Frame 8B1D 		783 B
599 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/lightbox_builder.js?cb=636885417983100100
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
534f2f25f81301ecc9f48fb15f9e75088d334a1a9d3c0ea35757a9bc7519870f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 20 Mar 2019 01:11:29 GMT
server
ESF
access-control-allow-origin
*
date
Wed, 20 Mar 2019 01:11:29 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
count-data.js
zdnet-1.disqus.com/ 		243 B
768 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet-1.disqus.com/count-data.js?1=91a1429b-0d61-43fd-b421-a8b6e260e98c
Requested by
Host: zdnet-1.disqus.com
URL: https://zdnet-1.disqus.com/count.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
dcae6922d356bb058d143bc1268fb79266ab74e79933c947b592145920137de0
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:29 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Age
301
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Cache-Control
public, max-age=600
Connection
keep-alive
Content-Type
application/javascript; charset=UTF-8
Vary
Accept-Encoding
Content-Length
205
X-XSS-Protection
1; mode=block
truncated
/ Frame 9191 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0ec767ddd74f5a54aafc6e910cf2d9c21ffff23d64f0b4d92b559da26b76d5f7

Request headers

Response headers

Content-Type
image/png
truncated
/ Frame 3D33 		209 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
11c381a5cdea03b9d438c209b4e53197c4a2e67b9b243c472ef8a6a3a0478f15

Request headers

Response headers

Content-Type
image/png
truncated
/ Frame 282D 		209 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67f98d21d0b019006060e627133c9f47006581f42f84050c85b88095338d85f8

Request headers

Response headers

Content-Type
image/png
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=41&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289215&r=640112497193&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=middle&zMoatPT=article&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=41&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289215&r=640112497193&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=middle&zMoatPT=article&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=28&fi=1&apd=56&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289310&r=708825421243&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=28&fi=1&apd=56&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289310&r=708825421243&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=28&fi=1&apd=56&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289310&r=708825421243&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=19&fi=1&apd=38&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289389&r=785626344325&t=meas&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=19&fi=1&apd=38&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289389&r=785626344325&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=19&fi=1&apd=38&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289389&r=785626344325&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=45&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289475&r=508495888181&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=bottom&zMoatPT=article&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=45&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289475&r=508495888181&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=bottom&zMoatPT=article&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
fancybox_sprite.png
cdn.jsdelivr.net/fancybox/2.1.5/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.jsdelivr.net/fancybox/2.1.5/fancybox_sprite.png
Requested by
Host: www.lightboxcdn.com
URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
cf-ray
4ba3cff9fe8cbea8-FRA
x-cache
HIT, HIT
status
200
vary
Accept-Encoding
content-length
1362
x-served-by
cache-ams21050-AMS, cache-hhn1530-HHN
server
cloudflare
etag
W/"552-F98Z+XYo53vgnDUr8nQl+uokglE"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v12/ Frame 8B1D 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/raleway/v12/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::2003 , Ireland, ASN (),
Reverse DNS
Software
sffe /
Resource Hash
1c21dd409e977f176ae963b5510fbdd57669e9861fff9f5d9a46b6fc73f430fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Raleway
Origin
https://www.zdnet.com

Response headers

date
Sat, 09 Mar 2019 03:30:30 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 18:25:45 GMT
server
sffe
age
942059
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
13160
x-xss-protection
1; mode=block
expires
Sun, 08 Mar 2020 03:30:30 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame FD91 		28 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2441955255668068&correlator=2662729269245366&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21063235%2C21062833%2C21062854%2C21062887%2C21063065%2C21063203&vrg=319&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-32&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=372x142%2C372x142&prev_scp=env%3Dprod%26session%3Df%26subses%3D6%26ptype%3Darticle%26vguid%3D4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e%7Cenv%3Dprod%26session%3Df%26subses%3D6%26ptype%3Darticle%26vguid%3D4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&cookie_enabled=1&cdm=www.zdnet.com&bc=15&lmt=1553044289&dt=1553044289607&dlt=1553044287947&idt=1628&frm=23&biw=1585&bih=1200&isw=371&ish=771&oid=3&adxs=0%2C0&adys=0%2C0&adks=3261246841%2C3261246840&ucis=qu67vsxg12an%7Csu5aghcrbd1v&ifi=1&ifk=1302591731&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&top=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&dssz=16&icsg=43552&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0%7C0x0&msz=0x0%7C0x0&blev=1&bisch=1&ga_vid=270234477.1553044290&ga_sid=1553044290&ga_hid=1626853677&fws=384%2C384
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
3e75b859bf35abaddc889d6b4ffdb4582b01a66bdceef816b57043b477e85cbc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
6996
x-xss-protection
1; mode=block
google-lineitem-id
4746066197,4746066197
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138239468731,138239375180
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_319.js
securepubads.g.doubleclick.net/gpt/ Frame FD91 		67 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
sffe /
Resource Hash
c11b9a046106f278a5fb5411e95c1ba5d6f06daf9e4bfa98da51c523e4157388
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 07 Mar 2019 16:13:36 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
25393
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-32/html/ Frame FD91 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-32/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:815::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers
ads
googleads.g.doubleclick.net/pagead/ Frame 537A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151321&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288638&bpp=56&bdt=769&fdt=1093&idt=1090&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=2&ga_vid=432472175.1553044290&ga_sid=1553044290&ga_hid=418746276&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1465&biw=1585&bih=1200&isw=300&ish=250&ifk=2401019456&scr_x=0&scr_y=0&eid=21060853%2C21061796&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=3832671437&ifi=1&uci=1.nzxmt4mejbj&fsb=1&dtd=1130
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151321&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288638&bpp=56&bdt=769&fdt=1093&idt=1090&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=2&ga_vid=432472175.1553044290&ga_sid=1553044290&ga_hid=418746276&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=1465&biw=1585&bih=1200&isw=300&ish=250&ifk=2401019456&scr_x=0&scr_y=0&eid=21060853%2C21061796&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=3832671437&ifi=1&uci=1.nzxmt4mejbj&fsb=1&dtd=1130
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUmaDbFNEm4s-VPa1ZaHQSC5jhCVdNTZJvoH5pAGj49HJVCm7KIZ3bduyPrG
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Mar 2019 01:11:29 GMT
server
cafe
content-length
46
x-xss-protection
1; mode=block
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
osd.js
www.googletagservices.com/activeview/js/current/ Frame C306 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27825
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 03BB 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=3772584338&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288702&bpp=37&bdt=863&fdt=1087&idt=1086&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=1&ga_vid=100367113.1553044290&ga_sid=1553044290&ga_hid=1296761769&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=1766732152&scr_x=0&scr_y=0&eid=21060853%2C410075102&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=4066913089&ifi=1&uci=1.j57g26fghydl&fsb=1&dtd=1098
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=3772584338&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288702&bpp=37&bdt=863&fdt=1087&idt=1086&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=1&ga_vid=100367113.1553044290&ga_sid=1553044290&ga_hid=1296761769&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=393&biw=1585&bih=1200&isw=728&ish=90&ifk=1766732152&scr_x=0&scr_y=0&eid=21060853%2C410075102&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=4066913089&ifi=1&uci=1.j57g26fghydl&fsb=1&dtd=1098
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUmaDbFNEm4s-VPa1ZaHQSC5jhCVdNTZJvoH5pAGj49HJVCm7KIZ3bduyPrG
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Mar 2019 01:11:30 GMT
server
cafe
content-length
17985
x-xss-protection
1; mode=block
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 9191 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27825
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 7AE9 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151320&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288742&bpp=17&bdt=881&fdt=1083&idt=1082&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&rume=1&frm=23&ife=5&pv=1&ga_vid=1970858110.1553044290&ga_sid=1553044290&ga_hid=52532568&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=2537108585&scr_x=0&scr_y=0&eid=21060549%2C21060853&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=3832671437&ifi=1&uci=1.3geg2q2mbwuw&fsb=1&dtd=1095
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=250&slotname=8385808081&adk=1919950094&adf=4077151320&w=300&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288742&bpp=17&bdt=881&fdt=1083&idt=1082&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&rume=1&frm=23&ife=5&pv=1&ga_vid=1970858110.1553044290&ga_sid=1553044290&ga_hid=52532568&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1043&ady=513&biw=1585&bih=1200&isw=300&ish=250&ifk=2537108585&scr_x=0&scr_y=0&eid=21060549%2C21060853&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=3832671437&ifi=1&uci=1.3geg2q2mbwuw&fsb=1&dtd=1095
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUmaDbFNEm4s-VPa1ZaHQSC5jhCVdNTZJvoH5pAGj49HJVCm7KIZ3bduyPrG
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Mar 2019 01:11:30 GMT
server
cafe
content-length
46
x-xss-protection
1; mode=block
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 3D33 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27825
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=644&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289215&r=640112497193&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=middle&zMoatPT=article&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 3F8E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151327&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288763&bpp=22&bdt=868&fdt=1111&idt=1110&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=1&ga_vid=664999439.1553044290&ga_sid=1553044290&ga_hid=1895982299&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=4294&biw=1585&bih=1200&isw=728&ish=90&ifk=3834625986&scr_x=0&scr_y=0&eid=21060853&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CopeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=4066913089&ifi=1&uci=1.dzti3j4786wv&fsb=1&dtd=1118
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:820::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-1991679624331369&output=html&h=90&slotname=3084619100&adk=3828543735&adf=4077151327&w=728&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ea=0&flash=0&wgl=1&adsid=NT&dt=1553044288763&bpp=22&bdt=868&fdt=1111&idt=1110&shv=r20190313&cbv=r20190131&saldr=sa&correlator=126386173524&frm=23&ife=5&pv=1&ga_vid=664999439.1553044290&ga_sid=1553044290&ga_hid=1895982299&ga_fc=0&iag=3&icsg=43368&nhd=1&dssz=18&mdo=0&mso=1&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=429&ady=4294&biw=1585&bih=1200&isw=728&ish=90&ifk=3834625986&scr_x=0&scr_y=0&eid=21060853&oid=3&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&rx=0&eae=2&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CopeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=20&bc=15&osw_key=4066913089&ifi=1&uci=1.dzti3j4786wv&fsb=1&dtd=1118
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
cookie
IDE=AHWqTUmaDbFNEm4s-VPa1ZaHQSC5jhCVdNTZJvoH5pAGj49HJVCm7KIZ3bduyPrG
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 20 Mar 2019 01:11:30 GMT
server
cafe
content-length
46
x-xss-protection
1; mode=block
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
osd.js
www.googletagservices.com/activeview/js/current/ Frame 282D 		75 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190313/r20190131/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27825
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=611&fi=1&apd=639&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289310&r=708825421243&t=hdn&os=1&fi2=0&div1=0&ait=292&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:29 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:29 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=559&fi=1&apd=578&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289389&r=785626344325&t=hdn&os=1&fi2=0&div1=0&ait=270&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=4&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:30 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:30 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=513&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=241984809&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289475&r=508495888181&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=bottom&zMoatPT=article&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:30 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:30 GMT
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=01%3A11%3A30.021&data=%7B%22id%22%3A812%2C%22ii%22%3A%22%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1553044290013%2C%22cv%22%3A%22350-59-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22e%22%3A%22https%3A%2F%2Ft.co%2F00ebQBQ0nK%22%2C%22bad%22%3A-1%2C%22bw%22%3A1600%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A8%2C%22uim%22%3A%22alternating-thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETarticleDesktop%2FTablet-Below%20Article%20Thumbnails%22%2C%22cd%22%3A4178.921875%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22normal%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.350-59-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
ccc8f0213349ee58951a6ee6c63443f9f70b9787f3357ef952105e6e253da655

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:30 GMT
content-encoding
gzip
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
via
1.1 varnish
x-served-by
cache-fra19172-FRA
server
nginx
x-timer
S1553044290.068300,VS0,VE123
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
5074
date
Tue, 19 Mar 2019 23:46:56 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17543
expires
Wed, 20 Mar 2019 01:46:56 GMT
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:30 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
902
Expires
Thu, 21 Mar 2019 01:11:30 GMT
/
inqlnfvog763mmf771rou737u.litix.io/ 		0
247 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.66.75 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-199-66-75.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://www.zdnet.com
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:11:30 GMT
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type
Content-Length
0
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
POST, GET
t.gif
www.lightboxcdn.com/z9g/ 		35 B
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.lightboxcdn.com/z9g/t.gif?c=1553044290437&h=www.zdnet.com&e=i&u=40913&b=178719&v=empty&s=empty
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Mar 2019 01:11:30 GMT
cf-cache-status
HIT
content-md5
KNaBTzCeoon4R8ac+RGUxg==
cf-polished
status=not_needed
x-ms-meta-cbmodifiedtime
Tue, 26 Feb 2019 00:59:40 GMT
status
200
content-length
35
x-ms-lease-status
unlocked
last-modified
Tue, 26 Feb 2019 01:15:02 GMT
server
cloudflare
etag
0x8D69B87D5A1B25F
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
x-ms-request-id
7e3e704a-501e-0118-4275-cd3e01000000
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
4ba3cfff5d8fc2d3-FRA
cf-bgj
imgq:85
z
lightboxapi2.azurewebsites.net/z9d/40913/178719/empty/empty/www.zdnet.com/img/ 		0
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lightboxapi2.azurewebsites.net/z9d/40913/178719/empty/empty/www.zdnet.com/img/z?cb=1553044290438
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.99.128.52 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
waws-prod-dm1-001.cloudapp.net
Software
Kestrel / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:30 GMT
X-Powered-By
ASP.NET
Server
Kestrel
tboptevent.html
widget.perfectmarket.com/opt/ Frame 5301 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.181 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22a%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Wed, 20 Mar 2019 01:11:30 GMT
via
1.1 varnish
x-served-by
cache-fra19126-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1553044291.563445,VS0,VE0
content-length
0
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=639&tet=1174&fi=1&apd=1202&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75374362809&S1id=23605329&S2id=23619609&ord=1553044289310&r=708825421243&t=iv&os=1&fi2=0&div1=1&ait=855&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:30 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:30 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=578&tet=1126&fi=1&apd=1145&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=zdnet.com&L1id=25299489&L2id=251370729&L3id=253246569&L4id=75375443409&S1id=23605329&S2id=23619609&ord=1553044289389&r=785626344325&t=iv&os=1&fi2=0&div1=1&ait=837&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=5&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:30 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:30 GMT
/
5f651e6f.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://5f651e6f.akstat.io/?h.pg=article&h.ab=ad_stack_control_1&when=1553044290373&cdim.Site_View=desktop&t_other=custom3%7C2669&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=157cf5af2a2a5cb78b7de4959e567960f1b6ab2f&h.t=1553044287368&http.initiator=api&rt.start=api&rt.si=f2bd5cea-91f0-4820-af44-2676edf40ae1&rt.ss=1553044290397&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:30 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 20 Mar 2019 01:11:30 GMT
OAS_Countdown_EG_5_700.webm
cbsadsales-a.akamaihd.net/Q1/ 		434 KB
434 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cbsadsales-a.akamaihd.net/Q1/OAS_Countdown_EG_5_700.webm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.10 , European Union, ASN (),
Reverse DNS
a2-16-186-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
99d71bfbd5b10b27442706ec707c0bb51976a9a43ee3ab6bf5d7888d4230e19c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

Date
Wed, 20 Mar 2019 01:11:30 GMT
Last-Modified
Fri, 08 Jun 2018 13:32:14 GMT
Server
Apache
ETag
"d3f484c3ea0c4a83874bef9fb13504ff:1528464734"
Content-Type
video/webm
Content-Range
bytes 0-444471/444472
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
444472
csi
csi.gstatic.com/ 		0
202 B 		Other
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~jtgigzum&c=126386173524&met.4=hvd_lc.jtgigzum~hvd_nd.jtgigzun~hvd_src.jtgigzun
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/instream/html5/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4002:c0c::5e , United States, ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:30 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
204
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 593C 		77 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 593C 		303 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50015
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
osd.js
www.googletagservices.com/activeview/js/current/ Frame FD91 		75 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 20 Mar 2019 01:11:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
27825
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:29 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame EFEF 		77 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame EFEF 		303 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50015
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
view
securepubads.g.doubleclick.net/pcs/ Frame 593C 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuMoJ_HnOHOSMtlM3BXCHbcMPyy0Mo9C-M5YrEOzQXblZ5XMjc0FsOpx0PctZ3x0UDiFSi3w9dks1XKVTHICCE8MOXSmDwPYH6Jl9GzNIRid2ktz5egec45s6qDzAWABgBWJYEmFaA_Byi_dVm7Zr82HD1l4ukI9KWqJlZRm2oaHVgV5Nc5_TQrnmYm3WshK1LKNcetJlgYpn2hKnj4noghUM1LquO6NqWfpCUnG0qpBUzwQMmKMfKBbGkHh7jP-A&sai=AMfl-YQUgmOf3BkSf45FMcLG5bEgumDdaR2msX7_jo7JTur67RoXAKa9X6Wn7Uwc6HfLKleb6L_hzpp7eQN1azp7Jgc9zLtE_Pjy8oufeyRbf-F6-Cd82E66nm9ue2I&sig=Cg0ArKJSzPd41Lw0EzhrEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:30 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
view
securepubads.g.doubleclick.net/pcs/ Frame EFEF 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuAkkckdHxLOktt2-8pmQvlpWJOoJ-3fq-pohuAIhO6lVBAy9nfJz0TAbpyQWaemyQyYl1QWsBXrRdD0HsiL1Tn7nk1-XhwIBlSar-na3egRRCQ6agMdNo4fDkNWirfa8X_TmNkZLKXrg0UL-OCQNQeQiGLM6Fh3lpLcGCNz6n4bN7Fpsye0d-C7c6QFF_-2-XdAnMINWMhBgqbAhrXP5b_KYbMzBB8fTdZPCQMk_z4B2RX0QXaJjTCPTIuqsQptQ&sai=AMfl-YQE8dth5rDc2VbrBl4SiHTYfNyGvEqn2hfCPPyvvTDIN8WNoiL0Ya41oTR2F0kR45pP3H9OEzdAq3zIVR3Y0L9s0QM06XaThmqleznxQXMjqBwHrGmZroQhbhk&sig=Cg0ArKJSzBJG5xjyRd_HEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:30 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
userx.350-59-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.350-59-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/cbsinteractive-zdnet/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
07a169c5ae41e3b924a062f69afdd51c9873fa22d3929f0d90545091df166d44

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
.AdTBuBKD7oWecUadvLdu8.rqNVEQ_gS
content-encoding
gzip
age
46
x-cache
HIT
status
200
date
Wed, 20 Mar 2019 01:11:30 GMT
x-amz-replication-status
COMPLETED
content-length
7623
x-amz-id-2
7fSObLFNffOBm2/iD8+AgLpyvgHaKfN46c6avbjCyYI9iQQV9NnW34dRd/UAWs4bDa0iigde3ZY=
x-served-by
cache-fra19172-FRA
last-modified
Wed, 20 Mar 2019 01:05:42 GMT
server
AmazonS3
x-timer
S1553044291.879994,VS0,VE0
etag
"31478d5d95e5e5c550cb1dda05d9d6df"
vary
Accept-Encoding
x-amz-request-id
E70DAD5914A3CD3B
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
59
x-cache-hits
18
collect
www.google-analytics.com/r/ 		35 B
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j73&aip=1&a=1376354792&t=pageview&_s=1&dl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&dr=https%3A%2F%2Ft.co%2F00ebQBQ0nK&ul=en-us&de=UTF-8&dt=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YAhAAEAB~&jid=1205347879&gjid=853693575&cid=666783898.1553044287&tid=UA-33613588-22&_gid=843951799.1553044291&_r=1&cd2=other&z=840149917
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN (),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 9191 		42 B
115 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvavig0_MzDlMJuO9t4UC4RlSoXgnc6lpXP2WqkBANbEIRt3zsWuEr2G_jKKak7yaCDRWWITqn10J88fIYkoVb1ap7YqQbIbr9XvfY&sig=Cg0ArKJSzD0QCpNI78adEAE&adk=2747284756&tt=2298&bs=1585%2C1200&mtos=1032,1032,1032,1032,1032&tos=1032,0,0,0,0&p=393,429,483,1157&mcvt=1032&rs=3&ht=0&tfs=1288&tls=2320&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1553044287848&rpt=1460&isd=0&msd=0&lm=2&aio_mode=1&oseid=3&xdi=0&ps=1585%2C4709&ss=1600%2C1200&pt=24&deb=1-7-7-14-7-24-66-5&tvt=2306&r=v&id=osdim&vs=4&uc=4&upc=0&tgt=DIV&cl=1&cec=14&clc=1&cac=0&cd=728x90&v=20190313
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 3D33 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvn2zHlltZWmKJ0E70pVp0WubwYr9hPqZOxiXVl3E5JFL6seICgFVr_2C_ZGBCDTiF7yB-b6lux3CBrGOBZ28hRIo1Gvj0j_0iRLbo&sig=Cg0ArKJSzDq0cIxZC9fZEAE&adk=452850281&tt=2298&bs=1585%2C1200&mtos=1032,1032,1032,1032,1032&tos=1032,0,0,0,0&p=513,1043,763,1343&mcvt=1032&rs=3&ht=0&tfs=1288&tls=2320&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1553044287867&rpt=1520&isd=0&msd=0&lm=2&aio_mode=1&oseid=3&xdi=0&ps=1585%2C4709&ss=1600%2C1200&pt=24&deb=1-7-7-14-7-24-66-5&tvt=2306&r=v&id=osdim&vs=4&uc=4&upc=0&tgt=DIV&cl=1&cec=14&clc=1&cac=0&cd=300x250&v=20190313
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
inqlnfvog763mmf771rou737u.litix.io/ 		43 B
349 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.66.75 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-199-66-75.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:31 GMT
Access-Control-Allow-Methods
POST, GET
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 		0
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?ri=fb5bfe41c0d51eecab8feca5666b9889&sd=v2_f635b19b611a3c141d55ab9e00c8dbe0_b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2_1553044290_1553044290_CGoQzro_GN3znMWZLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&ui=b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2&pi=/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers&wi=-4406134052192222584&pt=text&vi=1553044290013&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A2%2C%22m%22%3A%22stp%22%7D%2C%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%22%2C%22rref%22%3A%22https%3A%2F%2Ft.co%2F00ebQBQ0nK%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22%22%2C%22sec%22%3A%22%22%2C%22aut%22%3A%22%22%2C%22img%22%3A%22%22%2C%22v%22%3A13%7D%5D%7D&tim=01%3A11%3A31.266&id=5264&llvl=1&cv=350-59-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
server
nginx
x-timer
S1553044291.267579,VS0,VE8
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
cache-control
no-cache
access-control-allow-credentials
true
x-cache-hits
0
accept-ranges
bytes
content-type
image/gif
access-control-allow-origin
*
x-served-by
cache-fra19172-FRA
social
trc.taboola.com/cbsinteractive-zdnet/log/3/ 		0
195 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/social?ri=fb5bfe41c0d51eecab8feca5666b9889&sd=v2_f635b19b611a3c141d55ab9e00c8dbe0_b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2_1553044290_1553044290_CGoQzro_GN3znMWZLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA&ui=b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2&pi=/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers&wi=-4406134052192222584&pt=text&vi=1553044290013&st=social-visible&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-share%22%2C%22nm%22%3A%22facebook%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A362%2C%22ly%22%3A518%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%2C%7B%22i%22%3A%22w%22%2C%22tp%22%3A%22custom-link%22%2C%22nm%22%3A%22twitter%22%2C%22c%22%3A1%2C%22ln%22%3A%22above-fold%22%2C%22lx%22%3A670%2C%22ly%22%3A518%2C%22m%22%3A%22stp%22%2C%22v%22%3A3%7D%5D%7D&tim=01%3A11%3A31.266&id=2953&llvl=1&cv=350-59-RELEASE&
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
server
nginx
x-timer
S1553044291.268611,VS0,VE8
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
204
cache-control
no-cache
access-control-allow-credentials
true
x-cache-hits
0
accept-ranges
bytes
content-type
image/gif
access-control-allow-origin
*
x-served-by
cache-fra19172-FRA
available
trc.taboola.com/cbsinteractive-zdnet/log/3/ 		0
81 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.350-59-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
server
nginx
x-timer
S1553044291.278278,VS0,VE9
x-served-by
cache-fra19172-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c4b985401a0cb64b9e88935039dbfebd88c276c78603f1ff0b09288008afca20

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
716065
x-cache
HIT
status
200
expiration
expiry-date="Wed, 13 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//gallery-pl.go-game.io/uploads/2019/01/Vk_Resizes%25201000x600_B63497_1000x600_English%26IMG%3D1CZT.png
content-length
14213
x-served-by
cache-fra19172-FRA
last-modified
Sun, 10 Feb 2019 11:20:02 GMT
server
cloudinary
x-timer
S1553044291.308290,VS0,VE0
etag
"30ee0098be00663c3f3cc9120ca0a689"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
86
26facc4d8c267f1b8cfc33dc8e467716.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/26facc4d8c267f1b8cfc33dc8e467716.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
86edc57c3493939956537eb5ec5d45a0e4d9077f8e104f1ec3bda0fd0da8d674

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
2408004
x-cache
HIT
status
200
expiration
expiry-date="Mon, 04 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/26facc4d8c267f1b8cfc33dc8e467716.jpg
content-length
9514
x-served-by
cache-fra19172-FRA
last-modified
Fri, 01 Feb 2019 09:44:00 GMT
server
cloudinary
x-timer
S1553044291.308363,VS0,VE0
etag
"b7a82ba49bce362b4248c646382070f5"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
6
4b85a67a71a7b506ae813e931a32c369.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4b85a67a71a7b506ae813e931a32c369.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
7889842e100fa40874f58d342b8cf68317a2f7ae0a38de7319e5926b24cbb347

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
2326859
x-cache
HIT
status
200
expiration
expiry-date="Wed, 06 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4b85a67a71a7b506ae813e931a32c369.jpg
content-length
21461
x-served-by
cache-fra19172-FRA
last-modified
Sun, 03 Feb 2019 22:20:16 GMT
server
cloudinary
x-timer
S1553044291.308553,VS0,VE0
etag
"98c408ff80c4f2951baee7e6d895373b"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
4
photo-1481130763351-e3d9667e3087_1000x600_e1f63963b0dbc3f504df1798b8906fc7.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/08e05a9a-eb2b-4cf4-97b5-01fd088bdbc0/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/08e05a9a-eb2b-4cf4-97b5-01fd088bdbc0/photo-1481130763351-e3d9667e3087_1000x600_e1f63963b0dbc3f504df1798b8906fc7.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
29290d148b95461a19454237570d190b77b689fff343f85fb160d9fa1873eac6

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
414200
x-cache
HIT
status
200, 200 OK
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/08e05a9a-eb2b-4cf4-97b5-01fd088bdbc0/photo-1481130763351-e3d9667e3087_1000x600_e1f63963b0dbc3f504df1798b8906fc7.png
content-length
10629
x-request-id
12634d23e6beb799
x-served-by
cache-fra19172-FRA
last-modified
Wed, 13 Mar 2019 14:23:33 GMT
server
cloudinary
x-timer
S1553044291.308516,VS0,VE0
etag
"54ec30882abb8d24d35c6cf49c212813"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
13
478d3ae2ba2c7b835703000fb23c6b3d.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/478d3ae2ba2c7b835703000fb23c6b3d.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
ab0704fcb4965e24cd6066329fc4af74832ed7a95498fcc0935d8fc7b03b758e

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
1075034
x-cache
HIT
status
200
expiration
expiry-date="Wed, 13 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/478d3ae2ba2c7b835703000fb23c6b3d.jpg
content-length
17123
x-served-by
cache-fra19172-FRA
last-modified
Sun, 10 Feb 2019 04:56:10 GMT
server
cloudinary
x-timer
S1553044291.308541,VS0,VE0
etag
"24a9935da5eebb48e878d1b355e14014"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
348
f576f8b318f2b26216732e19bd8e4d34.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f576f8b318f2b26216732e19bd8e4d34.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
576ba362603444996deb95a7cddb2432e74937759ac34ddb571328e5ef1f0de2

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
885255
x-cache
HIT
status
200
expiration
expiry-date="Sun, 10 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f576f8b318f2b26216732e19bd8e4d34.jpg
content-length
14863
x-served-by
cache-fra19172-FRA
last-modified
Thu, 07 Feb 2019 07:10:38 GMT
server
cloudinary
x-timer
S1553044291.308562,VS0,VE0
etag
"f0a697390ccdb2e8446bf55114d4e4e7"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
56
05d2d5115028f817d5e5bf1285863076.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05d2d5115028f817d5e5bf1285863076.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
21b11546ec9cc1157cf43b45268108de0c19e561aefca3148cee8a299c76ad69

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
4511
x-cache
HIT
status
200
expiration
expiry-date="Sat, 23 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/05d2d5115028f817d5e5bf1285863076.png
content-length
8045
x-served-by
cache-fra19172-FRA
last-modified
Wed, 20 Feb 2019 04:32:42 GMT
server
cloudinary
x-timer
S1553044291.318057,VS0,VE0
etag
"f3479950cb9f3c935ca4135b3e5cb779"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1
fd1d023696d476c824edcf2392a52ee9.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/fd1d023696d476c824edcf2392a52ee9.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
51bddbe1523c98a951eb7c556aed35ee56d970fe3ee87efe8443fde968ad59f9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
age
818332
x-cache
HIT
status
200
expiration
expiry-date="Thu, 14 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/fd1d023696d476c824edcf2392a52ee9.jpeg
content-length
6522
x-served-by
cache-fra19172-FRA
last-modified
Mon, 11 Feb 2019 05:47:04 GMT
server
cloudinary
x-timer
S1553044291.318068,VS0,VE0
etag
"d649d0593f45827d06e94564fc17c415"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
487
domains
api.viglink.com/api/ 		104 B
784 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.87.193 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
3b1d15aa16a5e57161ab8e2ba5eabf91f90dcf15d11cc65bfc03adfdecd654af

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:31 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
104
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tboptevent.html
widget.perfectmarket.com/opt/ Frame 69A6 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widget.perfectmarket.com/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
Requested by
Host: widget.perfectmarket.com
URL: https://widget.perfectmarket.com/cbsinteractive-zdnet/pmk-201618008.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.181 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
Varnish /
Resource Hash

Request headers

:method
GET
:authority
widget.perfectmarket.com
:scheme
https
:path
/opt/tboptevent.html?v=2&a=u&d=%7B%22stp%22%3A%7B%22v%22%3A1%7D%7D
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/

Response headers

status
404
server
Varnish
retry-after
0
accept-ranges
bytes
date
Wed, 20 Mar 2019 01:11:31 GMT
via
1.1 varnish
x-served-by
cache-fra19126-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1553044291.446190,VS0,VE0
content-length
0
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 		254 B
747 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.350-59-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
age
27906
x-cache
HIT
status
200
date
Wed, 20 Mar 2019 01:11:31 GMT
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
NHYqfgHhQMaFiaJfDtKC9204ZOyUMXDomIHau6bwEOKVPEp427r4r0UiFipOO01wjx45H1bVHTE=
x-served-by
cache-fra19172-FRA
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1553044292.546083,VS0,VE0
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
x-amz-request-id
D631AE82D5B67BBE
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
59
x-cache-hits
27375
moatvideo.js
z.moatads.com/cbsiimajsint708425247896/ 		280 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsiimajsint708425247896/moatvideo.js
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
b14e016720fd0d8e3d338716f29d0b33d19bfc93279d0309ba75925c8384f6e6

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:31 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Jan 2019 19:12:24 GMT
Server
AmazonS3
x-amz-request-id
CA20C753A19FB8E8
ETag
"d103e7c9f5a7645c4ed8a58c49858657"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=63757
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88469
x-amz-id-2
FImh0RuuIseSoVd61bs+argZbmd5oRDOIluw4eESuDL9iVQaW+veJTMygWtnK9U4AqIN/C88KUg=
10d31225525ff5790a490d4d-adobeorg.xml
cbsinteractive.hb.omtrdc.net/settings/ 		228 B
624 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/settings/10d31225525ff5790a490d4d-adobeorg.xml?r=1553044291838
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.115.34 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-145-115-34.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Date
Wed, 20 Mar 2019 01:11:07 GMT
Last-Modified
Tue, 05 Feb 2019 09:39:36 GMT
Server
nginx
ETag
"5c5959d8-e4"
Access-Control-Allow-Methods
OPTIONS,GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Location
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type
Content-Length
228
ads
securepubads.g.doubleclick.net/gampad/ 		28 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=651165757893007&correlator=3046312428966066&output=json_html&callback=googletag.impl.pubads.callbackProxy2&impl=fifs&adsid=NT&json_a=1&eid=21062068%2C21063066%2C370204055&vrg=319&guci=1.2.0.0.2.2.0.0&plat=1%3A32776%2C2%3A32776%2C8%3A32776&sc=1&sfv=1-0-32&iu_parts=8264%2Cuk-zdnet%2Csecurity&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=320x50%7C11x11%2C641x321&fluid=height%2C0&prev_scp=pos%3Dtop%26strnativekey%3D8ec3a4f3%7Cpos%3Dtop&eri=1&cust_params=test%3Dad_stack%257C1%257Ccontrol%26buyingcycle%3Ddiscover%26topic%3Dsecurity%252Cservers%26pid%3Dcobalt%252Ckoss-cobalt%252Ctargus-strike%26tag%3Dcloud-security%252Ctarget%252Cmalware%26mfr%3Dcobalt-networks-inc%26device%3Ddesktop%26ptype%3Darticle%26cid%3Dvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%26env%3Dprod%26firstpg%3D1%26vguid%3D4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e%26session%3Df%26subses%3D6&cookie=ID%3Dfb6cfd38db979864%3AT%3D1553044287%3AS%3DALNI_MbvQ2T-jQ5ObLppRc0AM5EmWZXnyg&cookie_enabled=1&bc=15&abxe=1&lmt=1553044291&dt=1553044291866&dlt=1553044284815&idt=889&frm=20&biw=1585&bih=1200&oid=3&adxs=208%2C0&adys=1793%2C0&adks=2667220546%2C4052254709&ucis=h%7Ci&ifi=10&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&ref=https%3A%2F%2Ft.co%2F00ebQBQ0nK&dssz=106&icsg=0&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=770x11%7C770x3405&blev=1&bisch=1&psts=CjAItqWH1xFA0ZwfeAHoAan91P2CBIACmdKuB4AC0eCgC4ACmdChC9EC2tju2RvnHWY%2CCikI6fjgeOgBuYGm5ZgCgAKZ0q4HgALR4KALgAKZ0KEL0QIki2QPNz6gGg%2CCikI6fjgeOgB0fvn5ZgCgAKZ0q4HgALR4KALgAKZ0KEL0QIQl4cX_igb_Q%2CCikIqcqxc-gB0fvn5ZgCgAKZ0q4HgALR4KALgAKZ0KEL0QJ4A1FqdWm2oQ%2CCjAIlt3u1hFA0ZwfeAHoAcS044GDBIACmdKuB4AC0eCgC4ACmdChC9EC4rO0S0PKBKI%2CCikIqcqxc-gBuYGm5ZgCgAKZ0q4HgALR4KALgAKZ0KEL0QLY6hNda6L5-A%2CCioIhNOZ_RHoAbnfqIGDBIACmdKuB4AC0eCgC4ACmdChC9ECaIr2DkwxmKk&ga_vid=666783898.1553044287&ga_sid=1553044287&ga_hid=1376354792&fws=4%2C128
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_319.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
1c4bd6569f1436221fc4c6309456f705025e64a97af386eac4be33d432cb3fad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:31 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
7882
x-xss-protection
1; mode=block
google-lineitem-id
4955832456,4745327422
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138262432800,138239368367
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
m
secure-us.imrworldwide.com/cgi-bin/ 		44 B
332 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-700144&c29=plid,15530442885669739&c30=bldv,6.0.0.326&c6=vc,c01&c3=st,a&cg=ZDNet%20Video&tl=dav0-Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&c9=devid,&pr=iag.sid,1000011&pr=iag.tfid,902&pr=iag.bcr,us-700144&pr=iag.pgm,Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&pr=iag.epi,Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent%7C%7C%7Csf&pr=iag.seg,1&pr=iag.pd,www.zdnet.com&pr=iag.brn,us-700144&pr=iag.ap,pre&pr=iag.cte,&pr=iag.oad,na&pr=iag.fp,sf&pr=iag.pod,1_1_1_1&pr=iag.apt,na&pr=iag.cp,soc&c10=plt,&c26=dmap,3&tp=gg&c24=zip,99&uoo=&c68=bndlid,&c61=createtm,1553044291&nodeTM=&logTM=&c73=phtype,&c74=dvcnm,&c62=sendTime,1553044291&rnd=227981
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.255.169.159 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-255-169-159.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:31 GMT
server
nginx
access-control-allow-origin
*
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://www.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
status
200
cache-control
no-cache
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_s...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_...
43 B
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=5000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1553044291827&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=4082&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:31 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=5000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_ts=1553044291827&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=4082&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:31 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
s02790190292851
som.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/ 		43 B
615 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://som.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s02790190292851?AQB=1&ndh=1&pf=1&t=20%2F2%2F2019%201%3A11%3A31%203%200&mid=88302168321446056654240514095442262961&aid=2E48C99F05310321-40000191C000E2B0&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&r=https%3A%2F%2Ft.co%2F00ebQBQ0nK&c.&siteEdition=eu&siteSection=editorial&siteType=responsive%20web&articleId=91a1429b-0d61-43fd-b421-a8b6e260e98c&articleType=content_article&articleTitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&pageType=article&pageViewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&userState=not%20authenticated&userType=anon&deviceType=desktop&testName=ad_stack&testVersion=1&testGroup=control&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=D%3Dg&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity&test=ad_stack%7C1%7Ccontrol&abtest=ad_stack%7C1%7Ccontrol&videoAuthor=zdnet%20editors&Network=zdnet&tl=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&mediaAutoPlay=true&mediaMuted=true&a.&contentType=vod&media.&name=8495b1b0-20aa-4299-8f52-f480538e9d83&friendlyName=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&length=66&playerName=UVPJS_2.8.3&view=true&vsid=1553044291841249752366&.media&.a&.c&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&pe=ms_s&pev3=video&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.34 Lehi, United States, ASN (),
Reverse DNS
cbsi.com.ssl.d2.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
X-Content-Type-Options
nosniff
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Thu, 21 Mar 2019 01:11:32 GMT
Server
Omniture DC/2.0.0
xserver
www85
ETag
"3335137221776834560-4899811986608529672"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Tue, 19 Mar 2019 01:11:32 GMT
/
5f651e6f.akstat.io/ 		0
354 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://5f651e6f.akstat.io/?h.pg=article&h.ab=ad_stack_control_1&when=1553044291904&cdim.Site_View=desktop&t_other=custom2%7C9135&d=zdnet.com&h.key=YZ2TK-PC7PJ-K64DL-L53CR-P2G4E&h.d=zdnet.com&h.cr=157cf5af2a2a5cb78b7de4959e567960f1b6ab2f&h.t=1553044287368&http.initiator=api&rt.start=api&rt.si=f2bd5cea-91f0-4820-af44-2676edf40ae1&rt.ss=1553044290397&rt.sl=0&api=1&api.v=2&api.l=js&api.lv=0.0.1
Requested by
Host: zdnet1.cbsistatic.com
URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.214.229 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:31 GMT
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Timing-Allow-Origin
*
X-XSS-Protection
0
Expires
Wed, 20 Mar 2019 01:11:31 GMT
sfp-set-targeting.js
native.sharethrough.com/assets/ Frame CC36 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://native.sharethrough.com/assets/sfp-set-targeting.js
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.80 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-80.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
dbbaa3846da2488b06c96ac68e3885c9f3c623cb730e09044c873c7527f9ef96

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 19 Mar 2019 21:58:52 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 21:58:48 GMT
server
AmazonS3
age
113
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
public, max-age=3600
x-amz-cf-id
uydvLPNQQwZGZ5Hl75k649kT95SqpMuYAWO4hYuZbY4HWZLT165JBQ==
via
1.1 d01ad8df731d3f120823f9e20df55147.cloudfront.net (CloudFront)
expires
Tue, 19 Mar 2019 22:58:47 GMT
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame CC36 		77 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame CC36 		303 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50015
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 249F 		77 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: t.co
URL: https://t.co/00ebQBQ0nK
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 20 Mar 2019 01:11:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1552585448432221"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,44,43,39",quic=":443"; ma=2592000; v="46,44,43,39"
content-length
29080
x-xss-protection
1; mode=block
expires
Wed, 20 Mar 2019 01:11:28 GMT
moatad.js
z.moatads.com/cbsdfp5832910442/ Frame 249F 		303 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/cbsdfp5832910442/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_319.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f

Request headers

Response headers

Date
Wed, 20 Mar 2019 01:11:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Feb 2019 22:29:59 GMT
Server
AmazonS3
x-amz-request-id
82363167FAD5F230
ETag
"4192ad3d88c4b23647e26c5be6a8dbe9"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=50015
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
95759
x-amz-id-2
yirNQ4PsY1yl+387/ZDVh0Ttp+9Fi/f1S5Dfyz0kH+MjBZETIK+Tyv2pX5FSXcwPZd0/lM8qGjM=
view
securepubads.g.doubleclick.net/pcs/ Frame CC36 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstZZSqCokHnsOVMQbpcpGUXjIC2h2T2bi-0IbW0F_VQ7KSlXAMhKJniGmnCt67KgYMPH_7fy7RuQ2i3_faCDQPANQ-qWchO5awdNSU2Ft0we83cDJ85PtjYYkYtMOjx-VkwiQ0M8M4RS_EouYXTHjhxNYNsZDsljV1ZL5hEpvSHc5dpahzpU6QScPMLG4jq3pL7vMF2CvXs8ZQ3s6ErMQu5VGuFGiWEVy6NBhI7Apy60yzDV-0ruQM0DI1giA&sai=AMfl-YTJEZWhGUGpAcCt7L0cwHX5z7m8kq4Kw2RGSH8LzDKBkNU5Bnve-7BbDYIgR_9Cle36tQZFm7U-kTEttLIwPmDBRQl6CAEDBQJ1uxUtZFp8GfApD-GvGnUVJTbQ&sig=Cg0ArKJSzAWcDKu5p2QNEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:32 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
B22286505.241190948;dc_pre=CNum5erEj-ECFQe9dwodJH4EzQ;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=
ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/ Frame CC36
Redirect Chain
  • https://ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/B22286505.241190948;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=
  • https://ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/B22286505.241190948;dc_pre=CNum5erEj-ECFQe9dwodJH4EzQ;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_...
42 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/B22286505.241190948;dc_pre=CNum5erEj-ECFQe9dwodJH4EzQ;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.16.166 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s11-in-f166.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:32 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:32 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://ad.doubleclick.net/ddm/trackimp/N1933.273680CBS/B22286505.241190948;dc_pre=CNum5erEj-ECFQe9dwodJH4EzQ;dc_trk_aid=438183133;dc_trk_cid=112130342;ord=767020856;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 249F 		0
56 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstzBTL6yrqsGgTlLmUBEkwCtJak0ya-fQkUnAqbdwO_g1yUvx14uhZxeT1dyvptgCDF35UsUUuEznhb5_n7ZtvyREy8vA8hNJjoRojfwxqDyZApQO2o-R9fkokI_IM994fSd7kc4Xz3-9wj0vDIpbRuoOimaZQPSPPT4c1GNYc5nwJfw5zukRiOn1-SeL47TSjGvWYgxnffylrzKQyMJaCjY11gYI1tc__p22wxIN_f7Y8E_ShwmBWWCvhE8ikhjA&sai=AMfl-YRLe-_WEn7lHT8Tk7jC3WzdKtYXGsWm6SczCODRUXQyoO0HW4u7XF40Cn0QuGMFC5eEB6UCmSzNhdIrgn3Ab50SLKOXpAD2LgiCnmBM77Lrk4EgPcqvJqyTT9PQ&sig=Cg0ArKJSzJ25ojjQLpbFEAE&urlfix=1&adurl=
Requested by
Host: www.zdnet.com
URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.23.162 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s22-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:32 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
1; mode=block
truncated
/ Frame CC36 		208 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f0015edc70a1c3d75c903154e9df004769a36563ea8696f1524b585429e3a58e

Request headers

Response headers

Content-Type
image/png
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=CBSIMAJSINT1&hp=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&m=0&ar=4f071de90bd-clean&q=49&cb=0&cu=1553044292158&ll=2&lm=0&ln=0&r=0&em=0&en=0&d=%3A%3A4574368938%3A138225997530&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&qs=1&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&fd=1&ac=1&it=500&fs=158226&na=1311446957&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:32 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:32 GMT
/
cbsinteractive.hb.omtrdc.net/ 		0
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=som.cbsi.com&h:sc:ssl=1&s:user:aid=2E48C99F05310321-40000191C000E2B0&s:user:mid=88302168321446056654240514095442262961&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_2.8.3&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1553044291841249752366&s:event:type=start&l:event:duration=1&l:event:playhead=0&l:event:ts=1553044291849&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:asset:video_id=8495b1b0-20aa-4299-8f52-f480538e9d83&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=66&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteEdition=eu&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=91a1429b-0d61-43fd-b421-a8b6e260e98c&s:meta:articleType=content_article&s:meta:articleTitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&s:meta:pageType=article&s:meta:pageViewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:testName=ad_stack&s:meta:testVersion=1&s:meta:testGroup=control&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=D%3Dg&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity&s:meta:test=ad_stack%7C1%7Ccontrol&s:meta:abtest=ad_stack%7C1%7Ccontrol&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.115.34 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-145-115-34.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:11:07 GMT
X-VaRouter-Backend
prod21
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/ 		0
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=som.cbsi.com&h:sc:ssl=1&s:user:aid=2E48C99F05310321-40000191C000E2B0&s:user:mid=88302168321446056654240514095442262961&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_2.8.3&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1553044291841249752366&s:event:type=start&l:event:duration=1&l:event:playhead=0&l:event:ts=1553044291854&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:asset:video_id=8495b1b0-20aa-4299-8f52-f480538e9d83&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=66&s:asset:ad_id=4574368938&s:asset:ad_sid=1553044291853866994814&s:asset:resolver=UVPJS_2.8.3&s:asset:pod_id=c40f02414857f0c6844f01fcd3e31a7a_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_EG_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_EG_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0&s:meta:siteEdition=eu&s:meta:siteSection=editorial&s:meta:siteType=responsive%20web&s:meta:articleId=91a1429b-0d61-43fd-b421-a8b6e260e98c&s:meta:articleType=content_article&s:meta:articleTitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&s:meta:pageType=article&s:meta:pageViewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&s:meta:userState=not%20authenticated&s:meta:userType=anon&s:meta:deviceType=desktop&s:meta:testName=ad_stack&s:meta:testVersion=1&s:meta:testGroup=control&s:meta:siteRsids=cnetzdnetglobalsite&s:meta:siteCode=zdnet&s:meta:pageUrl=D%3Dg&s:meta:sitePrimaryRsid=cnetzdnetglobalsite&s:meta:userStatus=not%20authenticated&s:meta:siteHier=zdnet%3Asecurity&s:meta:test=ad_stack%7C1%7Ccontrol&s:meta:abtest=ad_stack%7C1%7Ccontrol&s:meta:videoAuthor=zdnet%20editors&s:meta:Network=zdnet&s:meta:tl=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:meta:mediaAutoPlay=true&s:meta:mediaMuted=true
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.115.34 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-145-115-34.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:11:07 GMT
X-VaRouter-Backend
prod21
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/ 		0
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=som.cbsi.com&h:sc:ssl=1&s:user:aid=2E48C99F05310321-40000191C000E2B0&s:user:mid=88302168321446056654240514095442262961&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:cuser:userId.as=0&s:cuser:puuid.as=0&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_2.8.3&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1553044291841249752366&s:event:type=aa_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1553044291977&l:event:prev_ts=-1&s:asset:type=main&s:asset:name=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:asset:video_id=8495b1b0-20aa-4299-8f52-f480538e9d83&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=66&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.115.34 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-145-115-34.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:11:07 GMT
X-VaRouter-Backend
prod21
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/ 		0
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=som.cbsi.com&h:sc:ssl=1&s:user:aid=2E48C99F05310321-40000191C000E2B0&s:user:mid=88302168321446056654240514095442262961&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_2.8.3&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1553044291841249752366&s:event:type=aa_ad_start&l:event:duration=0&l:event:playhead=0&l:event:ts=1553044291978&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:asset:video_id=8495b1b0-20aa-4299-8f52-f480538e9d83&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=66&s:asset:ad_id=4574368938&s:asset:ad_sid=1553044291853866994814&s:asset:resolver=UVPJS_2.8.3&s:asset:pod_id=c40f02414857f0c6844f01fcd3e31a7a_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_EG_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_EG_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.7.225 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-165-7-225.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:12:37 GMT
X-VaRouter-Backend
prod21
Server
nginx
Connection
keep-alive
s05506632043735
som.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/ 		43 B
544 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://som.cbsi.com/b/ss/cnetzdnetglobalsite/1/JS-2.3.0/s05506632043735?AQB=1&ndh=1&pf=1&t=20%2F2%2F2019%201%3A11%3A31%203%200&mid=88302168321446056654240514095442262961&aid=2E48C99F05310321-40000191C000E2B0&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c.&a.&media.&vsid=1553044291841249752366&name=8495b1b0-20aa-4299-8f52-f480538e9d83&playerName=UVPJS_2.8.3&friendlyName=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&length=66&ad.&name=4574368938&friendlyName=OAS_Countdown_EG_5&podFriendlyName=OAS_Countdown_EG_5&length=5&playerName=UVPJS_2.8.3&pod=c40f02414857f0c6844f01fcd3e31a7a_1&podPosition=1&podSecond=0.0&view=true&.ad&.media&contentType=vod&.a&siteEdition=eu&siteSection=editorial&siteType=responsive%20web&articleId=91a1429b-0d61-43fd-b421-a8b6e260e98c&articleType=content_article&articleTitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&pageType=article&pageViewGuid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&userState=not%20authenticated&userType=anon&deviceType=desktop&testName=ad_stack&testVersion=1&testGroup=control&siteRsids=cnetzdnetglobalsite&siteCode=zdnet&pageUrl=D%3Dg&sitePrimaryRsid=cnetzdnetglobalsite&userStatus=not%20authenticated&siteHier=zdnet%3Asecurity&test=ad_stack%7C1%7Ccontrol&abtest=ad_stack%7C1%7Ccontrol&videoAuthor=zdnet%20editors&Network=zdnet&tl=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&mediaAutoPlay=true&mediaMuted=true&.c&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&pe=msa_s&pev3=videoAd&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=10D31225525FF5790A490D4D%40AdobeOrg&AQE=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.34 Lehi, United States, ASN (),
Reverse DNS
cbsi.com.ssl.d2.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Thu, 21 Mar 2019 01:11:32 GMT
Server
Omniture DC
xserver
www235
ETag
"3335137221776834560-5932790077359953755"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Tue, 19 Mar 2019 01:11:32 GMT
public.json
platform-cdn.sharethrough.com/api/external/v1/placements/8ec3a4f3/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://platform-cdn.sharethrough.com/api/external/v1/placements/8ec3a4f3/public.json
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.109 Wilmington, United States, ASN (),
Reverse DNS
server-143-204-214-109.fra53.r.cloudfront.net
Software
nginx/1.14.2 /
Resource Hash
04e41b27e7c2c734bb2b29e2c3d0e121c15cf99d524c084a1cac59f54c853d57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 16 Mar 2019 02:27:15 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
User-Cache-Control
no-cache, must-revalidate
Access-Control-Allow-Origin
*
X-Cache
Hit from cloudfront
Status
200 OK
Connection
keep-alive
Content-Length
1394
X-XSS-Protection
1; mode=block
X-Request-Id
ed75bd95-0be1-474f-bd31-fc4558c4e91f
X-Runtime
0.071276
User-Header
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Server
nginx/1.14.2
ETag
W/"04e41b27e7c2c734bb2b29e2c3d0e121"
X-Frame-Options
SAMEORIGIN
Access-Control-Allow-Methods
GET
Content-Type
application/json; charset=utf-8
Via
1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
Cache-Control
max-age=900, public
X-Amz-Cf-Id
s_L7Iqfj6jAU05fKskJ_Bgab_bzw__udRqwqNovkyiMj8d8M2Qw_rw==
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&kq=1&lo=0&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=https%3A%2F%2Fwww.zdnet.com%2F%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&bq=8&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=103&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5285&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=21&an=0&gf=21&gg=0&ez=1&aj=1&pg=100&pf=0&ib=1&cc=0&bw=21&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=42&cd=0&ah=42&am=0&dq=42&dr=0&ds=42&dt=0&zx=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&eb=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=561753178&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:32 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:32 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=29&q=0&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&bq=8&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=109&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5285&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&as=0&ag=21&an=21&gf=21&gg=21&ez=1&aj=1&pg=100&pf=100&ib=1&cc=0&bw=21&bx=21&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&bu=42&cd=42&ah=42&am=42&dq=42&dr=42&ds=42&dt=42&zx=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&eb=1&ef=1&rf=0&re=0&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=9963185&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:32 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:32 GMT
v4
btlr.sharethrough.com/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/v4?placement_key=8ec3a4f3&campaign_key=DSbrSFRryqCYMafsUpQCvgZ6NP&mrid=1928e960-4aad-11e9-b0ef-37b6fd6464c1
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.185.208.109 Cambridge, United States, ASN (),
Reverse DNS
ec2-18-185-208-109.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
826759288201eac098fea118a62463043bf7d3880164ff29bcb6058b31ab5cdb

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-encoding
gzip
Vary
Origin
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
private, no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
2112
butler
b.sharethrough.com/ 		0
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.sharethrough.com/butler?type=networkImpressionRequest&pkey=8ec3a4f3&placementIndex=1&networkKey=stxnetwork&networkOrder=1&bwidth=1600&bheight=1200&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%252F&umtime=1553044292411&version=596-78ae35a9-eu&mrid=1928e960-4aad-11e9-b0ef-37b6fd6464c1&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.233.1.251 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-233-1-251.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
moatad.js
z.moatads.com/sharethroughv2465247317527/ 		288 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/sharethroughv2465247317527/moatad.js?moatClientLevel1=2ac18247&moatClientLevel2=DSbrSFRryqCYMafsUpQCvgZ6NP&moatClientLevel3=sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn&moatClientLevel4=DSAP3zWJp7z1a7zvDch6aXR12m&moatClientSlicer1=aec2767996d7a4df64f4df7e&moatClientSlicer2=8ec3a4f3&zMoatDSP=sfp&zMoatURLFunc=str-third-party-sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn-8ec3a4f3-1&zMoatIsInView=str-visibility-sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn-8ec3a4f3-1&zMoatTimeInView=str-time-sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn-8ec3a4f3-1
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d66ff08e71650494544e169b9dac586d6b891002b458bada248c29702bc0f9df

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Feb 2019 17:02:59 GMT
Server
AmazonS3
x-amz-request-id
30B36063A36481AA
ETag
"2c8ce018bdfc7efee2279d070cb1feef"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=46570
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
90564
x-amz-id-2
wLuXBM9cGxMdnxFcgnOUHWZC6/RnUZsO/Sak41ywg059+BbzwmymumawZzxp/0oofHXg3zGWIyE=
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Response headers

Content-Type
image/gif
intearct-twitter-logo_400x400.jpg
static.sharethrough.com/sfp/campaigns/25090/brand_logos/mobile/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.sharethrough.com/sfp/campaigns/25090/brand_logos/mobile/intearct-twitter-logo_400x400.jpg
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.86 Wilmington, United States, ASN (),
Reverse DNS
server-143-204-214-86.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0325e248491bb36d9c780a5931986a4b5913c20e138eaaddcfd44a0447fbc0d7

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sat, 02 Mar 2019 01:34:41 GMT
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
last-modified
Thu, 14 Feb 2019 09:54:01 GMT
server
AmazonS3
age
536
etag
"632674b316825a01738042c7b57d764c"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
cache-control
max-age=600
accept-ranges
bytes
content-length
1617
x-amz-cf-id
GUSaYv4kMmnwMV7UUkzq5SrfCGBiaWKyGE84TVMQ_k0O7kgyaeTBqg==
image-4.jpg
str-assets.imgix.net/creative_workflow/creative_thumbnails/413250/images/original/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://str-assets.imgix.net/creative_workflow/creative_thumbnails/413250/images/original/image-4.jpg?w=170&h=89&auto=format&fit=crop&dpr=1
Requested by
Host: native.sharethrough.com
URL: https://native.sharethrough.com/assets/sfp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::720 , European Union, ASN (),
Reverse DNS
Software
imgix-fe /
Resource Hash
fcd07d34fcaef424349817bb9d28149d460ad72e66cbb532a830ac5d7a0c5d38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:32 GMT
x-content-type-options
nosniff
last-modified
Tue, 19 Mar 2019 9:03:56 GMT
server
imgix-fe
age
1085
vary
Accept, User-Agent
x-cache
HIT, MISS
content-type
image/webp
status
200
cache-control
public,max-age=600
x-imgix-id
a3f6fa3b65f4f98b391cf921a1cad90dce26dd69
accept-ranges
bytes
content-length
8936
x-served-by
cache-lax8623-LAX, cache-fra19174-FRA
butler
b.sharethrough.com/ 		0
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.sharethrough.com/butler?type=impressionReceived&pkey=8ec3a4f3&placementIndex=1&ckey=sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn&vkey=DSAP3zWJp7z1a7zvDch6aXR12m&arid=9f47fd91-6096-485e-b636-44fd83b8ed76&awid=c3b10f22-dde3-41bc-8729-0fe545cd64c9&renderOffset=800&responseTime=82&butlerLatency=81.87000453472137&bwidth=1600&bheight=1200&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%252F&umtime=1553044292494&version=596-78ae35a9-eu&mrid=1928e960-4aad-11e9-b0ef-37b6fd6464c1&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.233.1.251 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-233-1-251.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
butler
b.sharethrough.com/ 		0
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.sharethrough.com/butler?bwidth=1600&bheight=1200&pwidth=770&pheight=131&pxoff=208&pyoff=1793&pkey=8ec3a4f3&ckey=sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn&tkey=bqSbBKSUnnhMPViET2buaJ7u&vkey=DSAP3zWJp7z1a7zvDch6aXR12m&arid=9f47fd91-6096-485e-b636-44fd83b8ed76&awid=c3b10f22-dde3-41bc-8729-0fe545cd64c9&sourceId=sfp&renderInPlace=false&placementIndex=1&twidth=170&theight=89&action=clickout&isVast=false&renderOffset=0&type=impression&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%252F&umtime=1553044292523&version=596-78ae35a9-eu&mrid=1928e960-4aad-11e9-b0ef-37b6fd6464c1&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.207.232 Ashburn, United States, ASN (),
Reverse DNS
ec2-52-72-207-232.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
butler
b.sharethrough.com/ 		0
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.sharethrough.com/butler?bwidth=1600&bheight=1200&pwidth=770&pheight=131&pxoff=208&pyoff=1793&pkey=8ec3a4f3&ckey=sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn&tkey=bqSbBKSUnnhMPViET2buaJ7u&vkey=DSAP3zWJp7z1a7zvDch6aXR12m&arid=9f47fd91-6096-485e-b636-44fd83b8ed76&awid=c3b10f22-dde3-41bc-8729-0fe545cd64c9&sourceId=sfp&renderInPlace=false&placementIndex=1&twidth=170&theight=89&action=clickout&isVast=false&responseTime=32.930001616477966&type=moatLatency&byscroll=0&ploc=https%253A%252F%252Fwww.zdnet.com%252Farticle%252Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%252F&umtime=1553044292683&version=596-78ae35a9-eu&mrid=1928e960-4aad-11e9-b0ef-37b6fd6464c1&bidId=NO_BID_ID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.207.232 Ashburn, United States, ASN (),
Reverse DNS
ec2-52-72-207-232.compute-1.amazonaws.com
Software
nginx/1.4.6 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:32 GMT
Server
nginx/1.4.6 (Ubuntu)
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=216&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4629503254&L2id=2488641989&L3id=4955832456&L4id=138262432800&S1id=23605329&S2id=23619609&ord=1553044292087&r=365953019299&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=1&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:32 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:32 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=216&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4629503254&L2id=2488641989&L3id=4955832456&L4id=138262432800&S1id=23605329&S2id=23619609&ord=1553044292087&r=365953019299&t=nht&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=2&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:32 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:32 GMT
pixel.gif
cbsdfp5832910442.s.moatpixel.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cbsdfp5832910442.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=261&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=zdnet.com&L1id=4629503254&L2id=2488641989&L3id=4955832456&L4id=138262432800&S1id=23605329&S2id=23619609&ord=1553044292087&r=365953019299&t=hdn&os=0&fi2=0&div1=0&ait=0&zMoatVGUID=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&zMoatCURL=zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers&zMoatPS=top&zMoatPT=article&bedc=1&q=3&nu=1&ib=1&dc=1&ob=1&oh=0&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:32 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:32 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=29&q=1&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=1028&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=0&ag=837&an=21&gf=837&gg=21&ez=1&aj=1&pg=100&pf=100&ib=1&cc=0&bw=837&bx=21&dj=1&aa=0&ad=740&cn=0&gk=740&gl=0&cq=1&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=858&cd=42&ah=858&am=42&dq=858&dr=42&ds=858&dt=42&zx=0&vm=1&vl=0&vt=193&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&ef=1&eg=1&rf=0&re=1&ft=329&fv=0&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1652830350&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:33 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:33 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=1029&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=0&ag=837&an=837&gf=837&gg=837&ez=1&aj=1&pg=100&pf=100&ib=1&cc=0&bw=837&bx=837&dj=1&aa=0&ad=740&cn=740&gk=740&gl=740&cq=1&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=858&cd=858&ah=858&am=858&dq=858&dr=858&ds=858&dt=858&zx=0&vm=1&vl=193&vt=193&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&ef=1&eg=1&rf=0&re=1&ft=329&fv=329&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=753690771&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:33 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:33 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=1077&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1040&an=837&gi=1&gf=1040&gg=837&ez=1&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&cc=1&bw=1040&bx=837&jz=858&dj=1&dx=1&aa=0&ad=943&cn=740&gk=943&gl=740&cq=1&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=858&cd=858&ah=858&am=858&dq=858&dr=858&ds=858&dt=858&zx=0&vm=1&vl=193&vt=240&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&ef=1&eg=1&rf=0&re=1&ft=532&fv=329&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1326478336&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:33 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:33 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=1078&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1040&an=1040&gi=1&gf=1040&gg=1040&ez=1&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&cc=1&bw=1040&bx=1040&jz=858&dj=1&dx=1&aa=0&ad=943&cn=943&gk=943&gl=943&cq=1&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=858&cd=858&ah=858&am=858&dq=858&dr=858&ds=858&dt=858&zx=0&vm=1&vl=240&vt=240&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&ef=1&eg=1&rf=0&re=1&ft=532&fv=532&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=249957595&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:33 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:33 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=1281&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=1244&an=1040&gi=1&gf=1244&gg=1040&ez=1&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&cc=1&bw=1244&bx=1040&jz=858&dj=1&dx=1&aa=1&ad=1147&cn=943&gn=1&gk=1147&gl=943&cp=1061&cq=1&cr=1&hj=0&pv=0&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1061&cd=858&ah=1061&am=858&dq=1061&dr=858&ds=1061&dt=858&zx=0&vm=1&vl=240&vt=287&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&ef=1&eg=1&rf=0&re=1&ft=736&fv=532&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1871937294&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:33 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:33 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=2093&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2056&an=1244&gi=1&gf=2056&gg=1244&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2056&bx=1244&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=1959&cn=1147&gn=1&gk=1959&gl=1147&cp=1061&cq=1&cr=1&hj=0&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1877&cd=1061&ah=1877&am=1061&dq=1877&dr=1061&ds=1877&dt=1061&zx=0&vm=1&vl=287&vt=474&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=2056&fj=0&ef=1&eg=1&rf=0&re=1&ft=1548&fv=736&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=2101020253&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:34 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:34 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=2&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=8&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=2093&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2056&an=2056&gi=1&gf=2056&gg=2056&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2056&bx=2056&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=1959&cn=1959&gn=1&gk=1959&gl=1959&cp=1061&cq=1&cr=1&hj=0&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1877&cd=1877&ah=1877&am=1877&dq=1877&dr=1877&ds=1877&dt=1877&zx=0&vm=1&vl=474&vt=474&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=2056&fj=2056&ef=1&eg=1&rf=0&re=1&ft=1548&fv=1548&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1240566755&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:34 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:34 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=29&q=2&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=9&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=2273&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2056&an=2056&gi=1&gf=2056&gg=2056&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2056&bx=2056&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=1959&cn=1959&gn=1&gk=1959&gl=1959&cp=1061&cq=1&cr=1&hj=0&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2077&cd=1877&ah=2077&am=1877&dq=2077&dr=1877&ds=2077&dt=1877&zx=0&vm=1&vl=474&vt=474&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=2056&fj=2056&ef=1&eg=1&eh=1&rf=0&re=1&ft=1548&fv=1548&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1908348283&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:34 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:34 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=3&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=10&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=2294&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2258&an=2056&gi=1&gf=2258&gg=2056&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2258&bx=2056&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=2161&cn=1959&gn=1&gk=2161&gl=1959&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2077&cd=2077&ah=2077&am=2077&dq=2077&dr=2077&ds=2077&dt=2077&zx=0&vm=1&vl=474&vt=521&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=2258&fj=2056&ef=1&eg=1&eh=1&rf=0&re=1&ft=1750&fv=1548&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1701625509&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:34 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:34 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=4&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=11&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=2704&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2667&an=2258&gi=1&gf=2667&gg=2258&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2667&bx=2258&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=2570&cn=2161&gn=1&gk=2570&gl=2161&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2483&cd=2077&ah=2483&am=2077&dq=2483&dr=2077&ds=2483&dt=2077&zx=0&vm=1&vl=521&vt=616&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=2667&fj=2258&ef=1&eg=1&eh=1&rf=0&re=1&ft=2159&fv=1750&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1975259457&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:34 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:34 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=2&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=12&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=2705&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=2667&an=2667&gi=1&gf=2667&gg=2667&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=2667&bx=2667&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=2570&cn=2570&gn=1&gk=2570&gl=2570&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2688&cd=2483&ah=2688&am=2483&dq=2688&dr=2483&ds=2688&dt=2483&zx=0&vm=1&vl=616&vt=616&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=2667&fj=2667&ef=1&eg=1&eh=1&rf=0&re=1&ft=2159&fv=2159&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=165807695&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:34 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:34 GMT
/
inqlnfvog763mmf771rou737u.litix.io/ 		0
247 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/mux.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.66.75 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-199-66-75.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://www.zdnet.com
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:11:35 GMT
Connection
keep-alive
Access-Control-Allow-Headers
Content-Type
Content-Length
0
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
POST, GET
/
inqlnfvog763mmf771rou737u.litix.io/ 		43 B
349 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://inqlnfvog763mmf771rou737u.litix.io/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.199.66.75 Ashburn, United States, ASN (),
Reverse DNS
ec2-34-199-66-75.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:35 GMT
Access-Control-Allow-Methods
POST, GET
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache,no-store,must-revalidate
Connection
keep-alive
Content-Length
43
Expires
Mon, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=29&q=3&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=13&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=3530&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=3478&an=2667&gi=1&gf=3478&gg=2667&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=3478&bx=2667&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=3381&cn=2570&gn=1&gk=3381&gl=2570&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3499&cd=2688&ah=3499&am=2688&dq=3499&dr=2688&ds=3499&dt=2688&zx=0&vm=1&vl=616&vt=803&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=3478&fj=2667&ef=1&eg=1&eh=1&ei=1&rf=0&re=1&ft=2970&fv=2159&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=634408878&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:35 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:35 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=3&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=14&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=3719&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=3682&an=3478&gi=1&gf=3682&gg=3478&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=3682&bx=3478&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=3585&cn=3381&gn=1&gk=3585&gl=3381&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3703&cd=3499&ah=3703&am=3499&dq=3703&dr=3499&ds=3703&dt=3499&zx=0&wa=2&vm=1&vl=803&vt=850&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=3682&fj=3478&ef=1&eg=1&eh=1&ei=1&rf=0&re=1&ft=3174&fv=2970&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=585484330&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:35 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:35 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=29&q=4&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=15&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=4499&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=4288&an=3682&gi=1&gf=4288&gg=3682&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=4288&bx=3682&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=4191&cn=3585&gn=1&gk=4191&gl=3585&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4309&cd=3703&ah=4309&am=3703&dq=4309&dr=3703&ds=4309&dt=3703&zx=0&wa=2&vm=1&vl=850&vt=990&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&du=55&eb=1&ec=9497&fh=2056&fi=4288&fj=3682&ef=1&eg=1&eh=1&ei=1&ej=1&rf=0&re=1&ft=3780&fv=3174&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1633481515&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:36 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:36 GMT
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_s...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_...
43 B
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=4842&ns_st_ipt=4842&ns_st_et=4842&ns_st_det=4842&ns_st_upc=4842&ns_st_dupc=4842&ns_st_iupc=4842&ns_st_upa=4842&ns_st_dupa=4842&ns_st_iupa=4842&ns_st_lpc=4842&ns_st_dlpc=4842&ns_st_lpa=4842&ns_st_dlpa=4842&ns_st_pa=4842&ns_ts=1553044296669&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:36 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=2&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=pause&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=4842&ns_st_ipt=4842&ns_st_et=4842&ns_st_det=4842&ns_st_upc=4842&ns_st_dupc=4842&ns_st_iupc=4842&ns_st_upa=4842&ns_st_dupa=4842&ns_st_iupa=4842&ns_st_lpc=4842&ns_st_dlpc=4842&ns_st_lpa=4842&ns_st_dlpa=4842&ns_st_pa=4842&ns_ts=1553044296669&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=1&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:36 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
free-malware-tools-are-being-exploited-for-malicious-intent.m3u8
www.zdnet.com/video/manifest/ 		3 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/video/manifest/free-malware-tools-are-being-exploited-for-malicious-intent.m3u8?device=ott&change-to-host=techrepublicmedia.akamaized.net&secure=true
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1579c26385b707d4b6f54b0ddd06043fa570caaaa0cb41283b8b88f9f16aef6e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/video/manifest/free-malware-tools-are-being-exploited-for-malicious-intent.m3u8?device=ott&change-to-host=techrepublicmedia.akamaized.net&secure=true
pragma
no-cache
cookie
GED_PLAYLIST_ACTIVITY=W3sidSI6InRUckMiLCJ0c2wiOjE1NTMwNDQyOTYsIm52IjowLCJ1cHQiOjE1NTMwNDQyODUsImx0IjoxNTUzMDQ0Mjg1fV0.; muxData=sid=a17f267b-25d6-45af-a722-b0733433092a&sst=1553044296663&sex=1553045796679
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
www.zdnet.com
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
:scheme
https
:method
GET
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
391
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 19 Mar 2019 23:04:24 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:36 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
7ecff365-c9c6-4eb8-9a19-e789ec0c0ab4
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
set-cookie
fly_device=desktop; expires=Wed, 27-Mar-2019 01:11:36 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Wed, 27-Mar-2019 01:11:36 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure
accept-ranges
bytes
expires
Wed, 20 Mar 2019 00:34:24 GMT
/
www.zdnet.com/video/related-videos-xhr/free-malware-tools-are-being-exploited-for-malicious-intent/ 		32 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/video/related-videos-xhr/free-malware-tools-are-being-exploited-for-malicious-intent/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
eeebdc424df0ec012ef91836202ad1a76cdbc46557c9f6a809f1b63273cd0988
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/video/related-videos-xhr/free-malware-tools-are-being-exploited-for-malicious-intent/
pragma
no-cache
cookie
GED_PLAYLIST_ACTIVITY=W3sidSI6InRUckMiLCJ0c2wiOjE1NTMwNDQyOTYsIm52IjowLCJ1cHQiOjE1NTMwNDQyODUsImx0IjoxNTUzMDQ0Mjg1fV0.; muxData=sid=a17f267b-25d6-45af-a722-b0733433092a&sst=1553044296663&sex=1553045796679
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
5192
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 20 Mar 2019 01:11:37 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:37 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
8a18ff0f-05a7-46ce-9565-8edba29460fb
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
set-cookie
fly_device=desktop; expires=Wed, 27-Mar-2019 01:11:37 GMT; path=/; domain=.zdnet.com; secure fly_geo={"countryCode": "de"}; expires=Wed, 27-Mar-2019 01:11:37 GMT; path=/; domain=.zdnet.com; secure fly_preferred_edition=eu; path=/; domain=.zdnet.com; secure fly_default_edition=eu; path=/; domain=.zdnet.com; secure ak_bmsc=FACBA8C1170DE0F852389977DAAC60B60210BAB7CD7000004993915C0B61FF19~plveQflfwc4n3Dhwt70jB+4qt/fpBFqa5cwVs06yflKEAWTpOyGHXWEyIiwOEdbCLmyrNLDH+AD6GvenFoZueWy2GmZnQXhz0v6cFzfjyREcR+Xnrp8Jn7m6RedXBPpzh+yU73j6Lr2AzcDqEB3zQ1+V9COlR4aTD2Z7OTNMn/EWAstxMSRjixzbDi3FnNYjjff8kRXCtlbeSGdHiE8xvHFtSkh6Aj32eSGyG1Nz/1PIU=; expires=Wed, 20 Mar 2019 03:11:37 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 02:41:37 GMT
pixel.gif
px.moatads.com/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=28&q=0&hp=1&kq=1&lo=0&tr=1&ua=null&pk=1&wk=1&rk=1&tk=0&qs=1&ak=-&i=CBSIMAJSINT1&ud=undefined&qn=(%2BIb%7Cj8o%3FJ(jkkeL07ta_*JRM!6t9B%2CN%3Ey)%2ChXbvU37_*NhSfBghz%5D*vOJ%23_%3DNoUA%5DRgBU_Gr1%3E%3AHuFTn%3ADXqJHZ%3BR%23yAb%2Bho8bYLaXBjA%3AmQ)%3CF!tAbjrzJ%3BgoVYGVxc%40lQQV%23tc3%2Fh%7C%3FVKV%3BW5.NO)Wx%7C*E%24%3D!L2ux%7Ci_lOfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7BA&qp=00000&is=voqBBkBBy4HhBBwBBBBJjBRCqUCY3CTCB6BXwUcu8gKCBS9lYBBBCCBpYFmR4BOZBBgSJTcBBBBBBBBHUoBOFCyz7BB3CZ6mv5TimBBe9oeCt9lXqBvB8fBBBBBBBBBBBBBBCBMBa8eBBkKzQClBeaKaMVMBj5iMPzyHVY9zqxknZlysGBBBcBBBB9CctORpnICyRBBB4OBBBBBBBBBBC9TiFF3dOKBCBBxBBBBBBBfBz1BD7fB3BpkBJUDyDCZ6IDDDCCCCDDCCCCCCCBdh2eBBBGI57kNB8DJoDBBBBCiBBiB&iv=6&qt=0&gz=0&hh=0&hn=0&tw=c%3FgD3W%3CA&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&po=1-0020002000002100&qr=0&vf=1&vg=100&bq=8&g=16&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=433&w=770&om=0&fy=207.5&gp=583&f=0&j=https%3A%2F%2Ft.co&o=3&t=1553044292158&de=976456472846&cu=1553044292158&m=4499&ar=4f071de90bd-clean&cb=0&zMoatSc=1600x1200&zMoatVp=1600x1200&zMoatRawVp=1600x1200&ll=2&lm=0&ln=0&r=0&dl=0&dm=1000&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=583&lb=5391&le=1&gm=1&io=1&ct=undefined&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&as=1&ag=4288&an=4288&gi=1&gf=4288&gg=4288&ez=1&ck=2056&kw=858&aj=1&pg=100&pf=100&ib=1&dw=1&ka=1&kb=1&cc=1&bw=4288&bx=4288&ci=2056&jz=858&dj=1&dx=1&undefined=1&aa=1&ad=4191&cn=4191&gn=1&gk=4191&gl=4191&co=2161&cp=1061&cq=1&cr=1&ew=1&ex=1&hj=1&pv=1&vk=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4309&cd=4309&ah=4309&am=4309&dq=4309&dr=4309&ds=4309&dt=4309&zx=0&wa=2&vm=1&vl=990&vt=990&vd=0&zMoatSRE=0.17365104166666667&zMoatVSD=5&dh=5000&hc=1&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dp=0&dz=1&ea=1&du=55&eb=1&ec=9497&fh=2056&fi=4288&fj=4288&ef=1&eg=1&eh=1&ei=1&ej=1&rf=0&re=1&ft=3780&fv=3780&fw=329&cl=0&at=0&d=%3A%3A4574368938%3A138225997530&dfp=0%2C1&la=4574368938&zMoatPL=vaw-can&zMoatPL2=zdnet&bo=vaw-can&bd=zdnet&gw=cbsiimajsint708425247896&zMoatPT=article&zMoatTest=ad_stack%7C1%7Ccontrol&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=2%3A&tc=0&fs=158226&na=1925389759&cs=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.18.235.40 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:36 GMT
Last-Modified
Fri, 20 May 2016 15:16:00 GMT
Server
Apache
ETag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
Expires
Wed, 20 Mar 2019 01:11:36 GMT
2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800.m3u8
techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/ 		1 KB
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800.m3u8
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.10 , European Union, ASN (),
Reverse DNS
a2-16-186-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9687cf4b6e3c95db7e0e064bc98d4e2821c7eded418cdabfe50f9d157e13022e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Wed, 29 Aug 2018 11:56:15 GMT
server
Apache
status
200
etag
"b82926465ccdd4e70842e648d92911e1:1535543779"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
248
/
cbsinteractive.hb.omtrdc.net/ 		0
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=som.cbsi.com&h:sc:ssl=1&s:user:aid=2E48C99F05310321-40000191C000E2B0&s:user:mid=88302168321446056654240514095442262961&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_2.8.3&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1553044291841249752366&s:event:type=play&l:event:duration=4816&l:event:playhead=0&l:event:ts=1553044296670&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:asset:video_id=8495b1b0-20aa-4299-8f52-f480538e9d83&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=66&s:asset:ad_id=4574368938&s:asset:ad_sid=1553044291853866994814&s:asset:resolver=UVPJS_2.8.3&s:asset:pod_id=c40f02414857f0c6844f01fcd3e31a7a_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_EG_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_EG_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.165.7.225 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-165-7-225.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:12:42 GMT
X-VaRouter-Backend
prod21
Server
nginx
Connection
keep-alive
/
cbsinteractive.hb.omtrdc.net/ 		0
163 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cbsinteractive.hb.omtrdc.net/?s:sc:rsid=cnetzdnetglobalsite&s:sc:tracking_server=som.cbsi.com&h:sc:ssl=1&s:user:aid=2E48C99F05310321-40000191C000E2B0&s:user:mid=88302168321446056654240514095442262961&s:aam:blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&l:aam:loc_hint=6&s:sp:sdk=2.0.1&s:sp:player_name=UVPJS_2.8.3&s:sp:hb_version=js-2.0.2.123-150f2b&l:sp:hb_api_lvl=4&s:event:sid=1553044291841249752366&s:event:type=complete&l:event:duration=0&l:event:playhead=0&l:event:ts=1553044296670&l:event:prev_ts=-1&s:asset:type=ad&s:asset:name=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&s:asset:video_id=8495b1b0-20aa-4299-8f52-f480538e9d83&s:asset:publisher=10D31225525FF5790A490D4D%40AdobeOrg&l:asset:length=66&s:asset:ad_id=4574368938&s:asset:ad_sid=1553044291853866994814&s:asset:resolver=UVPJS_2.8.3&s:asset:pod_id=c40f02414857f0c6844f01fcd3e31a7a_1&s:asset:pod_position=1&l:asset:pod_offset=0&s:asset:pod_name=OAS_Countdown_EG_5&l:asset:ad_length=5&s:asset:ad_name=OAS_Countdown_EG_5&s:stream:type=vod&l:stream:bitrate=0&l:stream:fps=0&l:stream:dropped_frames=0&l:stream:startup_time=0
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.115.34 Ashburn, United States, ASN (),
Reverse DNS
ec2-54-145-115-34.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 20 Mar 2019 01:11:12 GMT
X-VaRouter-Backend
prod21
Server
nginx
Connection
keep-alive
/
www.zdnet.com/homepage/xhr/ 		268 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/homepage/xhr/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e69a7002a27c3e0390efc9dc0478e0d1f8637017c52f37270e3f58dc754aa9ba
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/homepage/xhr/
pragma
no-cache
cookie
muxData=sid=a17f267b-25d6-45af-a722-b0733433092a&sst=1553044296663&sex=1553045796754; fly_device=desktop; fly_geo={"countryCode": "de"}; fly_preferred_edition=eu; fly_default_edition=eu; GED_PLAYLIST_ACTIVITY=W3sidSI6InRUckMiLCJ0c2wiOjE1NTMwNDQyOTcsIm52IjowLCJ1cHQiOjE1NTMwNDQyODUsImx0IjoxNTUzMDQ0Mjg1fV0.
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
28088
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 20 Mar 2019 00:59:38 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:37 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
6b227ed2-9830-4d8e-b8c7-f59021c93045
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=5400, private
set-cookie
ak_bmsc=E48BD57E858577E7630B2FCA2D4FF6FD0210BAB7CD7000004993915C113B4071~plpuGKeIfJGDNeJuBK2ri8PB7OD9Ey3BIs2ecoZoxcRwdp5GQ0M6CHKjc8y/CLSg4aS7mPQDPTtFjiX+PpQEEh4jZNL34B5aI3pfTr/0Acjto3iwbc26mZjC+5Ki6GSPIisbOvi1Vt2xtF8NgkrdXfgiaw+p7DfWHFk2Yba6dJMVfFsdDPoE4Vjp0Ke6Tw1L+dm8OhlkZyQqPDR87CQY9t0QgXawYjHYYwnnB7bhd4KPg=; expires=Wed, 20 Mar 2019 03:11:37 GMT; max-age=7200; path=/; domain=.zdnet.com; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 02:29:38 GMT
ring.gif
zdnet3.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/logos/ 		16 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/logos/ring.gif
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
etag
W/"5c91341f-3f75"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
9039
expires
Wed, 27 Mar 2019 01:11:37 GMT
ZDLogoMicroRed-x2.png
zdnet2.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/logos/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/logos/ZDLogoMicroRed-x2.png
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/cbsdfp5832910442/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
etag
W/"5c91341f-6fa"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1513
expires
Wed, 27 Mar 2019 01:11:37 GMT
ZDLogoMicroWhite-x2.png
zdnet1.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/logos/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/fly/1553019935-fly/bundles/zdnetcss/images/logos/ZDLogoMicroWhite-x2.png
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/1660-fly/css/core/main-4a2e80177e-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Tue, 19 Mar 2019 18:25:35 GMT
server
nginx
etag
W/"5c91341f-691"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1398
expires
Wed, 27 Mar 2019 01:11:37 GMT
metamorworks_iStock-971998294.jpg
creatives.techrepublic.com/whitepapers/pro/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://creatives.techrepublic.com/whitepapers/pro/metamorworks_iStock-971998294.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
64.30.228.207 Fort Lauderdale, United States, ASN (),
Reverse DNS
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
83f52b572975b475afb869014a0efcb4a50339d8e116ceee9cb622c61b14d473

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:38 GMT
Last-Modified
Tue, 19 Mar 2019 20:36:28 GMT
Server
Apache/2.4.18 (Ubuntu)
ETag
"270f-5847875a23099"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=16
Content-Length
9999
windows-10-graphics-intel-warns-patch-19-5c8a68fefe727300b83cce68-1-mar-17-2019-10-04-14-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/03/17/73790a8b-08f9-4462-bd14-078550ad4d8d/thumbnail/170x96/31ba74059191086e95419c78e598911d/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/03/17/73790a8b-08f9-4462-bd14-078550ad4d8d/thumbnail/170x96/31ba74059191086e95419c78e598911d/windows-10-graphics-intel-warns-patch-19-5c8a68fefe727300b83cce68-1-mar-17-2019-10-04-14-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d5b9fee6c9e52a8ce55741081bc61d6e944026dc19b92d8ac06144314080fd9d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"cf88118aa2ba88de549d08038ae76606"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31485043, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
3642
18-percent-of-americans-admit-to-having-5c8a50fe2f64e300dd731ca8-1-mar-17-2019-10-03-39-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/03/17/f5e1b7d8-dac9-4904-ac39-60c8ef684eb0/thumbnail/170x96/9c4badedebe39e8c24fdff7a79d4edd0/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/03/17/f5e1b7d8-dac9-4904-ac39-60c8ef684eb0/thumbnail/170x96/9c4badedebe39e8c24fdff7a79d4edd0/18-percent-of-americans-admit-to-having-5c8a50fe2f64e300dd731ca8-1-mar-17-2019-10-03-39-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
c3c1fef1252e9eb1cd27934e734714bb7490a105362d4e831aaf32677c284536

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"33805671920f0d02e6d18f630985aace"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31376823, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
4575
is-the-end-in-sight-for-cryptojacking-cy-5c8a2420fe727300b83cbceb-1-mar-14-2019-12-31-36-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/03/14/d6202897-6c46-46d2-90c0-b406050f60fc/thumbnail/170x96/540ff83afd268455b6ec90fe545e97be/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/03/14/d6202897-6c46-46d2-90c0-b406050f60fc/thumbnail/170x96/540ff83afd268455b6ec90fe545e97be/is-the-end-in-sight-for-cryptojacking-cy-5c8a2420fe727300b83cbceb-1-mar-14-2019-12-31-36-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1c9936e889b081a50780b09336123729dfe611d241cdc08cd627061995e168f6

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"c182f930a06317057d31c73bb2fedd4f"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=31059889, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
2136
banking-trojans-flood-the-enterprise-and-5c8654982f64e300dd728e9a-1-mar-11-2019-16-17-59-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/03/11/0deed48a-3819-4898-b61b-eb7edc8a6df3/thumbnail/170x96/cc6a9763e455b0b97a83f8c7da91df87/ 		873 B
883 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/03/11/0deed48a-3819-4898-b61b-eb7edc8a6df3/thumbnail/170x96/cc6a9763e455b0b97a83f8c7da91df87/banking-trojans-flood-the-enterprise-and-5c8654982f64e300dd728e9a-1-mar-11-2019-16-17-59-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
45fd3260d9335d17504007cb23b3a142be18b0c1e88cc8ba0e242478b9dd897d

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"98d6f58ab0dafbb86b083a001561bb34"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=30891634, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
652
chinese-hackers-strike-us-universities-i-5c81116f2f64e300c587448c-1-mar-11-2019-16-17-55-poster.jpg
zdnet4.cbsistatic.com/hub/i/r/2019/03/11/0fd2fa2e-564e-4fab-b4e4-f2148bc63baa/thumbnail/170x96/e976b85cd296878f4fcab12a21f4c9f2/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet4.cbsistatic.com/hub/i/r/2019/03/11/0fd2fa2e-564e-4fab-b4e4-f2148bc63baa/thumbnail/170x96/e976b85cd296878f4fcab12a21f4c9f2/chinese-hackers-strike-us-universities-i-5c81116f2f64e300c587448c-1-mar-11-2019-16-17-55-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
aac30469f689bc02880c5bf16bb0377b7c3c1e8ef82eb938c30e597112c87628

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"976abf49974d4686f87192efa0513ae0"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=30838736, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
3152
screen-shot-2019-03-15-at-5-removebg-3.png
zdnet2.cbsistatic.com/hub/i/r/2019/03/15/a9caa222-44a0-4148-8a60-131aadeb2352/thumbnail/170x96/110ef113f046af363b01bb1197f72f2b/ 		48 KB
48 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/03/15/a9caa222-44a0-4148-8a60-131aadeb2352/thumbnail/170x96/110ef113f046af363b01bb1197f72f2b/screen-shot-2019-03-15-at-5-removebg-3.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
da07e38e7eb1d5671ac8e8cee706d83997521051aa91a9b38251c184d9144230

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"7c229eb911f585be823686b4cfccb35f"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=31178966, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
49146
heres-how-to-securely-wipe-your-android-5c7d564add173300c0c29853-1-mar-06-2019-20-54-42-poster.jpg
zdnet2.cbsistatic.com/hub/i/r/2019/03/06/6eccd51c-4eb2-489f-ba0c-ae6e3b4cdc91/thumbnail/170x96/282717928d72133958b40aaece56ccce/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/hub/i/r/2019/03/06/6eccd51c-4eb2-489f-ba0c-ae6e3b4cdc91/thumbnail/170x96/282717928d72133958b40aaece56ccce/heres-how-to-securely-wipe-your-android-5c7d564add173300c0c29853-1-mar-06-2019-20-54-42-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f4a21231c33148c4a2f96e28fb7cb4dcd1c247cdc0347755cd7c78bdef22c161

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"621fbd17da27241c58015eabe4164a52"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=30479653, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
3372
screen-shot-2019-03-15-at-4-46-38-pm.png
zdnet3.cbsistatic.com/hub/i/r/2019/03/15/b555f11c-40bc-4663-b38a-a640e0a33bf2/thumbnail/170x96/669ff716e9b08de683415cce3af75e8f/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/03/15/b555f11c-40bc-4663-b38a-a640e0a33bf2/thumbnail/170x96/669ff716e9b08de683415cce3af75e8f/screen-shot-2019-03-15-at-4-46-38-pm.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
dc2b90567b4e153621056250d4537bca194fa51d9d218c82f05cb9a4e07980aa

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"b08895656b247052add65727526fc044"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=31174743, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
38680
these-major-scammers-just-switched-focus-5c7d0bd6bd785600b9b326e9-1-mar-04-2019-14-39-39-poster.jpg
zdnet1.cbsistatic.com/hub/i/r/2019/03/04/9d8b65fc-d555-4f24-96af-c1c397eb59c2/thumbnail/170x96/cf1118ff47ac3c988ee61a47072d2258/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet1.cbsistatic.com/hub/i/r/2019/03/04/9d8b65fc-d555-4f24-96af-c1c397eb59c2/thumbnail/170x96/cf1118ff47ac3c988ee61a47072d2258/these-major-scammers-just-switched-focus-5c7d0bd6bd785600b9b326e9-1-mar-04-2019-14-39-39-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e08f7f02be50f559acd7166c57472078d9277ad251cb71b446cff681f92f74dd

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"8a0cd50ecce34cfd150d3d512ccf42cf"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=30366980, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
6462
youtube-to-disable-comments-on-videos-fe-5c7c94ccfe727300b980ac00-1-mar-04-2019-5-36-42-poster.jpg
zdnet3.cbsistatic.com/hub/i/r/2019/03/04/7f5a8362-cc6f-4196-85c7-d30e83336c44/thumbnail/170x96/ffd895bbcb8b40d3c231160a511dd7e4/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet3.cbsistatic.com/hub/i/r/2019/03/04/7f5a8362-cc6f-4196-85c7-d30e83336c44/thumbnail/170x96/ffd895bbcb8b40d3c231160a511dd7e4/youtube-to-disable-comments-on-videos-fe-5c7c94ccfe727300b980ac00-1-mar-04-2019-5-36-42-poster.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
05810003dc685a05be39bb0dccf45f696dbf053bedff37512d8b0b016697df30

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
server
nginx
access-control-allow-origin
http://origin.img.hub.zdnet.com
etag
"084afd913ab1e6ea58b8ca73f6cb41a6"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
public, max-age=30328839, s-maxage=21600
content-transfer-encoding
binary
timing-allow-origin
*
content-length
4801
arrows-sfb3cc8e09f.png
zdnet2.cbsistatic.com/fly/images/sprites/ 		430 B
611 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://zdnet2.cbsistatic.com/fly/images/sprites/arrows-sfb3cc8e09f.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
189bac19ed72631b5d881ef5cd82042a1deb6f2e84ffcc2f09888db4581a14bc

Request headers

Referer
https://zdnet4.cbsistatic.com/fly/css/video/htmlPlayerControls/controls-9423ff3b54-rev.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
last-modified
Mon, 14 Jan 2019 21:13:48 GMT
server
nginx
etag
"5c3cfb8c-1ae"
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
430
expires
Wed, 27 Mar 2019 01:11:37 GMT
river-time-ago-f2210a157b-rev.js
zdnet4.cbsistatic.com/fly/js/components/ 		753 B
637 B 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/js/components/river-time-ago-f2210a157b-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Mon, 26 Nov 2018 11:30:11 GMT
server
nginx
etag
"5bfbd943-2f1"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
accept-ranges
bytes
timing-allow-origin
*
content-length
426
expires
Wed, 27 Mar 2019 01:11:37 GMT
load-more-180e93ae95-rev.js
zdnet3.cbsistatic.com/fly/js/components/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet3.cbsistatic.com/fly/js/components/load-more-180e93ae95-rev.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9054d29b95733bdf0cfbe40f3831248046b2ca565ef4332366327b7dc3518bd4

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Thu, 07 Mar 2019 18:36:31 GMT
server
nginx
etag
W/"5c8164af-1271"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
1784
expires
Wed, 27 Mar 2019 01:11:37 GMT
/
www.zdnet.com/newsletter/xhr/widget-login/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/newsletter/xhr/widget-login/?topic=
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4055b2bd50dca3fe0011680651cc8a81a939ce5f195e0bc435f43880acdcde83
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/newsletter/xhr/widget-login/?topic=
pragma
no-cache
cookie
muxData=sid=a17f267b-25d6-45af-a722-b0733433092a&sst=1553044296663&sex=1553045796754; fly_device=desktop; fly_geo={"countryCode": "de"}; fly_preferred_edition=eu; fly_default_edition=eu; GED_PLAYLIST_ACTIVITY=W3sidSI6InRUckMiLCJ0c2wiOjE1NTMwNDQyOTcsIm52IjowLCJ1cHQiOjE1NTMwNDQyODUsImx0IjoxNTUzMDQ0Mjg1fV0.; ak_bmsc=FACBA8C1170DE0F852389977DAAC60B60210BAB7CD7000004993915C0B61FF19~plveQflfwc4n3Dhwt70jB+4qt/fpBFqa5cwVs06yflKEAWTpOyGHXWEyIiwOEdbCLmyrNLDH+AD6GvenFoZueWy2GmZnQXhz0v6cFzfjyREcR+Xnrp8Jn7m6RedXBPpzh+yU73j6Lr2AzcDqEB3zQ1+V9COlR4aTD2Z7OTNMn/EWAstxMSRjixzbDi3FnNYjjff8kRXCtlbeSGdHiE8xvHFtSkh6Aj32eSGyG1Nz/1PIU=
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
:method
GET
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
735
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:37 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
282183ab-669c-407d-a5d4-bbf34dbc73d6
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
set-cookie
fly_session=if0kn3obbu5qesv25hiuhmdoo6; path=/; domain=.zdnet.com; secure; HttpOnly bm_sv=2DE4BA789EC30F3FEEBB55EA55AC8553~NrmDLJek2ujkTJqz+6VH6M6/Hfk8cBbdiz1jrwad/2mPRg7MYHYPJjmCs9SdtHX2kkt5HEiCoxzi2CgdgIh+/R3TgwRSljB6Vp+8jRu+npuarD0HImneB1C4v00TOg2w3pJEc0cX6C7zda0rN9Vlj8vuUjmk1iBAQDuNDzqRhJk=; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 01:11:37 GMT
/
www.zdnet.com/m3d0s1/xhr/horizontal/ 		13 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.zdnet.com/m3d0s1/xhr/horizontal/
Requested by
Host: zdnet3.cbsistatic.com
URL: https://zdnet3.cbsistatic.com/fly/1660-fly/js/main.default.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.143 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-143.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5ff3e87f6937201a01936ab86e549cf89396892ba3bf3884dbe29d7b1d6277f6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/m3d0s1/xhr/horizontal/
pragma
no-cache
cookie
muxData=sid=a17f267b-25d6-45af-a722-b0733433092a&sst=1553044296663&sex=1553045796754; fly_device=desktop; fly_geo={"countryCode": "de"}; fly_preferred_edition=eu; fly_default_edition=eu; GED_PLAYLIST_ACTIVITY=W3sidSI6InRUckMiLCJ0c2wiOjE1NTMwNDQyOTcsIm52IjowLCJ1cHQiOjE1NTMwNDQyODUsImx0IjoxNTUzMDQ0Mjg1fV0.; ak_bmsc=FACBA8C1170DE0F852389977DAAC60B60210BAB7CD7000004993915C0B61FF19~plveQflfwc4n3Dhwt70jB+4qt/fpBFqa5cwVs06yflKEAWTpOyGHXWEyIiwOEdbCLmyrNLDH+AD6GvenFoZueWy2GmZnQXhz0v6cFzfjyREcR+Xnrp8Jn7m6RedXBPpzh+yU73j6Lr2AzcDqEB3zQ1+V9COlR4aTD2Z7OTNMn/EWAstxMSRjixzbDi3FnNYjjff8kRXCtlbeSGdHiE8xvHFtSkh6Aj32eSGyG1Nz/1PIU=; upid_855134808=1
origin
https://www.zdnet.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/x-www-form-urlencoded; charset=UTF-8
accept
application/json, text/javascript, */*; q=0.01
cache-control
no-cache
:authority
www.zdnet.com
x-requested-with
XMLHttpRequest
:scheme
https
referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
content-length
495
:method
POST
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy
frame-ancestors 'self' *.zdnet.com *.ampproject.org *.amp.cloudflare.com; default-src https: blob: 'unsafe-inline' 'unsafe-eval'; font-src https: blob: data:; img-src https: data: android-webview-video-poster: blob:; form-action https:; block-all-mixed-content; media-src https: blob: data:;
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding, User-Agent
content-length
1636
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
nginx
x-frame-options
SAMEORIGIN
date
Wed, 20 Mar 2019 01:11:37 GMT
expect-ct
max-age=0, report-uri="https://7a8f8748a40805618a61b617481a6ebc.report-uri.com/r/d/ct/reportOnly"
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-tx-id
ec4c8115-e1c0-48d1-8931-0a14311020da
content-type
application/json
access-control-allow-origin
https://www.zdnet.com
cache-control
max-age=0, no-cache, no-store
set-cookie
bm_sv=FDF42FA68B9A9E6243B2B95AA2539D74~NrmDLJek2ujkTJqz+6VH6OI6jpBwMsrb4swKBWQBSZZpGHW2dCibaPoMXBPpCyNjKhWBhxP0EeyhoqtfQ8NeByfXWSmOU410t2S1eZrqmRWXchci5dLwBy2hUKZ4JvLxUeFKFH881TgYwE0xZTcVPbEVzfCS/XiuL2frMaJb9xY=; Domain=.zdnet.com; Path=/; Max-Age=7200; HttpOnly
accept-ranges
bytes
expires
Wed, 20 Mar 2019 01:11:37 GMT
domains
api.viglink.com/api/ 		42 B
721 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.87.193 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
749f1db8e5816cc120f6eb046ab08188e94528d8f0d8ab45bde3738b948cfe44

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:37 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
load-more-1.0.js
zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zdnet4.cbsistatic.com/fly/bundles/flyjs/js/components/load-more-1.0.js
Requested by
Host: zdnet2.cbsistatic.com
URL: https://zdnet2.cbsistatic.com/fly/1660-fly/js/libs/require-2.1.2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.149 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-149.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
last-modified
Wed, 20 Jun 2018 16:57:54 GMT
server
nginx
etag
W/"5b2a8792-1f51"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
timing-allow-origin
*
content-length
2472
expires
Wed, 27 Mar 2019 01:11:37 GMT
vglnk.js
cdn.viglink.com/api/ 		78 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.viglink.com/api/vglnk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0dd0d42e82bfcc16e96fb72d732787a0edf0bc99b0a34f6f6eaaf1d1b32a8f9

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
10188A31AAAD84F6
status
200
content-length
27355
x-amz-id-2
DqydBfcU3scbnAmCHibbgGUjt9NeYrjWjZWtMQ9zgQT9RYVOhrlkzz28Ae6Ws0CLqevAPK6qseU=
last-modified
Thu, 28 Feb 2019 16:44:17 GMT
server
cloudflare
etag
"e4a0c710d19e7cd4fd23cd54aeb7db5e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=1800
accept-ranges
bytes
cf-ray
4ba3d02ded4763a3-FRA
expires
Wed, 20 Mar 2019 01:41:37 GMT
0.6658760324956546
saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/ 		43 B
544 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://saa.cbsi.com/b/ss/cbsib2bleadgen/1/G.4--NS/0.6658760324956546?AQB=1&ce=UTF%2D8&events=event66&v0=&v2=en&v3=desktop&v4=horizontal&v5=zdnet&v10=article&v20=vulnerability+exposes+location+of+thousands+of+malware+c%26c+servers&v22=content_article&v23=&v24=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&v30=91a1429b-0d61-43fd-b421-a8b6e260e98c&v60=33166080,33166079,33166086,33165738&v64=22149&v69=&c0=D%3Dv0&c2=D%3Dv2&c3=D%3Dv3&c4=D%3Dv4&c5=D%3Dv5&c10=D%3Dv10&c20=D%3Dv20&c22=D%3Dv22&c23=D%3Dv23&c24=D%3Dv24&c30=D%3Dv30&c60=D%3Dv60&c64=D%3Dv64&c69=D%3Dv69&pe=lnk_o&pev2=medusa_impression&vid=201903201-leadgen-zdnet&mid=90240133173074011141898988208131324462&aid=2D535D450507F28B-40000106A0001145&AQE=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.37 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
cbsi.com.ssl.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 20 Mar 2019 01:11:37 GMT
X-C
ms-6.6.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Thu, 21 Mar 2019 01:11:37 GMT
Server
Omniture DC
xserver
www235
ETag
"3335137232514252800-6170073482727016101"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Tue, 19 Mar 2019 01:11:37 GMT
e.gif
dw.cbsi.com/levt/ria/ 		43 B
369 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dw.cbsi.com/levt/ria/e.gif?rsid=cnetzdnetglobalsite&sid=2&siteid=2&pagetype=article&assetguid=91a1429b-0d61-43fd-b421-a8b6e260e98c&assettitle=vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20c%26c%20servers&assettype=content_article&pubdate=2019-02-28%2018%3A26%3A07&viewguid=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&devicetype=desktop&sitetype=responsive%20web&author=catalin%20cimpanu&authorid=85fd8691-f525-4ea2-a601-af296f629f7f&topicguid=113c25b6-ec91-11e3-95d2-02911863765e&topic=security&topicbrcrm=security&s8=cnetzdnetglobalsite&v23=cnetzdnetglobalsite&v19=article&v17=113c25b6-ec91-11e3-95d2-02911863765e&v20=91a1429b-0d61-43fd-b421-a8b6e260e98c&v16=4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e&riaevent=impression&comptyp=spot&mapp=medusa_app&objtyp=medusa&eventt=log&v18=security&comp=ucwc&ts=1553044297908&tcset=utf8&im=dsjs&title=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&srcurl=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.30.230.22 Fort Lauderdale, United States, ASN6623 (CBSI-1 - CBS Interactive Inc., US),
Reverse DNS
phx2-dw-cbsi-xw-ext-lb.cnet.com
Software
Apache/2.4.25 /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:37 GMT
Server
Apache/2.4.25
Vary
*
Content-Type
image/gif
Cache-Control
no-cache, must-revalidate, no-transform
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=80, max=705
Content-Length
43
Expires
Fri, 23 Jan 1970 12:12:12 GMT
2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_0.ts
techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/ 		1 MB
1 MB 		XHR
General
Check archive.org
Download Go to
Full URL
https://techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_0.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.10 , European Union, ASN (),
Reverse DNS
a2-16-186-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ba51b58715ae4fc95299983d24084284cedc4ac7ffd840818517d1997b9c68a5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:37 GMT
last-modified
Wed, 29 Aug 2018 11:56:16 GMT
server
Apache
etag
"70c1f9f9d3671e68513553287de45c9f:1535543779"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1181392
ecbdae22-acff-49e5-a7c6-e11bbb9325cf
https://www.zdnet.com/ 		61 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.zdnet.com/ecbdae22-acff-49e5-a7c6-e11bbb9325cf
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c34da761727d7d301b12207d336e5b0486df63e2bb18fcf279769d519900b5a7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length
62104
Content-Type
text/javascript
2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_1.ts
techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/ 		1 MB
1 MB 		XHR
General
Check archive.org
Download Go to
Full URL
https://techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_1.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.10 , European Union, ASN (),
Reverse DNS
a2-16-186-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b3bd90c13adfc8669f005d1d87e89f6e5c637e3656a0ac4b2fffaf3e6cf883f2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
last-modified
Wed, 29 Aug 2018 11:56:17 GMT
server
Apache
etag
"c7b11b6ac4fd0ca6abdc986245ab2f7f:1535543779"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1269376
json
trc.taboola.com/cbsinteractive-zdnet/trc/3/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/trc/3/json?tim=01%3A11%3A38.244&data=%7B%22id%22%3A898%2C%22ii%22%3A%22%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%22%2C%22it%22%3A%22text%22%2C%22sd%22%3A%22v2_f635b19b611a3c141d55ab9e00c8dbe0_b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2_1553044290_1553044290_CGoQzro_GN3znMWZLSABKAEwODib4wlAgooQSJjEF1Cl7BBYAWAA%22%2C%22ui%22%3A%22b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2%22%2C%22uifp%22%3A%22b63b481e-653a-423d-95b3-e754912d3662-tuct38b18c2%22%2C%22vi%22%3A1553044290013%2C%22cv%22%3A%22350-59-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22e%22%3A%22https%3A%2F%2Ft.co%2F00ebQBQ0nK%22%2C%22bad%22%3A-1%2C%22bw%22%3A1600%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A4%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22orig_uip%22%3A%22ZDNETfront_doorDesktop%2FTablet-Bottom%20Page%20Thumbnails%22%2C%22cd%22%3A8993.328125%2C%22mw%22%3A770%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_2%22%2C%22lt%22%3A%22normal%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.350-59-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
6ee11fe3dee241762a48c675b874ee3d25c02f695f8b5c6652f7596bcba84146

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
content-encoding
gzip
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
via
1.1 varnish
x-served-by
cache-fra19172-FRA
server
nginx
x-timer
S1553044298.248335,VS0,VE94
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_s...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_...
43 B
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=end&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=6509&ns_st_det=1667&ns_st_upc=4842&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=4842&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=4842&ns_st_dlpc=0&ns_st_lpa=4842&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298336&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:38 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=end&ns_st_po=4842&ns_st_cl=5000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=1&ns_st_ad=1&ns_st_ci=0&ns_st_pt=4842&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=6509&ns_st_det=1667&ns_st_upc=4842&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=4842&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=4842&ns_st_dlpc=0&ns_st_lpa=4842&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298336&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=1&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_an=1&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va11&ns_st_st=*null&ns_st_pu=*null&c3=*null&c4=*null&c6=*null&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:38 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
p2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/p?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_s...
  • https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_...
43 B
309 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=2&ns_st_ev=play&ns_st_po=0&ns_st_cl=66000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=8495b1b0-20aa-4299-8f52-f480538e9d83&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298337&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C2_8_3&c4=3000074&c6=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.214.103 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-214-103.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:38 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://sb.scorecardresearch.com/p2?c1=2&c2=3005086&ns_type=hidden&ns_st_sv=6.1.1.171219&ns_st_smv=5.8&ns_st_it=r&ns_st_id=1553044287744&ns_st_ec=4&ns_st_sp=1&ns_st_sc=1&ns_st_psq=2&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=2&ns_st_ev=play&ns_st_po=0&ns_st_cl=66000&ns_st_mp=js_api&ns_st_mv=6.1.1.171219&ns_st_pn=1&ns_st_tp=0&ns_st_ci=8495b1b0-20aa-4299-8f52-f480538e9d83&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=4842&ns_ts=1553044298337&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=1&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=ZDNet%20Video&ns_st_sn=*null&ns_st_en=*null&ns_st_ct=vc12&ns_st_ge=*null&ns_st_st=3000074&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=zdnet&c3=UVPJS%7C2_8_3&c4=3000074&c6=Free%20malware%20tools%20are%20being%20exploited%20for%20malicious%20intent&c7=https%3A%2F%2Fwww.zdnet.com%2Farticle%2Fvulnerability-exposes-location-of-thousands-of-malware-c-c-servers%2F&c8=Vulnerability%20exposes%20location%20of%20thousands%20of%20malware%20C%26C%20servers%20%7C%20ZDNet&c9=https%3A%2F%2Ft.co%2F00ebQBQ0nK
Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:38 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
available
trc.taboola.com/cbsinteractive-zdnet/log/3/ 		0
248 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/cbsinteractive-zdnet/log/3/available
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.350-59-RELEASE.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 20 Mar 2019 01:11:38 GMT
via
1.1 varnish
server
nginx
x-timer
S1553044298.397753,VS0,VE9
x-served-by
cache-fra19172-FRA
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://www.zdnet.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
4c8e1da1fa2ed9e65e939d43148aa873.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4c8e1da1fa2ed9e65e939d43148aa873.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
6f1ecdc6e1cc25f45a4e443feab35fb71d5a138c6794b5e1c5776d7c51536850

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
via
1.1 varnish
age
689524
x-cache
HIT
status
200
expiration
expiry-date="Sun, 17 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4c8e1da1fa2ed9e65e939d43148aa873.jpg
content-length
8674
x-served-by
cache-fra19172-FRA
last-modified
Thu, 14 Feb 2019 10:31:15 GMT
server
cloudinary
x-timer
S1553044298.403445,VS0,VE0
etag
"6dd990e053b3083a03b0d8131b255bcd"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
175
e5f99a10dfbedfa84a2373e5a75d1799.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e5f99a10dfbedfa84a2373e5a75d1799.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
42524a0bbe884559ead24e7d660fe008ede736851ca050875a6c6fc6441f3d1c

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
via
1.1 varnish
age
596686
x-cache
HIT
status
200
expiration
expiry-date="Fri, 22 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e5f99a10dfbedfa84a2373e5a75d1799.png
content-length
8020
x-served-by
cache-fra19172-FRA
last-modified
Tue, 19 Feb 2019 15:08:14 GMT
server
cloudinary
x-timer
S1553044298.403459,VS0,VE0
etag
"979ad04cc6a81acb36f965ac479aacb0"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
479
fb558f2ac04f91fd5c2314df7fb9019c.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/fb558f2ac04f91fd5c2314df7fb9019c.jpeg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
2c74bfb0845ea3dba284aeecc89879263177d39b29187366ed39c7dba7125e04

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
via
1.1 varnish
age
840957
x-cache
HIT
status
200
expiration
expiry-date="Mon, 25 Mar 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/fb558f2ac04f91fd5c2314df7fb9019c.jpeg
content-length
17553
x-served-by
cache-fra19172-FRA
last-modified
Fri, 22 Feb 2019 03:52:23 GMT
server
cloudinary
x-timer
S1553044298.403600,VS0,VE0
etag
"2edac8e7434d68d1e9f62968235d3630"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
982
3_1000x600_d6636500fb12643ba4b472eef3e73fd3.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/08e05a9a-eb2b-4cf4-97b5-01fd088bdbc0/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/08e05a9a-eb2b-4cf4-97b5-01fd088bdbc0/3_1000x600_d6636500fb12643ba4b472eef3e73fd3.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
660ce45278eb580ba9a3be98b96a36462987a8788aaeba31b1f34e740bba7436

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
via
1.1 varnish
age
419991
x-cache
HIT
status
200
expiration
expiry-date="Sun, 14 Apr 2019 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_184%2Cw_220%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//console.brax-cdn.com/creatives/08e05a9a-eb2b-4cf4-97b5-01fd088bdbc0/3_1000x600_d6636500fb12643ba4b472eef3e73fd3.png
content-length
9883
x-served-by
cache-fra19172-FRA
last-modified
Thu, 14 Mar 2019 08:46:23 GMT
server
cloudinary
x-timer
S1553044298.403738,VS0,VE0
etag
"bd3d6e6c1a441425e4d3f88fd1e7ba9c"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
9
domains
api.viglink.com/api/ 		42 B
721 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.viglink.com/api/domains
Requested by
Host: cdn.viglink.com
URL: https://cdn.viglink.com/api/vglnk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.87.193 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-72-87-193.eu-west-1.compute.amazonaws.com
Software
Apache-Coyote/1.1 /
Resource Hash
3e2f324389d28812d8b269dc4773087af97aa64560834ea13ef504ffd181f781

Request headers

Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 20 Mar 2019 01:11:37 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.zdnet.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT
2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_2.ts
techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/ 		1 MB
1 MB 		XHR
General
Check archive.org
Download Go to
Full URL
https://techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_2.ts
Requested by
Host: vidtech.cbsinteractive.com
URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2.16.186.10 , European Union, ASN (),
Reverse DNS
a2-16-186-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
39592ddbdbadaa388b4caae32b981aa586b7de875ac1c31a0ce252bf41394f3c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/
Origin
https://www.zdnet.com

Response headers

date
Wed, 20 Mar 2019 01:11:38 GMT
last-modified
Wed, 29 Aug 2018 11:56:19 GMT
server
Apache
etag
"ecfc7b4d2fc7e2ee8189df5ef691d95d:1535543779"
status
200
content-type
video/MP2T
access-control-allow-origin
https://www.zdnet.com
akamai-mon-iucid-del
525165
accept-ranges
bytes
content-length
1247380
2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_3.ts
techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
techrepublicmedia.akamaized.net
URL
https://techrepublicmedia.akamaized.net/media/2018/08/29/1308810307668/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800/2018-08-29-wochit-free-malware-tools-are-being-exploited-for-malicious-intent_1646106_1800_3.ts

Verdicts & Comments Add Verdict or Comment

348 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| soastaTracking object| ZdnetPageVars object| ZdnetFunctions boolean| gdprConsent object| evidon object| knownServiceWorkers object| cbsiGptDivIds function| UUIDv4 string| __tealium_data_guid object| utag_data function| requirejs function| require function| define number| BOOMR_lstart object| _sp_ function| $ function| jQuery object| googletag object| closure_memoize_cache_ object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken object| headertag function| headertag_render object| pbjs object| BOOMR object| BOOMR_mq string| testGroup string| testName object| __core-js_shared__ function| setImmediate function| clearImmediate function| UUIDv1 function| clamp object| STR undefined| UUID object| Audit object| GPT_jstiming undefined| google_measure_js_timing object| swfobject object| Modernizr function| Waypoint object| jQuery183036139819033595266 object| debug object| CryptoJS object| mPulseApp object| utag_err boolean| utag_condload function| getCookieValue object| isInternal object| js object| s object| adData string| adCookieName undefined| adCookieData undefined| adRegion function| parseJson object| match object| utag function| runInternalUserFuncs function| cbsiInternal function| _tealium_old_error boolean| isEuUser object| vglnk object| omnitureMgr object| dwMgr object| om function| lightboxjs function| lightboxlib object| _ml object| EF number| BOOMR_configt function| setUpAgknTag function| dw_callback function| vl_cB function| vl_disable function| vglnk_15530442859806 object| __ql string| path string| host object| scriptTags object| _bmrEvents function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq function| doSiteCatalystTag object| headID object| newScript object| s_c_il number| s_c_in function| Visitor object| visitor function| DIL number| s_objectID number| s_giq function| agknTagBuilder object| _agknTag string| _agknTagName object| _agknEchoTag number| _isAgknTagSet function| renderAdCallback function| blankAdCallback string| firstpgvar string| waypointContextKey object| sticky object| TRUE_ANTHEM undefined| _ function| Hls undefined| uuid function| addResizeListener function| removeResizeListener function| Spinner object| uvpjs function| Class object| mpulseUserTiming object| DIGIOH_API object| LIGHTBOX_API object| DW undefined| vglnk_15530442864817 function| dw_anonc object| DW_anonc object| optimizely string| f0 object| omMgr undefined| vglnk_15530442866419 object| s_i_cnetzdnetglobalsite number| BOOMR_onload string| adBlockCookieValue object| $tealium boolean| google_noFetch boolean| google_DisableInitialLoad number| __google_ad_urls_id object| ret boolean| searchOpen object| $lastFocusedInput string| pageType function| udm_ function| ns_order object| ns_ object| ns_p string| ZN_3xeBFJDuSs0SRW5_ed string| ZN_3xeBFJDuSs0SRW5_sampleRate string| ZN_3xeBFJDuSs0SRW5_url function| fbq function| _fbq number| google_unique_id object| google_reactive_ads_global_state object| gaGlobal object| UA object| QSI string| disqus_shortname function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter number| _rnd string| __prot object| __i undefined| jQuery17106550358415670661_1553044286208 function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| ima object| google object| platform function| mux object| ADB object| NOLCMB object| closure_lm_511062 boolean| autoplay object| google_persistent_state_async number| google_global_correlator object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| NOLBUNDLE object| closure_lm_149677 function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| jQuery17106550358415670661 object| TRC object| _tblConsole object| _taboola object| _comscore undefined| msg string| pm_pgtp object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| MoatDataJsonpRequest undefined| vglnk_155304428850011 object| COMSCORE string| pm_ppy string| pm_geo string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb function| _pmloadfile object| bbVer object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv undefined| _tb_d undefined| _tb_rand function| getBBVersion function| _tb_getUrlParameter object| _pm_mcm function| pmws_request_done object| _tb_ext_xp string| emmUrlKey string| optoutCookieKey object| ns object| paramsPassed object| stateObject string| BUILDVERSION object| stateEvents object| DISQUSWIDGETS undefined| disqus_domain function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcDOMWalker function| __trcPurgeEventHandlers function| __trcJSONify function| __trcUnJSONify function| __trcGetMargins function| __trcAttachResize function| __trcDetachResize function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager object| params number| trc_debug_level string| trc_article_id string| trc_item_url object| TRCImpl object| google_jobrunner object| google_prev_clients number| taboola_view_id object| _pmk function| TBWidgetStorage function| TBWidgetPersonalization function| TBWidgetWhatsApp function| TBWidgetGawkerComments function| TBWidgetGawkerPersonalization function| TBWidgetWeatherStories function| TBWidgetFBCommentPersonalization function| TBWidgetDisqusPersonalization function| TBWidgetFacebookComments function| TBWidgetCommentButton function| TBWidgetMsnTsb function| TBClickToPlayVideo function| TBClickToPlayVideoElem function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBKalturaPlayer function| TBBrightcovePlayer function| TBOoYalaPlayer function| TBMSNPlayer function| TBWidgetMsnTsbPersonalization function| TBVideoCarousel function| TBVideoRightRail function| TBWidgetVideoPersonalization function| TBWidgetFPORunner function| PMTargeting function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| TBWidgetFacebook function| TBWidgetTwitter function| TBWidgetAddThis function| TBWidgetShareThis function| TBWidgetDisqus function| TBWidgetGigya function| TBWidgetReddit function| TBWidgetPinterest function| TBWidgetSC function| TBWidgetSTPPersonalization function| TBWidgetSCPersonalization function| _comcast_fn function| PMRetry function| PMGlobal function| PMIdentifier function| pmws_getlocation_done object| pmdebug object| pmws object| xq string| GoogleAnalyticsObject function| ga object| _pm_mcg object| tbopt function| PMAd function| openx_ad_request_done function| pm_image_onload_done object| google_tag_data object| gaplugins object| gaData undefined| vglnk_155304429142012 undefined| ct undefined| et undefined| hourElapsed undefined| pixelDomain undefined| pxSrc undefined| px object| callbacks object| Moat#PML#26#1.2 number| creativeWidth number| creativeHeight object| time function| str-time-sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn-8ec3a4f3-1 function| str-third-party-sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn-8ec3a4f3-1 function| str-visibility-sfp-DSdrhvfpf9fKFnVcMUMyWfL4Gn-8ec3a4f3-1 object| Moat#PSCB95355988 function| MoatPxIOPT2849936 object| Moat#PSCB18906838 function| MoatPxIOPT59055541 object| Moat#PSCB57866470 function| MoatPxIOPT54222358 object| Moat#PSCB36213534 function| MoatPxIOPT27907578 number| customInviewPercentThreshold

29 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 88531462596589170174219556101805620937
.www.lightboxcdn.com/ Name: __cfduid
Value: dfd39b65b0aec279789b1bea33e1e44811553044285
.zdnet.com/ Name: RT
Value: "sl=1&ss=1553044282770&tt=4190&obo=0&bcn=%2F%2F0211c814.akstat.io%2F&sh=1553044286967%3D1%3A0%3A4190&dm=zdnet.com&si=f2bd5cea-91f0-4820-af44-2676edf40ae1&ld=1553044286967"
.zdnet.com/ Name: utag_main
Value: v_id:016998a729820014cad51407097800078006107000b08$_sn:1$_ss:0$_st:1553046086914$ses_id:1553044285827%3Bexp-session$_pn:1%3Bexp-session$linktag:undefined%3Bexp-session
.zdnet.com/ Name: s_lv_zdnet_s
Value: First%20Visit
.zdnet.com/ Name: aam_uuid
Value: 88531462596589170174219556101805620937
.zdnet.com/ Name: fly_default_edition
Value: eu
.zdnet.com/ Name: AMCV_10D31225525FF5790A490D4D%40AdobeOrg
Value: -894706358%7CMCMID%7C88302168321446056654240514095442262961%7CMCAAMLH-1553649086%7C6%7CMCAAMB-1553649086%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1553051486s%7CNONE%7CMCAID%7C2E48C99F05310321-40000191C000E2B0%7CvVersion%7C2.3.0
.demdex.net/ Name: dextp
Value: 269-1-1553044286714|477-1-1553044286816|771-1-1553044286918|22052-1-1553044287018
.agkn.com/ Name: u
Value: C|0CEAkJE--JCRPvgAAAAABAg1RAQCADVIBAIABEUEAAAAA
.zdnet.com/ Name: AMCVS_10D31225525FF5790A490D4D%40AdobeOrg
Value: 1
www.zdnet.com/ Name: viewGuid
Value: 4f8e5f11-46a0-46b0-b6cd-6d3fcc5afa6e
.zdnet.com/ Name: s_invisit
Value: true
.agkn.com/ Name: ab
Value: 0001%3AQhEHP4tfQ%2BTdyrg1Eh2QauOWe68sc2h%2FHcXJu2ftvkcJ3J8ghDx4CQ%3D%3D
www.zdnet.com/ Name: _ccmaid
Value: 5978151465408062634
.zdnet.com/ Name: fly_geo
Value: {"countryCode": "de"}
.zdnet.com/ Name: first_page_today
Value: false
.zdnet.com/ Name: s_vnum
Value: 1555636286519%26vn%3D1
www.zdnet.com/ Name: XCLGFbrowser
Value: BxabzFyRkz5icIhQVCI
.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers Name: CBS_INTERNAL
Value: 0
.zdnet.com/ Name: fly_preferred_edition
Value: eu
.zdnet.com/ Name: s_lv_zdnet
Value: 1553044286520
.zdnet.com/ Name: fly_device
Value: desktop
.zdnet.com/ Name: s_cc
Value: true
www.zdnet.com/ Name: _ccmsi
Value: 1553044286071_735y9r83i|1553044286071
.zdnet.com/ Name: s_getNewRepeat
Value: 1553044286520-New
.zdnet.com/ Name: zdnet_ad
Value: %7B%22type%22%3A%22gpt%22%2C%22region%22%3A%22uk%22%2C%22session%22%3A%22f%22%2C%22subSession%22%3A%226%22%7D
.zdnet.com/ Name: nemo_highlander
Value: ad_stack%3a1%3acontrol
www.zdnet.com/ Name: LDCLGFbrowser
Value: 729ffe36-ddd1-4420-b951-3a9854c61bfa

63 Console Messages

Source Level URL
Text
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service pending (GDPR consent not granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service pending (GDPR consent not granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service pending (GDPR consent not granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service pending (GDPR consent not granted): script_gpt
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 744)
Message:
ADS: queuing nav-ad-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1214)
Message:
ADS: queuing intromercial-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1281)
Message:
ADS: queuing leader-plus-top-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1435)
Message:
ADS: queuing inpage-video-top-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1445)
Message:
ADS: queuing sharethrough-top-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1669)
Message:
ADS: queuing mpu-plus-top-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1779)
Message:
ADS: queuing dynamic-showcase-top-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 1786)
Message:
ADS: queuing mpu-middle-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 2014)
Message:
ADS: queuing mpu-bottom-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 2031)
Message:
ADS: queuing leader-plus-bottom-5c91933ba07ea for display
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service pending (GDPR consent not granted): script_sharethrough
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
GDPR consent granted
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent finally granted): script_indexexchange
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent finally granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent finally granted): script_sourcepoint
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent finally granted): script_gpt
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent finally granted): script_sharethrough
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_mpulse
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): _injectQueryStringGCP
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 9)
Message:
Missing adCookieData!
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_ad
console-api log (Line 2)
Message:
ADS: queuing mpu-bottom-5c91933ba07ea for display
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.1787.js?utv=ut4.43.201902042326(Line 177)
Message:
Service: sitecatalyst
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_video
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_sharebar
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_urban_airship
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_disqus_count
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/CBSI-PLAYER.js(Line 20)
Message:
UVPJS 2.8.3 03/26/18 8:42:19 AM (PDT)
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api warning URL: https://zdnet1.cbsistatic.com/fly/js/libs/mpulse-1.0.2.js(Line 8)
Message:
mPulse: Custom Timer 'video_ploaded' is not defined
console-api log (Line 33)
Message:
blank creative loaded: 138239360681 (7 x 7, pos=nav)
console-api log (Line 33)
Message:
blank creative loaded: 138247985732 (300 x 250, pos=bottom)
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 164)
Message:
Dynamic Showcase Center container ::: creative id = 138247024569
console-api log URL: https://www.lightboxcdn.com/vendor/a1583f50-579b-41d0-8c4e-1cd1790d945c/user.js?cb=636885417988309970(Line 1401)
Message:
ERROR:::: custom_js_boxes() - Cannot read property 'topicTag_var' of undefined
console-api log (Line 33)
Message:
blank creative loaded: 138239468731 (372 x 142, pos=)
console-api log (Line 33)
Message:
blank creative loaded: 138239375180 (372 x 142, pos=)
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28)
Message:
[01:11:31 GMT+0000 (Coordinated Universal Time).905] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.
console-api log (Line 33)
Message:
blank creative loaded: 138239368367 (641 x 321, pos=top)
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_taboola
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_async_load
console-api log URL: https://www.zdnet.com/article/vulnerability-exposes-location-of-thousands-of-malware-c-c-servers/(Line 104)
Message:
Service loading (GDPR consent already granted): script_medusa_recommendation
console-api log URL: https://tags.tiqcdn.com/utag/cbsi/zdnetglobalsite/prod/utag.js(Line 92)
Message:
zdnet
console-api log URL: https://vidtech.cbsinteractive.com/uvpjs/2.8.3/lib/tracking/adobe/VideoHeartbeat-2.0.2.min.js(Line 28)
Message:
[01:11:38 GMT+0000 (Coordinated Universal Time).269] [ERROR] [MediaHeartbeat] API call trackPlay is unsupported in the current state.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 1; mode=block; report=https://twitter.com/i/xss_report

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0211c814.akstat.io
5f651e6f.akstat.io
ad.doubleclick.net
ad.yieldmanager.com
ads.rubiconproject.com
adservice.google.com
adservice.google.de
api.viglink.com
as-sec.casalemedia.com
b.sharethrough.com
beacon-eu-ams3.rubiconproject.com
beacon.tru.am
btlr.sharethrough.com
c.evidon.com
c.go-mpulse.net
cbsadsales-a.akamaihd.net
cbsdfp5832910442.s.moatpixel.com
cbsi.demdex.net
cbsinteractive.hb.omtrdc.net
cdn-gl.imrworldwide.com
cdn.jsdelivr.net
cdn.taboola.com
cdn.viglink.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
creatives.techrepublic.com
csi.gstatic.com
d.agkn.com
dpm.demdex.net
dw.cbsi.com
eus.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
idsync.rlcdn.com
iicbsi-a.akamaihd.net
images.taboola.com
imasdk.googleapis.com
in.ml314.com
inqlnfvog763mmf771rou737u.litix.io
js-sec.indexww.com
js.agkn.com
l.betrad.com
lightboxapi2.azurewebsites.net
lightboxapi3.azurewebsites.net
match.adsrvr.org
ml314.com
native.sharethrough.com
optimized-by.rubiconproject.com
pagead2.googlesyndication.com
pixel.everesttech.net
pixel.mathtag.com
platform-cdn.sharethrough.com
ps.eyeota.net
px.moatads.com
rev.cbsi.com
s0.2mdn.net
saa.cbsi.com
sb.scorecardresearch.com
secure-us.imrworldwide.com
secure.adnxs.com
securepubads.g.doubleclick.net
som.cbsi.com
static.sharethrough.com
str-assets.imgix.net
sync.crwdcntrl.net
t.co
tags.bluekai.com
tags.tiqcdn.com
techrepublicmedia.akamaized.net
tpc.googlesyndication.com
trc.taboola.com
tru.am
vidtech.cbsinteractive.com
web-sdk.urbanairship.com
widget.perfectmarket.com
www.everestjs.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagservices.com
www.lightboxcdn.com
www.summerhamster.com
www.zdnet.com
z.moatads.com
zdnet-1.disqus.com
zdnet1.cbsistatic.com
zdnet2.cbsistatic.com
zdnet3.cbsistatic.com
zdnet4.cbsistatic.com
zn_3xebfjduss0srw5-cbs.siteintercept.qualtrics.com
techrepublicmedia.akamaized.net
104.109.87.166
104.111.214.103
104.111.214.229
104.111.215.136
104.111.230.142
104.244.42.133
143.204.214.109
143.204.214.80
143.204.214.86
151.101.1.181
151.101.120.134
151.101.122.133
151.101.2.2
172.217.16.130
172.217.16.166
172.217.23.130
172.217.23.162
18.185.208.109
18.197.149.199
2.16.186.10
2.18.232.206
2.18.233.143
2.18.233.149
2.18.233.201
2.18.234.21
2.18.235.40
213.19.162.57
213.19.162.61
23.211.2.27
23.67.133.23
23.99.128.52
2600:9000:200d:7400:15:efbc:e300:93a1
2606:4700:20::6819:a322
2606:4700::6810:4fa5
2606:4700::6810:5514
2606:4700::6810:a10d
2607:f8b0:4002:c0c::5e
2a00:1288:110:833::4000
2a00:1450:4001:808::2002
2a00:1450:4001:80b::2002
2a00:1450:4001:814::2002
2a00:1450:4001:815::2001
2a00:1450:4001:816::200e
2a00:1450:4001:81f::2002
2a00:1450:4001:820::2002
2a00:1450:4001:820::2003
2a00:1450:4001:820::200a
2a00:1450:4001:821::2006
2a00:1450:4001:824::2004
2a00:1450:4001:825::2003
2a02:26f0:6c00:197::e3d
2a02:26f0:6c00::210:ba12
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f107:83:face:b00c:0:25de
2a04:4e42::720
3.122.36.177
34.192.38.147
34.199.66.75
34.233.1.251
34.235.206.33
34.235.30.148
34.240.175.172
34.246.247.78
34.255.169.159
35.177.197.190
37.252.172.70
52.17.182.129
52.208.88.219
52.213.58.51
52.72.207.232
54.145.115.34
54.165.7.225
54.171.224.12
54.171.227.173
54.72.87.193
63.140.43.34
63.140.43.37
64.30.228.207
64.30.230.22
66.117.28.68
66.117.28.86
95.101.194.150
99.84.8.118
0025565f0cddfceb7ebdbc4b21d2552c894998e443153f97a6e8b353dfd9bebd
0325e248491bb36d9c780a5931986a4b5913c20e138eaaddcfd44a0447fbc0d7
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
04e41b27e7c2c734bb2b29e2c3d0e121c15cf99d524c084a1cac59f54c853d57
05810003dc685a05be39bb0dccf45f696dbf053bedff37512d8b0b016697df30
0670a9b776355524c521a3f31f3bcbaf8bfa71681c326be2915310b100f4eb1a
07a169c5ae41e3b924a062f69afdd51c9873fa22d3929f0d90545091df166d44
07b69027231d985f5bdcd4d5a539f120d26003feef6e9dc0a6b77a4b43a9b21f
081873caa83744b6d819ab294b08927e20b60841dd8f23a87c2a57e15f65591c
091f22ee9132a45b69120f7c34c7f090f4e2694ab23267b34fb384ac6573ccfd
0c163d79b9c69d7c02c4bcc3e3bebea07c68aa6cd7de232146b4e128245afdb7
0dd91e59e964377d91851af0a2aa172c1c2832ffa3391b3f527421f90be7666c
0e13cd6845611f0c419398a75b85ba014a7fffb1b9e9575c2e1b4cfefebd0017
0e4e46fa1aa04c24e793912d7aabaa2f2b0f7dc03d73cf74fbe12cb84f062554
0ec767ddd74f5a54aafc6e910cf2d9c21ffff23d64f0b4d92b559da26b76d5f7
0f4176807e149be9c6cc0e583699fffe630cccb37e57242ce5a7b1f7d63d859d
0f91e664ba993207337dbd5b1ab9f156c5f579d99d9b2e1315706815deadd0ae
10113bad06fefd5698a45480ffaedd421c6e06f9dbd0d1c772b7128bbea0842d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11c381a5cdea03b9d438c209b4e53197c4a2e67b9b243c472ef8a6a3a0478f15
1248d29a870a1c2b43e881497a3c7d5046d2a1bd2784e3782fdee46d147edd67
1491a1594a4058a62ea4c08441cfcbbfe82a0916b4f26b55f3605af896766dd7
1579c26385b707d4b6f54b0ddd06043fa570caaaa0cb41283b8b88f9f16aef6e
1724d7fd70903754d6f29172f2ac879dc6dab79df6c4c78ed06f45c0f117e15c
189bac19ed72631b5d881ef5cd82042a1deb6f2e84ffcc2f09888db4581a14bc
18acd09ec1584113e42232bb972da74ec2ed2d0bf58458b6bdccf45c5f9d9c1c
1b91058b5969c2319ee3f3efb2b91ccf388c64fe22f806e59b0edb43694150d4
1c0ccb11374e2374cb7a52c792ffe07d9203d28d4ad97623bcf27bc58d2513f9
1c21dd409e977f176ae963b5510fbdd57669e9861fff9f5d9a46b6fc73f430fa
1c4bd6569f1436221fc4c6309456f705025e64a97af386eac4be33d432cb3fad
1c9936e889b081a50780b09336123729dfe611d241cdc08cd627061995e168f6
1d1eab2e9d5b36e1297db68599d3e9c3df71869a0863fb261972b93e919d7af1
1d4d518e1da495fb6d6d8b3d86bba79d7597b61b466e71c45cdb09ed79659c53
1e323dbeea0c9e92937c9569b5310027d4afa488b81906993a005ecf7ff9ca40
21b11546ec9cc1157cf43b45268108de0c19e561aefca3148cee8a299c76ad69
223e28eecc4a5536d595b32357b763fbccfefb9ddd1ca0aa94323e895984e8b3
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
27676ea482895bdddd3f3796f430a812e11364efc224227c86973a52398966c2
27cd569efd4a5e1be8a63597fb40ac2f9d29f4db0f5eb4686bf99469fbeb779c
28e2960b8daa25db02de7244e062aa66f9134462ca6b62975a01667e42fb08ba
29290d148b95461a19454237570d190b77b689fff343f85fb160d9fa1873eac6
2c74bfb0845ea3dba284aeecc89879263177d39b29187366ed39c7dba7125e04
2d3e9015bb665cc4e62a0aada26a74311bf87ba40e12b896724f447a98e68a89
2e8a7f9a54c5cdcd46f59e055e6e2bd1f56e511fe958bf1b42a3dd1e351b53b9
2f00ffcd2cd563cfc9f5942b26ccadb11f5524c628c51cb66a5fe009cda9bce7
309e20d540054848c2bee4268a2ec8e37656da9e7d5f8084c6f66f4fd711aed6
343b16db122aec6814fa5d708b0d2640a0e42d1f29ee0d98c796b3ec722c22ed
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
35733dd71de077b039d2bac6614c78eb3ab7d3879cb307cc10cc1907d2f61eb6
366dd5f07685f15ce8fbf1ef89dc1831f87e77274e8eaca4c175aae3c8db4fa4
382fde4c3b7f67dd0cd604e32a416a7444d16c554ce47db1ca15dd7562eb975a
3905d3b0fd6276509a8eba066ad829e40dbbc02cc56d5b14eaa030323028ce3e
39592ddbdbadaa388b4caae32b981aa586b7de875ac1c31a0ce252bf41394f3c
3ae5d0f70dfeb1308462aaaa19d8326a6bd2d41781323b07db04cccffc09cf5f
3b1d15aa16a5e57161ab8e2ba5eabf91f90dcf15d11cc65bfc03adfdecd654af
3bd097e0a2ffab3241922a0b074d76dcdd1a75d43e1c9556e7f1e8e5939994cc
3e2f324389d28812d8b269dc4773087af97aa64560834ea13ef504ffd181f781
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
3e75b859bf35abaddc889d6b4ffdb4582b01a66bdceef816b57043b477e85cbc
3ff065de0d90b0510727a72c173d05652c30967c5e6561dbf1d82fa077cabb22
4055b2bd50dca3fe0011680651cc8a81a939ce5f195e0bc435f43880acdcde83
42524a0bbe884559ead24e7d660fe008ede736851ca050875a6c6fc6441f3d1c
44174c2f84a5b2e11079ee9fbefe39f1d699fdd9bfcea3ae1e84ab2809ca2de9
456887b6e9592979b8525ec06fb2b3a24de69ed0388001771d0ee02031bb9086
45fd3260d9335d17504007cb23b3a142be18b0c1e88cc8ba0e242478b9dd897d
4974c54f5183f50fd1f3c3d49c496fd79602f8159b6d393d3fab09e4433555dd
497bac55b8d1afbbb4250b3e05c457590c57c1b1e01ae937f6f60fe2bf79462f
4b51cad50779921c134fe5f8a46df29da7bdedf5f643c331d192b6057af97992
4b862283bb0b7628d0a044ee87ae769795382c60338e8690c5bd9a65261aec44
4f72e8df44e82a8066b16ca8ab2d59f8f9ef21fa52c07d8554972f48b5105f13
50e258894c35132a6e6650553a2ca25c007c449a6c065f145ef0bc1eb9637a58
51bddbe1523c98a951eb7c556aed35ee56d970fe3ee87efe8443fde968ad59f9
527c0c0c1a578554c4475a506762fb90fe7af774e9fa3aa12a8e46098971ab80
534f2f25f81301ecc9f48fb15f9e75088d334a1a9d3c0ea35757a9bc7519870f
56b1ab920150e9ebc47c4e6ec87c70c05af7a50edb4a9fccfc52fd3a261f7b90
5702f1ec93a14aa36a5120d29618fec7f8e49a4cb52c742c177d4ce318e11583
576ba362603444996deb95a7cddb2432e74937759ac34ddb571328e5ef1f0de2
576e8bf4510a62d7cdcfedd8b749f3039d0c5aa8b2bdfe2e38a44645e0f982e4
57e1e8e64fe95a0acc0822d690633b9450b26919fcedc32958ebcf7d39393181
592a90fbaae1f84e757b6585999e04f1d2c39cc7568285aac75f7e42e1e734c3
5998ea0ddeb88858fb1d3cac734662086a999298da0eadb3da62e19fd8907f83
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5b4f35da519cd7ef263aa48d3c0061acf643d692670412523a1166fe4d845845
5c07e505644f3fb108d78aea0fda66308640c68b73bba3a62cf2c4113e97f6c0
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5ecc6a93ec2939faa8dbf80084346c7d940f5a2181ee69343810da52902eb92d
5ff3e87f6937201a01936ab86e549cf89396892ba3bf3884dbe29d7b1d6277f6
61c7775dd53bf4483c287392a1194232ed17a29eeec5f64896c57ff53c5e66ef
62f2eeec7851ae0d5e322062cf40092478236d4a4fc5a2cfd87b257739104147
660ce45278eb580ba9a3be98b96a36462987a8788aaeba31b1f34e740bba7436
66ef1b7581d8ef7b82bfe2ca363a612a479d89b808e2241f68d3e8c75f4f06d4
67f98d21d0b019006060e627133c9f47006581f42f84050c85b88095338d85f8
68661329a1cd69d6d40894a3531b37e648a4057832a3ab433afc6abd1d64d313
69721aa2f1085046c84d1943a1daa0515be8e2f060c21063024ea117789e425c
698d9814ab21541807e6d3364e450ecbd3f45536fbf67c59e36f993cb544ca35
69ab1a2de27af9982ac383ba968b31150b40465eee67ccd2cb540397dd372c14
6b536d88c3df185fc95a5c3120148b75da6dbe0960d3108642c9ec87d239f727
6bb981959d783d83df88b9aa48738948c9a8a22c1a31b8cb5305d3e338ebf9a7
6de73873dd441f953668e77030299f082e0f3e6335bf944d88d44978162e6609
6ee11fe3dee241762a48c675b874ee3d25c02f695f8b5c6652f7596bcba84146
6f1ecdc6e1cc25f45a4e443feab35fb71d5a138c6794b5e1c5776d7c51536850
748351ae61f6d52d56b073486ce980e0305e0df6b7a0866c7a129e636ecf835c
749f1db8e5816cc120f6eb046ab08188e94528d8f0d8ab45bde3738b948cfe44
763fa0bd7eff816d0a5f8c3e4075f9173a5cebf51a1e2c0d1174f841de10b9dd
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
7889842e100fa40874f58d342b8cf68317a2f7ae0a38de7319e5926b24cbb347
791b7ff5657f9c41e24adaa1f6f5a4dc51046d292b25b01a5a8d152ff4a951ac
7a1c6137f5ed3900e2b07d0c6785da9915da4e44dea8aabac8c3ddaad73b4ca2
7aa91de94b48accc2edb54d589727a31df97a2c8be30f665f44746cc0ee023d8
7e9696aabfbb60803028b14636581f459404cea187d0c0c50b7d4d5cf8e1a3b1
7eae865fd7c820936603897a072b7ddd77b2c74e8022160fd19792291a63fac8
814fc328c94f6c4693c0d960425db2c2cda5c48ac07cd68248ef49483bb1a0a5
8238f5f25e0f6c79352684181f41e1f8fb226fbbeefe07cb21aa9c074b5141b2
826759288201eac098fea118a62463043bf7d3880164ff29bcb6058b31ab5cdb
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f52b572975b475afb869014a0efcb4a50339d8e116ceee9cb622c61b14d473
8677698d257a0e229eee4cf3b6c40dfa04bf2d2057f0591f856b3af090b36a41
86edc57c3493939956537eb5ec5d45a0e4d9077f8e104f1ec3bda0fd0da8d674
88af97624c853db3e3193068cf680f6f61961ef889b984ac3d477377d13694b3
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a27fab6c5a0b1db438219c7d24ce2fff95e0910378fe4bdeb64b4f970eebccc
8ba131a677ea1357ae7fdc95d6a5c67c3b02d171bb286f6c9ec6bce3cef5c211
8c0702ef2a629a8d6e4ce1ffd10791e9463ff2706bc57d0fdbb81b32de845fe7
8cbc6f6b56bd4267915a2dc3fb476ff37dc18f9abcaf7fe8768afad282d809b6
9054d29b95733bdf0cfbe40f3831248046b2ca565ef4332366327b7dc3518bd4
927048ad11de8981ab14882b0cac610a1c194aa991d07247cdbf875032dec422
9337d4f2ef8a00759da573e178e302712fec944ac54cfd808f48c526b9816d3b
94821abc572dfe5903d78f557c8cd2ffd5aed758ae2e1598448ea2eefdbef84d
94eda68ef465fcff5393659fd95ec043d732f3a7254fa695e4edfed349a4c94c
9687cf4b6e3c95db7e0e064bc98d4e2821c7eded418cdabfe50f9d157e13022e
96cf2e499d0aa55ab3638bcbd9e9d54982e20dbae123f214d857eb1b77cbbaac
97cc5d66b92bfefff1a0f96e4f06981d6e1261d9c67da523365b7fabaec6ab77
98a91b898a824dd0cf24f33ff1e83eed96b8846b34906a04d148d679ec76328a
99d71bfbd5b10b27442706ec707c0bb51976a9a43ee3ab6bf5d7888d4230e19c
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9db8bd3e641dc88d54edf476a148e75e29b4e8ccd040cb340404d557578dcfbd
a002d29c9492e0679d163afa2f2eb9828dfb00fe517bacdddfae7070e2fc04b3
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0dd0d42e82bfcc16e96fb72d732787a0edf0bc99b0a34f6f6eaaf1d1b32a8f9
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2a804abed27cf1276fba69a26f3da96befe05f5661af72545fc97a508c82e5e
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a3273dce4deb1a87d9c6b75ce1b9305872ee56ad6da2ab873858d9d20d1ff3a8
a3fc1372b0b5633793c73f767e6e8c999f9f5ff9e3e6e0b412826ec1af74ef9b
a42c55f8a0a47f3c876221eb7ed577c044f59ab90ed2395d592ce0f245d278b9
a4d452555ef3c54319d8528439b6d27eea5e7cf579b89303b72a00e54c0dfbf5
aac30469f689bc02880c5bf16bb0377b7c3c1e8ef82eb938c30e597112c87628
ab0704fcb4965e24cd6066329fc4af74832ed7a95498fcc0935d8fc7b03b758e
acf3b5b3ade1391096f23120b725a032dce430448ba8aff2a6f0c3f9c598b2a3
afd311dd346d987f9c1bd97d8d39dd49f68b3a19aa2e2844fc5e72bee545daa3
b1306e0bddee25498a07d408621acee737c6ddf7b8a84079879481f0877668eb
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b14e016720fd0d8e3d338716f29d0b33d19bfc93279d0309ba75925c8384f6e6
b2ab8784d5ca4bc5e4e1990ba55c6d9f041b8fe8cf41ad9afa37bc1c3dd12756
b3bd90c13adfc8669f005d1d87e89f6e5c637e3656a0ac4b2fffaf3e6cf883f2
b5d047c9cfeaab36c22d219ad63f1320ab177bdc3f5c7345daaac22f07c1d272
b897168b2c33a6b7fa55e5ae1852de95bb9a80cad540ef77b5c2458ca8f2c784
b8c15c61feffdfe68b168cf2ac8cf58867f38547da3b15d7971a75c44f16bc26
b9d6fddb0988440902fcfc72f371ecfa80ee2eb36073f9eebc17449ee41c886f
ba2fa15976662b87f31dccdd53d415b927f2118760fdafc4ac21dd2c1b234ff3
ba51b58715ae4fc95299983d24084284cedc4ac7ffd840818517d1997b9c68a5
bcf58131ecb05e295093138b95f5bb6d7e0a26b8a3bdf6243184baa26371cade
bd30ffd9618eaa423abb4c900f4af01cac18be85d75265ba08d87d5230bf85b8
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
bfdd00df7d044aee98ae6a057d826479041e36972d77e0190401d8cecf913358
c11b9a046106f278a5fb5411e95c1ba5d6f06daf9e4bfa98da51c523e4157388
c13552944b0ca91101e9d1fe16c0a220e0851634ea1e6e95d832858d9fd9b9ea
c2c432e808e795014171d087ba8abd58d8337f59ad387c08d8a6c6b3c32106fb
c34da761727d7d301b12207d336e5b0486df63e2bb18fcf279769d519900b5a7
c3c1fef1252e9eb1cd27934e734714bb7490a105362d4e831aaf32677c284536
c480ce7d4d5f2fb023403c864eac3350b46fab68728482d625d4d4b45b049427
c4b985401a0cb64b9e88935039dbfebd88c276c78603f1ff0b09288008afca20
c5ed40064116613618498a83645bf2064a2e8dc34948cf93005ff6d7863ea30a
c6df1bf046eea1d51b9b30f72f87f5c6d13f4fea02b8efc48ac386557e8bb32a
c8a6d6006718ee7a80977294992376112600b26c4661e984bccfeaed715fbcfd
ccc8f0213349ee58951a6ee6c63443f9f70b9787f3357ef952105e6e253da655
cd1d44243c825f1c5b6fece79fb2f3605907af8e9948469e3be7fe265a74e6dc
cd5e6512fdbb698425174148dba05f72357a3b1944413f8812c55c4025d3d562
cdfffe04dd3bedc6b4d55766ac77df7ca133d5cd7df9b4da219b91c63773869e
ce6a918d0fade0e75a9ecf3dabb9eaa08c0c34af6ca838defe9adc31768b6995
ceffb891c3e1891757ead2e7e41497adc13abca0d14d7f58d20e3aa8d5aee108
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf65e308f1c461e06038b45d5bfa27689e22241f6b673b7d540d35cdd0ca4c32
d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d1a0a88486d3874e2bff42dda5e558fd62790464ca65ba2acea9e0bca514b3a0
d2fe67ecc4354b214728e0a7d75b67536a78f6b575080b589d54a1937fc46b41
d48e0904f1b40972f1fc6dac3f358719e080fab3291d13d2ca4a60405707a88b
d4bf85df37940345c4a0795bcc6556e480751e36f503425c25b1993071e90c9c
d4ccc0936dea09d1846d5bb1487dd533738e598752d8215cd883f77b3cd91d4b
d5b9fee6c9e52a8ce55741081bc61d6e944026dc19b92d8ac06144314080fd9d
d5e9dfd6066c2872be4f85c25aa0186402b124ea3f80152e2e2b767906793284
d6305c6ca4187969344afb4397344a451f65786537f4f54302c59f38c07f0a9d
d66ff08e71650494544e169b9dac586d6b891002b458bada248c29702bc0f9df
d696da403b0169c2191d0ec0b0fcdaa85487b21b19fd58f4b1fb5b9edf40b153
d6f28c2ecc7e7b603cead026b3febaa53ef60ef1ee17095ccaa5bfd465565e5e
d9993f23ac0ad90b8490b44fbb5803222e4c24389137007d970ae6fa371d9426
da07e38e7eb1d5671ac8e8cee706d83997521051aa91a9b38251c184d9144230
da52af54b0a90f89c3b6c3482a53119a588e68f99f3cb4d7af0e4460ff8e5016
da8e47bfc536f94a3d784e8f094a96b41244efe4b42ea8b857cc6169cd55e47c
dabf73474662398f4f686a1b3103542f53384dd6241e6ac13f8ba535c6372aff
dbbaa3846da2488b06c96ac68e3885c9f3c623cb730e09044c873c7527f9ef96
dbe433fd93ce167d7ab3165a4274bb9e4caa01404c0ac6d87c10bdd376f24ef7
dc2b90567b4e153621056250d4537bca194fa51d9d218c82f05cb9a4e07980aa
dcae6922d356bb058d143bc1268fb79266ab74e79933c947b592145920137de0
de4b8c1882f3c5f3e8d7ed920d1f4f31865ee05228fa7c60800656f3b279287d
de749bdbeeb7bb7f79cb31ff00fe6830004064419f73fe9a6ec982e9de8bf19d
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
ded5e33cf5c8a626dec0b35a3985aa37cbf5c23153fc32ec53aa81111c7e5109
e08209b44a15fd9f6b9977d2580034e8d3da36542235802c2722ff8db4c0a461
e08f7f02be50f559acd7166c57472078d9277ad251cb71b446cff681f92f74dd
e0b8436d50fb200de76d7a25cf450ea238cd100197f8e9d462e9228153da873f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e482ba089d973ca257acfd70b2d7541447d5d333449b106d5c3dffebe322566a
e4893cdf68767df27f118085e884a8c9da84230a1412c630d117f4cbec3c9688
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e624dffee1d0f645d4dc8a5bbf8b5df999a9536e4cf6583a4646997e4809d981
e69a7002a27c3e0390efc9dc0478e0d1f8637017c52f37270e3f58dc754aa9ba
e6b7af9cebec6e08f0d84046a51912d2e7dac2070a46d3d4ecf42673432f76ac
e7d3f48ce3af3303f77d30969b0e3ef39983c52e2b74fbb7cd23d43cd64fa969
e884428110b94ddd472b35bd0a415fd5493ee5456631ee1a238ff3c3a9c57818
e9671a96669a66f6cb6b8b0008ff3661d6cb18515c78ad68da5a60222283212a
e9a4d90f147ce964245ed1d4c52269e22b2e8be39d9c0d289ecbfc89cb5d0dec
e9b3eb7f022396e969766ad5e908b21df0b646c943e149902c64de590e9549d9
ea8709c333523eaa79e47d2670f5bbb49c469bf52de4d4c5d4b83571ec14da65
ee9c37795c79a1eed787b12e2c9ed9b327ac01cf0843ef63e916c64eb10ddeec
eeb25e7b51977245f7d5218163af6614ec2211005fe746bee7b8cd4bbcb9fdd8
eeebdc424df0ec012ef91836202ad1a76cdbc46557c9f6a809f1b63273cd0988
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0015edc70a1c3d75c903154e9df004769a36563ea8696f1524b585429e3a58e
f04be93e144932a277b3b79253acc171ea7bbb59460c33d2f4f07dcf684a6b14
f05f427c0a3425f17ce1b199296557b22f8b385c963696f80d588f692364abca
f0a8ddb225b2c3387fec857e9281f571cb8d707045427179ca3403da280dd6ad
f27c0c9f284c6959dd7db1e768c6e43a518ea650afc69d7a60383f3a963cde7b
f4a21231c33148c4a2f96e28fb7cb4dcd1c247cdc0347755cd7c78bdef22c161
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f68ec7cf550e86cb14e4d992724157c4f625ea3f0cd7d06e9e533c17c735401d
f882e21c26aa874216d4e620fa3392b012a490404cc065f4e7748699b1a58023
f92514f4e39c16da9037f964148a09a79419744b77d611860ffc81c86aeace0a
f96f203f5605c9f56e7f6f97caf6ea84f122872ec3c5ac1f9037a1b508c706ee
f9784f57729f84391b084eed9e944e048f771129d65e9b58f34095fdfba86473
fa33d1db535d783b0baf4e74bdc7ce9e54633f87a03669b2803e567088d64ccb
fb9007c254c493be4a067de535b19a30f5e5aef3d5b19f58b1c72d2c65a04f79
fcd07d34fcaef424349817bb9d28149d460ad72e66cbb532a830ac5d7a0c5d38
fd58c72e2037127f17c2c3d0c53116c75eab402ae74b8a6fc415c79833fda846
fd9faddcffbc92c87f36ce5edea2e116bb7c228d4a0328c6104d42920c60e643
ff2ae991ac0efdb5ae8b4428ba8555a0aeb0fd94b8014ce290c484242c524097